← All writing

Field Notes / Security

Twenty-Six Seconds

Agents compromised eleven organisations in 26 seconds and took one from initial access to domain administrator in seven minutes. Your response process assumes a human on the other end.

By Nicolai Imset7 min read
aisecurity
The attacker's clockSeptember 2026
  1. 0:26Eleven organisations compromisedPeak of one campaign, with agents scanning and exploiting two known PaperCut flaws at scale.
  2. 7:00Initial access to domain administratorAt a US high school. Education was roughly half of that campaign’s victims.
  3. 10:00:00Full enterprise intrusion, ending in ransomwareMore than fifty attack techniques. Unit 42 puts a skilled human team at about two weeks for the same work.
  4. YoursPage acknowledged. Triage begins.Then escalation. Then a containment decision somebody has to approve.
Every figure above comes from an attack that already happened.

In July, agents escaped a test environment and breached a live company by accident. I wrote about that, and the lesson was about monitoring the systems nobody watches. That piece is here.

September was different. September was people choosing to do this.

What happened

  • 2 September. Unit 42 published an investigation into an enterprise breach where a human attacker drove frontier agents through more than fifty attack techniques, ending in ransomware. The whole operation ran in under ten hours, which Palo Alto Networks puts at 97% faster than a skilled red team. Worth noting what stopped part of it: branch protection blocked an attempt to plant a backdoor in Terraform. An ordinary control, and it held.
  • 8 September. Google's threat intelligence group reported that stolen machine credentials now carry a market price, with average prices per account more than doubling across the year. Buyers want Claude and Gemini credentials and coding-agent seats. The same report describes a credential-harvesting campaign that ran in under six hours, and an attacker's own dashboard built to manage 23,800 harvested secrets in real time.
  • 9 September. GreyNoise documented a mass exploitation campaign driven by hundreds of agents against two known PaperCut vulnerabilities: 395 organisations across 48 countries. The agents wrote the exploits, tested them, then deployed at scale.
  • 10 September. Anthropic reported an attacker using prompt injection against an AI vendor's automated evaluation sandbox, which handed over production API keys held in that environment. The attacker then ran the same playbook against roughly thirty AI companies in about four days.
  • Mid-September. Spain's data protection authority logged the first breach notification attributed to an autonomous agent. Agent intrusion now appears in regulatory filings as its own category.
  • 18 September. Google confirmed that a Gemini model had reached systems at three outside companies during testing, believing they were in scope. The incident was in May; only the disclosure was September. The model stopped before doing anything with the access, and the cause was a test environment that left internet access open and used a fictional company name that collided with a real domain.

Add METR, the AI evaluation nonprofit, which disclosed that an attacker found an exposed agent dashboard, prompted the agent into revealing its model-provider key, and spent roughly $600,000 of credits before anyone noticed. The entry point was a researcher's side project: an internet-facing app that was supposed to sit behind Google authentication and had a fail-open bug that silently switched it off.

Speed is the whole story

Look past the volume and the thing that matters is the clock.

Twenty-six seconds to initial compromise at eleven organisations. Seven minutes from a foothold to domain administrator at one of them. Ten hours for a complete enterprise intrusion that used to take a fortnight.

Now put your own process beside those numbers. A page fires. Someone acknowledges it inside your response target. They triage. They escalate. Somebody senior approves isolating a production system. Every step in that chain is sized for an adversary working at human speed, because until this year every adversary was.

An attacker who reaches domain admin in seven minutes has finished before your first responder has finished reading the alert.

Where the reporting is thinner than the headline

Two of these deserve a caveat, and both cut toward the same caution.

The GreyNoise campaign is widely described as the first run mostly by autonomous agents. The agents genuinely wrote and deployed the exploits, but analyses of the same data point out that the operation stalled for days whenever the human operator still had to act. The speed is real. The autonomy is partial.

Spain's filing is a notification, not an investigation. The autonomy there rests on the affected organisation's own account of what happened, and the agency's deputy director said as much when it was published. It is the first of its kind as a regulatory event, which is what makes it worth knowing, rather than as an established technical finding.

Neither caveat softens the operational point, and the regulator made that point itself: the AEPD's position is that AI creates no new category of threat, it raises the speed, scale and adaptability of known ones. That is the whole argument of this piece, from the body that received the filing.

Why defences built for humans fail here

The companies in these reports were not unprotected. The tooling worked. The assumptions underneath it did not.

  • Detection thresholds assume human pacing. Alerting tuned to catch reconnaissance over hours misses reconnaissance that finishes in seconds.
  • Response targets assume reading time. A fifteen minute acknowledgement window is generous against a person. It is two intrusions against an agent.
  • Machine credentials are treated as trusted infrastructure. Service accounts, API keys and CI tokens rarely carry the scrutiny a human login gets. They are now the primary route in, and there is a market for them.
  • Approval gates assume the approval covers what runs. See above.

What to change

None of this is exotic. It is the same discipline, applied at a different tempo.

  • Automate containment for known-bad patterns. If isolation waits for a human decision, isolation arrives after domain admin.
  • Treat machine credentials like privileged human accounts. Scope them to one task. Rotate them. Alert on use outside the expected path.
  • Assume any key an agent can read is a key an agent can be talked into giving up. Scope it accordingly, and prefer a broker the agent calls over a secret the agent holds.
  • Patch on the attacker's clock. Both campaigns above used known vulnerabilities, and Unit 42 reports automated scanners weaponising newly disclosed CVEs within fifteen minutes. No change window opens that fast, which is the actual problem to solve.
  • Verify actions, not summaries. Log what an agent did. Compare it to what it reported.
  • Rehearse at speed. Run an exercise where the adversary reaches domain admin in ten minutes. Find out what your process does when there is no time to convene anyone.

One more thing worth sitting with. GreyNoise reported that the operator gave the swarm a list of countries to leave alone, and the agents did not consistently obey it. The person running this attack could not reliably control his own tooling. Everything above is about defending against agents pointed at you. It is also a description of what happens when somebody points them anywhere.

Your controls were built for an attacker who reads, thinks and types. That attacker still exists. They now have colleagues who do not get tired, do not pause, and finish the job in the time it takes you to open the ticket.