More Than 50 Techniques in Under Ten Hours. Branch Protection Was the Only Control That Held

More than 50 MITRE ATT&CK techniques, executed in less than 10 hours. Unit 42’s own baseline for the same scope, performed by human operators, is around two weeks. No zero-day was used. The attacker supplied objectives; an agent supplied the tradecraft.

That compression ratio is the number the report leads with, from the Unit 42 investigation published in September 2026. It is the least useful part of the report.

The useful part is the timeline. Walk it control by control, and the write-up stops being a story about speed and becomes an inventory of which enterprise controls survived contact with an agent and which did not. Several named surfaces failed. One held. The one that held has a property the others lack, and that property is the whole finding.

What Actually Happened, Stage by Stage

Unit 42 describes a chain with distinct stages, each mapping to a control most enterprises believe they already have.

The entry point was a public API endpoint. It was breached. Perimeter control: failed.

From there, sub-agents went through repositories and extracted hard-coded tokens. Secret hygiene in source code: failed. This is one of the oldest findings in application security and it is still the one that pays.

Those tokens reached the secrets management system, and the agent harvested master credentials from it. That is the stage worth sitting with. A secrets manager is bought to contain exactly this: the damage from a leaked token. Here it became an amplifier: one hard-coded token in a repository reached the master credentials the vault held.

Then the CI/CD pipeline was hijacked through custom workflows. Pipeline integrity: failed. And stolen cloud keys were repurposed to turn the victim’s own AI endpoints into post-compromise infrastructure. The organization’s AI spend became the attacker’s compute budget.

Unit 42 also reports one attempt that did not work. The agent tried to plant a backdoor in Terraform. Branch protection on the infrastructure-as-code repository blocked it. That is the only control the report describes as having stopped a step.

I want to be careful here, because the report is a single investigation and one blocked step is not a controlled experiment. Unit 42 does not claim that branch protection is the answer. But the asymmetry between what failed and what held is specific enough to reason about, and the reasoning holds up.

The Property That Separated Them

Look at the failures as a set. The perimeter API, the token in the repository, the secrets manager, the pipeline. Each of these controls is real, funded, and probably audited. Each of them also depends, at the moment of compromise, on something happening outside the control itself: an alert reaching someone, a review being performed, an anomaly being noticed, a token being rotated on a schedule built for weeks, not hours.

Branch protection does not work that way. It is a precondition on the write. The push either satisfies the rule or the write does not land. No human is consulted, no queue is drained, no analyst has to be awake. The control is not a detection that produces work for a person. It is a refusal that executes in the same instant as the attempt.

At the two weeks a human team would have needed for the same scope, the difference between those two shapes of control is invisible. There is enough slack for a human to enter the loop. At under ten hours, with more than 50 techniques already spent, the slack is gone. A control that produces an alert and waits is, functionally, a control that logs the breach.

That is the finding I would take to a board: the controls that survive machine speed are the ones that do not require a human to be watching when they fire.

Why the Agent Was Fast, in Mechanical Terms

The speed was not magic, and the mechanics Unit 42 names are worth reading as engineering rather than as threat theater.

The operation used parallel LLM calls across multiple frontier models. It used structured Markdown files as inter-agent state, which is to say the coordination substrate was a filesystem, not a bespoke framework. Persistence was layered and overlapping: SSH keys, serverless functions, container restart policies, cloud identities. Each of those is a separate foothold with a separate lifecycle, and evicting one leaves the others intact.

The agent also produced, at the attacker’s direction, an 80-page technical audit detailing dozens of exploited findings. The output artifact of the intrusion was a deliverable. That detail says more about the operating model than the technique count does: the human ran this like a project with a reporting requirement, and the agent filled the analyst role.

Nothing in that list requires a novel capability. Parallel model calls, files as shared state, multiple persistence mechanisms. Any team that has built an agent system recognizes all of it, because it is the same architecture, pointed at a different objective.

The Capability Curve Is Not Flat

In September 2026, CNBC reported that OpenAI says its Astra model can find previously unknown security flaws and exploit them without step-by-step guidance from humans, crossing the ‘Critical’ cybersecurity threshold in OpenAI’s Preparedness Framework for the first time. The capability is gated to a coalition named Daybreak.

Astra had nothing to do with the Unit 42 intrusion, and I am not going to pretend otherwise. The two data points sit next to each other for a different reason. The Unit 42 attacker still had to supply objectives and direction; the agent supplied execution. Astra is described as removing the need for the step-by-step half of that. Gating is a real mitigation for the specific model, and it says nothing about what an equivalent capability looks like when it is no longer gated.

If your control model already assumes an adversary who executes more than 50 techniques in under ten hours, the direction of that curve is a planning input. If it assumes two weeks, the curve is a problem you have not started on.

Do This Now: Sort Your Controls Into Two Piles

This is a one-hour exercise, and it needs the security lead and the platform lead in the same room.

List the controls you would name if a regulator asked how you would contain a credential compromise. For each one, answer a single question: does this control block the action, or does it produce a signal that a person has to act on?

Blocking controls include branch protection with no bypass path, required reviews that gate the merge itself, deny-by-default network policy, admission controllers that reject a manifest, short-lived credentials that expire without anyone deciding to revoke them, and write paths that are simply absent for the identity in question.

Signal controls include everything that ends in a dashboard, a ticket, an email, or a page. They are worth having. They are not what stands between an agent and your Terraform state inside a ten-hour window.

Then take the surfaces Unit 42 watched fail and audit yours against them specifically. Are hard-coded tokens findable in your repositories right now, by a scan you run rather than one you assume ran? Does a token compromise in one repository reach your secrets manager’s master credentials, or is that path segmented? Can a workflow file change in a pull request alter what your CI pipeline executes, without a separate approval? Can a compromised cloud identity invoke your own model endpoints, and would that show up as anything other than a spend anomaly at month end?

The answers will be uncomfortable, and the discomfort is the point. We have argued before that detection has to shift from techniques to intent and that blast radius is the design unit. This case adds the third piece. Between those two, at execution time, sits the question of whether the control needs you awake.

Branch protection held because nobody had to be paged for it to work. Build more controls with that property.

---

This analysis synthesizes An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation (Unit 42, Palo Alto Networks, September 2026) and OpenAI says its Astra AI model crosses ‘Critical’ cybersecurity capability threshold (CNBC, September 2026).

Victorino Group helps engineering organizations separate blocking controls from signal controls and rebuild the ones that need a human awake. Let’s talk.