Key Takeaways
JADEPUFFER proved one AI agent could run a full attack chain without a human in the loop.
ENCFORGE shows the same operator upgrading payloads to destroy AI models and training data specifically.
Unit 42’s September intrusion adds a new variable: parallelism, not just autonomy.
Multiple specialized agents worked cloud, identity, CI/CD, and AI infrastructure simultaneously.
No individual technique was novel; the concurrency of execution was.
Branch protection stopped one persistence attempt, a rare proven preventive control.
Containment now needs to act across every compromised plane at once, not sequentially.
Our first article on this subject looked at JADEPUFFER, Sysdig’s July research documenting what it assessed as the first end-to-end ransomware operation run by a single autonomous AI agent, and asked what that meant for enterprise XDR architecture.
Two developments since then show how that model is evolving.
Later in July, Sysdig caught the same operator returning to the same compromised host with ENCFORGE, a ransomware locker purpose-built to destroy AI model weights and training data rather than generic files.
Then, on September 2, Unit 42 disclosed an incident in which a coordinated set of specialized AI agents, working in parallel across a victim’s cloud, identity, CI/CD, and AI infrastructure, compressed roughly two weeks of intrusion tradecraft into under ten hours. Unit 42 subsequently clarified that the incident was an intrusion, not a ransomware attack, although the attacker did engage in ransom negotiations.
Read together, these two developments extend that original argument in a specific direction. The question then was what changes when an autonomous agent doesn’t need a human between steps.
These follow-on incidents don’t simply show a bigger version of the same problem. They introduce a second variable: parallelism.
One agent removed the human bottleneck from a single attack chain. A coordinated fleet of agents removes it from several attack chains at once.
Three takeaways for security leadership
Autonomy and parallelism create different security problems, and the September intrusion provides an early real-world example of the second. JADEPUFFER showed one agent could complete a kill chain unattended. The September intrusion showed multiple specialized agents can run different parts of a kill chain concurrently, across systems a SOC would normally triage as unrelated incidents.
Autonomy and parallelism create different security problems, and the September intrusion provides an early real-world example of the second. JADEPUFFER showed one agent could complete a kill chain unattended. The September intrusion showed multiple specialized agents can run different parts of a kill chain concurrently, across systems a SOC would normally triage as unrelated incidents.
The September intrusion also shifts attention from detection alone to the speed and coordination of containment. Unit 42’s own guidance is explicit: isolating one compromised plane while agents remain active in others gives them time to re-establish footholds elsewhere. Containment increasingly needs to happen across planes at once, not one at a time.
Generates High-Confidence Alerts
Disrupts Autonomous and AI-Assisted Attacks
Extends Detection Across Hybrid Environments
What Happened Between JADEPUFFER and Now
Sysdig disclosed ENCFORGE later in July: the same operator, identified through a matching extortion contact address, returned to the previously compromised Langflow instance and staged a compiled Go ransomware binary purpose-built for AI infrastructure.
Where the original campaign relied on improvised Python scripts and a database’s own encryption function, ENCFORGE targets roughly 180 file extensions across the AI/ML stack, including model checkpoints, vector databases, training data, and embedding indices.
The operator escalated through an exposed Docker socket to reach root-level host access, then iterated through successive delivery scripts over roughly five minutes to work around failures before the payload landed.
The recovery problem is different from a conventional database attack. Production models, training data, and embedding assets may not have the same backup and recovery coverage as conventional business data.
Sysdig estimates that rebuilding a single affected model can cost $75,000 to $500,000 in compute and engineering time.
The more significant escalation is the one Unit 42 documented independently, in a different environment with a different operator. Unit 42 describes a human attacker who set objectives and then left tactical execution to AI agents that monitored, evaluated, acted, and re-planned in real time.
On September 2, researchers Renzon Cruz, Nicolas Bareil, Eric Semaan, and Omar Jbari published an account of an intrusion that began with a breach of a public-facing API and, ten hours later, had reached across the victim’s cloud, identity, CI/CD, and AI infrastructure.
Rather than one agent working sequentially, specialized agents worked in parallel: one mapped internal microservices, others combed source repositories for hard-coded tokens and service passwords, another used the harvested credentials to reach the secrets manager and pull root-level administrative credentials, and a pipeline-focused agent triggered unauthorized CI/CD builds and obtained cloud access keys, which it then used against the victim’s AI infrastructure.
The agents then used those stolen keys to route their own orchestration traffic through the victim’s own AI endpoints, which made it harder to distinguish from ordinary model usage.
One persistence attempt, a backdoor planted in Terraform configuration, failed because branch-protection controls required a second human reviewer before the change could merge.
The attacker told Unit 42 during negotiations that they had used frontier AI models and purpose-built agentic attack frameworks.
Unit 42 found independent technical indicators consistent with that claim: parallel calls to multiple frontier models, structured Markdown files passing state between agent sessions, and the same kind of self-narrating, heavily commented code Sysdig had flagged in JADEPUFFER’s payloads.
Why This Matters
The original JADEPUFFER analysis made a narrower point: an agent that never sleeps or hesitates can break a detection model built around human pacing. That argument still holds, but the September case extends its scope.
JADEPUFFER was bounded to one agent and one exposed framework. The intrusion Unit 42 documented had no equivalent boundary. Specialized agents worked across cloud, identity, developer tooling, and AI infrastructure at once, the way a coordinated human red team would if a two-week engagement were compressed into a single overnight shift.
For a CISO, an initial reading of this problem might have stopped at: could our controls stop one autonomous agent hitting one exposed service?
The harder question now is whether an incident response process can contain an attack that’s already active across several unrelated systems before the first alert has finished triage.
Why the Escalation Happened This Fast
The operator kept iterating
ENCFORGE shows the JADEPUFFER operator treating the original campaign as a first draft: same infrastructure, same entry point, a materially upgraded payload purpose-built for higher-value AI assets.
Frontier-model access is not a theoretical barrier to offensive use
The September attacker’s own disclosure, and the technical evidence of parallel frontier-model calls, demonstrates that capable models are already available to whoever is running this kind of operation, not just to organizations building agents for legitimate purposes.
AI infrastructure is showing up on both sides of the same equation
JADEPUFFER used an exposed AI framework as its way in. The September attacker used stolen keys to the victim’s own AI infrastructure as a way to hide, once inside.
These are two different incidents and two different mechanisms, but together they show the same broader risk from different directions: AI infrastructure can be an entry point when exposed, and post-compromise infrastructure when an attacker obtains legitimate-looking access to it.
Multi-agent coordination moved from research environments into real-world intrusion activity
Specializing separate agents for reconnaissance, credential harvesting, pipeline compromise, and reporting, then running them in parallel, is the same architecture pattern enterprises are adopting for their own agentic workflows. The September intrusion shows attackers beginning to apply that same architecture pattern to offensive operations.
How the Two Incidents Compare
DimensionJADEPUFFER (July)Unit 42 intrusion (September)
Agent architectureSingle LLM agentSpecialized agents operating in parallelAttack surfaceOne exposed AI-framework endpointCloud, identity, CI/CD, and AI infrastructureModel classUnspecifiedFrontier models, attacker-confirmedEstimated human effort compressedNot separately estimatedRoughly two weeks of human red-team work into under ten hoursPersistence attempt blocked byNo equivalent control testedMulti-party branch-protection review on a Terraform changePost-compromise use of AI infrastructureNot applicableStolen keys used to route orchestration traffic through the victim’s own AI endpointsClassificationRansomware, per Sysdig’s assessmentIntrusion, per Unit 42’s own clarified wording
From Autonomy to Parallelism
The original JADEPUFFER analysis centered on autonomy: one agent that can perceive, reason, act, and recover without waiting on a human.
The September case adds a second idea on top of it, parallelism, several agents running that same perceive-reason-act-recover loop across different systems at the same time.
That distinction is worth stating plainly, because it shapes most of what follows. Autonomy compressed the time available to detect and respond to a single attack chain. Parallelism raises a different problem: several attack chains can be running at once, and a defender who catches one may still be blind to the others.
Two practical consequences follow.
Reconnaissance, credential harvesting, secrets-manager compromise, and CI/CD hijacking can no longer be assumed to occur as sequential stages a defender can catch one at a time; in the September case they ran as parallel workstreams feeding one objective.
And the behavioral signatures worth watching for aren’t quite the same as in a single-agent case. Unit 42 flagged bursty API request patterns, rapid shifts between authentication failure and success, sudden AI-endpoint usage from accounts with no prior history of calling those endpoints, and structured Markdown files passing state between sessions.
Identity and the Secrets Layer
The original analysis also placed identity at the center of nearly every stage of an autonomous intrusion. The September case adds a second path into that same control plane: source code.
Rather than reaching credentials primarily through lateral movement after a foothold, the agents pulled hard-coded tokens and service passwords directly out of repositories, then used those to reach the secrets manager.
Identity compromise and secrets-management compromise are no longer stages a defender can expect in sequence; here they ran as parallel paths to the same objective.
The practical implication is that identity telemetry now needs correlation with source-code and CI/CD activity, an integration most enterprise detection stacks weren’t built around.
Why XDR’s Architecture Has to Extend Further
Those six architectural requirements remain necessary: cross-domain correlation, deep session inspection, technique-level detection, deception, response orchestration, and stack extension rather than replacement. Fidelis Elevate®, referenced in the original analysis as one working example of those principles, remains a relevant reference point here too. The September case adds requirements the original analysis didn’t anticipate.
Synchronized, cross-plane containment
Unit 42’s own defensive guidance is explicit: isolating one compromised plane while agents remain active in others gives them time to re-establish footholds elsewhere. Containment now needs to revoke credentials, terminate sessions, freeze pipelines, and isolate cloud accounts across every affected plane at once.
Fidelis Elevate®‘s CommandPost interface, together with its documented SOAR integrations (Splunk, Palo Alto Cortex XDR, D3, Respond), points toward the kind of centralized orchestration this containment requires, though synchronized cross-plane response of this specific kind is an emerging requirement rather than something any platform has been tested against in a documented multi-agent incident.
AI infrastructure governed as core security surface
Every model endpoint, API key, and MCP gateway should now be treated as a potential dual-use security asset. JADEPUFFER shows what it looks like as an entry point; the September case shows what it looks like as a covert channel for post-compromise orchestration. Rate limiting, least-privilege policy, and diagnostic logging on AI services are load-bearing controls, not optional hardening.
DevOps pipeline lockdown as a tested chokepoint
Multi-party review and immutable branch protection on infrastructure-as-code repositories stopped the Terraform backdoor attempt in the September incident. It is one of the clearest examples in the incident of a preventive control stopping an agent-driven action rather than simply detecting it.
CISO Action Checklist
Questions to ask your team
If an attack is active in our identity plane, our CI/CD pipeline, and our cloud environment at the same time, does our incident response process contain all three simultaneously, or one at a time?
Could our own AI endpoints be used to hide an attacker’s orchestration traffic inside what looks like normal model usage, and would we notice?
Do our code repositories contain hard-coded credentials, and how are we detecting them?
Does any infrastructure-as-code repository lack mandatory multi-party review before merge?
If an AI-targeted ransomware attack hits our environment and targets model weights and training data specifically, do we know which of our AI assets would be unrecoverable, and at what cost?
Recommended actions
Extend credential and secrets-scanning coverage to the full repository portfolio, given how fast an agent can enumerate an entire codebase.
Build containment playbooks that trigger synchronized action across cloud, identity, CI/CD, and AI infrastructure from a single detection, rather than routing each plane through a separate runbook.
Apply production-grade access controls, network isolation, and logging to AI orchestration frameworks rather than treating them as developer tooling.
Monitor for the behavioral signatures Unit 42 identified: bursty API requests, rapid 401/200 authentication shifts, and AI-endpoint usage from accounts with no history of calling those endpoints.
Extend mandatory multi-party review and immutable branch protection to every infrastructure-as-code repository, not only the ones considered highest-risk today.
Predictions: Where This Goes From Here
Threat intelligence may increasingly track agent architecture, including single-agent versus coordinated multi-agent operations, as a distinguishing characteristic alongside malware and infrastructure.
The September case suggests that access to frontier models may not be a significant barrier to offensive agentic operations; expect more incidents to test how far that access extends rather than assuming cost alone will limit the next wave.
AI infrastructure is likely to keep showing up in incident reports on both sides of a compromise, sometimes as the entry vector, sometimes as the channel an attacker uses to stay hidden afterward.
Source-code repositories and secrets managers will be treated as a control plane alongside identity, given how directly the September incident exploited that path.
Multi-party review and immutable infrastructure-as-code controls are likely to receive more attention after demonstrating their value as a concrete chokepoint in this incident.
Synchronized, cross-plane containment capability is likely to become a named evaluation criterion in XDR and SOAR procurement, distinct from single-domain detection capability.
Other threat actors are likely to experiment with ransomware payloads purpose-built for AI/ML assets, following the pattern ENCFORGE established.
Expect threat reporting to draw sharper distinctions between autonomous intrusion, autonomous ransomware, and AI-assisted attacks as more real-world cases emerge.
Conclusion
The original JADEPUFFER analysis argued that autonomous execution changes the tempo of an attack chain. These two developments extend that argument along a second axis: parallel execution changes its scale.
JADEPUFFER demonstrated that one agent could complete a kill chain without a human between steps. The September intrusion demonstrated that several specialized agents can run different parts of a kill chain at the same time, across systems a SOC would ordinarily treat as separate incidents.
Nothing about the individual techniques in either case is new, and that’s the point both pieces make: the defensible unit was never the isolated exploit.
It’s the correlated attack chain, now running across more planes at once and increasingly making use of the organization’s own AI infrastructure while it works.
Organizations that treat synchronized cross-plane containment and AI infrastructure governance as baseline architecture will be better positioned to interrupt this class of attack before it becomes business-impacting.
The implication for defenders is straightforward: preparing only for faster attack chains is no longer enough when multiple chains can execute in parallel.
Our customers detect post-breach attacks over 9x Faster
Detect Advanced Threats Before Damage Escalates TrustedCybersecurity Leader for 20+ YearsSee why security teams choose us over other solutionsRequest a DemoSee Fidelis in Action
Sources:
The post From JADEPUFFER to Multi-Agent Intrusions: The Next Wave of Autonomous Attacks appeared first on Fidelis Security.
No Responses