The key facts
- The attackers needed about three hours to penetrate critical systems and steal data
- The intruders gained access to more than ten hosts running Linux and Windows
- Specialists have not yet been able to fully confirm the involvement of AI agents alone
The first such investigation in the company's practice
In Russia, a cyberattack was investigated in which attackers needed only three hours to penetrate a company's critical systems and steal data. Positive Technologies specialists believe that almost the entire operation was carried out autonomously by AI agents. This was reported by TASS, citing the company.
How the attack unfolded
In a short time, the attackers gained access to more than ten infrastructure hosts running Linux and Windows. The intrusion began through an external service, after which the malicious activity quickly spread inside the corporate network.
Why AI is suspected
The peculiarity of the attack lay in the intruders' behavior: they simultaneously explored different paths of movement through the network, made mistakes, and corrected them almost instantly. It was precisely this speed and consistency of actions that led experts to suggest that autonomous AI systems were behind the attack.
“A first in PT ESC IR's practice”
“This is the first case in PT ESC IR's practice where we investigated a successful attack on Linux and Windows infrastructure that was, presumably, carried out entirely by AI agents,” said Denis Goydenko, head of the comprehensive cyberthreat response department at Positive Technologies.
What this changes for investigations
According to Goydenko, such technologies significantly complicate the investigation of cyber incidents: it becomes harder to establish who exactly organized the breach, and information security specialists have less and less time to detect and block the threat. At the same time, specialists have not yet been able to definitively confirm that the operation was carried out exclusively by AI agents — this conclusion is based primarily on the nature and speed of the detected actions.
Context: disguising as neural networks
Earlier, Life.ru reported on another scheme of attacks on Russian companies: attackers disguised malicious requests as queries to popular neural networks, including ChatGPT, DeepSeek, and Claude, in order to hide suspicious activity from security systems. The new investigation differs from that scheme: there, AI was used merely as cover for traffic, whereas in the case described, the agents themselves are believed to have carried out the attack.
