AI Agents Pull Off First Successful Hack of a Russian Company, Investigators Say

Artificial intelligence has carried out a successful cyberattack on a Russian company for the first time, according to specialists at Positive Technologies' cyber threat response department (PT ESC IR) who investigated the incident.

Denis Goydenko, head of PT ESC IR, said experimental AI-driven attacks had been seen before and criminals have long used AI at certain stages, but this was the first case in the unit's practice of a successful attack on Linux and Windows infrastructure presumably carried out entirely by AI agents. The speed and nature of the actions pointed to that conclusion, he said.

About three hours passed from the initial breach through an external service to the leak of confidential information from the victim's internal critical systems. Within hours the intruders gained access to more than ten nodes of the corporate infrastructure, and some of the agents' moves looked illogical from a human standpoint.

Goydenko said the agents tried different ways of moving through the infrastructure simultaneously, made mistakes and corrected them almost immediately. The attack was very noisy and developed unusually fast. Initial access came through a configuration error in an external service that is hard to spot manually - grounds, he said, to suspect AI agents went through the entire chain from entry to data leak on their own.

Positive Technologies noted that AI agents can make it much harder to trace whoever launched an attack, since tools are created and modified during the assault and the sequence of actions does not always match familiar criminal scenarios. Autonomous attacks also change the demands on corporate defenses: AI agents can perform many tasks in minutes, cutting the time defenders have to detect and stop an attack.

Earlier it was reported that hackers from a new group, Stingy Basilisk, spied on a Russian state institution for almost four years, present in its infrastructure since at least April 2022.