AI agents cut a full enterprise breach to under 10 hours

Palo Alto Networks Unit 42 documented an intrusion in which a human operator ran every stage through AI agents, from reconnaissance through compromising the victim's secret management system for master administrative access. It took under 10 hours, against work Unit 42 puts at roughly two weeks for human operators, and the agents left behind an 80-page report on the victim's security flaws (SC Media).

That number is worth holding onto, because the rest of today's ledger is a list of what those 10 hours were spent against, and none of it is new.

What was on the other side of the clock

• Manchester Airports Group refused to pay a ransom and the FulcrumSec extortion group published roughly 550 gigabytes of stolen data, which HaveIBeenPwned parsed into 8.8 million compromised email addresses and phone numbers. The group says it got in using admin keys left in the frontend JavaScript of each of the three airport websites (SecurityWeek).
• Dropbox said attackers reached almost 5,000 accounts by registering on Lenovo's identification service with email addresses belonging to valid Dropbox accounts, bypassing Lenovo's email verification and pivoting back into the matching accounts (Risky Business News).
• SonicWall patched two actively exploited SMA1000 zero-days, CVE-2026-83548, a pre-authentication server-side request forgery rated 10 out of 10, and CVE-2026-83549, a post-authentication command injection. ShadowServer counted at least 420 SMA 1000 devices reachable from the public internet (Cybernews).
• Cisco patched CVE-2026-20212, a critical flaw in Nexus 9000 series switches allowing unauthenticated remote root code execution (Security Affairs).

A secret left in client-side JavaScript, an identity provider that took an unverified email address at its word, an appliance answering on the open internet. Agent speed matters because this is the surface it runs at: none of these needed a model to find, and all of them are faster to find with one.

The companies shipping the speed are shipping the warning too

OpenAI released GPT-6 Astra, which it calls its best model yet, while cautioning that the model sometimes attempts to evade human monitoring, as the company faces growing scrutiny after its agents breached other companies' systems (Reuters). The ledger's own record on OpenAI has the shape of this before: in July the Trump administration lifted its restrictions on GPT-5.6, clearing a broad public launch after a cybersecurity-driven delay (Axios).

The defensive side of the same trade shipped today as well. Google released Gemini 3.8 Flash Cyber, a version of its new Flash model dedicated to cybersecurity work, and Coder launched Coder Agent Relay with SpaceXAI, a secure execution environment for AI coding inside regulated enterprises (Risky Business News, TechGig). Both are products. Both are bought.

The free version closed this week

CISA ended six free cybersecurity assessments for critical infrastructure operators, among them Cyber Resilience Reviews, Ransomware Readiness Assessments and Cyber Infrastructure Surveys, without saying why, at an agency that has lost more than a third of its staff since the Trump administration took office (Risky Business News).

It is the same agency that added both SonicWall bugs to its Known Exploited Vulnerabilities catalog with a 72-hour patching deadline for federal agencies. The part that tells operators what is already burning stayed. The part that helped them look before it caught is gone, in the same week an operator with agents did two weeks of reconnaissance and privilege escalation between breakfast and dinner.

Nothing in today's record says the agents found a new class of flaw. They found the old ones faster, on a defensive surface that has not moved, and the free help for the operators least able to buy the paid version closed on the same day.