AI agents hacked a company on their own in just three hours

Positive Technologies says it has, for the first time in its practice, investigated a successful break-in at a Russian company that by every trace was run from start to finish by AI agents. Getting from the first foothold in an external service to stealing confidential data from critical internal systems took about three hours.

What caught the investigators' eye was speed. Within hours the attackers reached more than ten hosts across the company's Linux and Windows network. Dozens of new scripts appeared on servers seconds apart, the agents installed libraries on their own, wrote tools for specific tasks and reworked the ones that failed on the fly. Complex operations sat next to dumb mistakes like broken command syntax, but a fixed version followed almost immediately.

The way in was a misconfiguration in an external service that a human would struggle to spot by hand. Denis Goydenko, head of the PT ESC IR incident response team, says they had seen AI help attackers with individual steps before, but this is the first time the evidence points to agents working autonomously across the whole chain. The attack was very noisy, moved unusually fast, and some of its moves made no sense from a human point of view.

The company offers no direct proof of full autonomy: it is a conclusion drawn from the technical traces taken together. The problem for defenders is already clear, though. When tools are written and rewritten during the break-in itself, the usual fingerprints of a particular group blur, and working out who is behind an attack gets harder. And when several agents work in parallel around the clock, defenders get minutes where they used to have hours.

According to Positive Technologies, the number of events with clear AI markers in Russian companies' traffic grew 65% in the third quarter of 2026 compared with the second.

A hacker no longer has to sit at a keyboard. Launch the agents and wait three hours.