Three hours to data theft: AI agents apparently hacked a Russian company

What's going on

Criminals using AI is nothing new. Until now, though, AI has mostly played a supporting role: a language model writes a phishing email, analyzes a vulnerability or reworks malware. A human at the keyboard made the decisions.

On November 2, 2026, Russian security firm Positive Technologies described a different kind of case. Its incident response team, PT ESC IR, investigated a successful attack on a Russian company. The experts believe it was run from start to finish by AI agents: programs built on a language model that pick their own next step, run commands and evaluate the results. This article is based on a detailed summary on dev.to, which in turn draws on reports from Gazeta.Ru, SecurityLab, Lenta.ru, Life.ru, TRT and CISOCLUB. The author says the text was written with AI assistance.

How the attack unfolded

According to PT ESC IR, the attackers got in through a configuration error in an internet-facing service. The investigators stress that a human would have had a hard time finding this flaw manually. PT doesn't say which service or which setting was involved.

After that, things moved fast. Dozens of new scripts appeared on several servers almost at once. Libraries and software components were installed, the working environment was adjusted, and different methods were tried to get tools onto the machines. Whatever didn't work was rewritten while the attack was still underway.

In the end, the attackers controlled more than ten machines on the corporate network, both Linux and Windows servers. Their target was apparently confidential data from critical internal systems. About three hours passed between the initial intrusion and the data exfiltration.

Denis Goydenko, head of PT ESC IR, told Gazeta.Ru that experimental AI attacks had been seen before, and that attackers have long used AI for individual stages. In his team's own experience, however, this was the first successful attack on Linux and Windows infrastructure that was probably carried out entirely by AI agents. The "speed and nature of the actions" pointed that way, he said.

How to spot an agent

No log file says an AI was at work. The investigators infer it from the pattern of activity, which looks very different from that of a human attacker:

That last point makes attribution harder, meaning linking an attack to a specific hacking group. Such groups are usually identified by their signature tools.

What isn't proven

The dev.to author explicitly warns against blowing the story up. Headlines read "AI hacks a company for the first time," but PT itself is more cautious. That AI agents were involved is a conclusion the investigators drew from the traces, not a proven fact. Whether there really was no human at the controls couldn't be settled conclusively. PT also doesn't claim this is the world's first autonomous AI attack, only the first in its own caseload. The company, the industry and the language model behind the agents haven't been named.

There's another caveat: PT sells exactly the kind of fast defense tools it is now recommending. Still, the author considers the conclusion sound.

Not the first warning shot

The case fits into a broader trend:

• In November 2025, Anthropic described an espionage campaign that used its own model, Claude. By Anthropic's estimate, the AI did 80 to 90 percent of the work: reconnaissance, vulnerability hunting, exploit code and data exfiltration. Humans only stepped in at key points and signed off on bigger moves.
• In October 2026, according to SecurityLab, cloud security firm Wiz described attacks in which an agent found entry points on its own, harvested credentials, hopped between cloud services and rewrote scripts that had crashed. The gaps between commands were too short for a human operator.
• Fully autonomous attacks are still hard. In tests run by Standoff 365 and CyberED in September, 33 out of 310 agents completed a practice attack chain, roughly one in ten. The rest got stuck, went off in the wrong direction or waited for hints. On a real network, though, one agent finding one gap is all it takes.

The bigger picture is getting worse too. According to PT, Russian companies' network traffic showed 65 percent more events with clear AI characteristics in Q3 2026 than in Q2. The share of attempts to exploit vulnerabilities rose from 1.1 to 5.6 percent. The most common were SQL injection (smuggling in database commands), directory traversal (breaking out of permitted directories) and OS command injection.

Speed, not smarts

The agent wasn't smarter than a human pro. It actually got things wrong more often. What made the difference was speed. Typical defenses are built around human attackers: monitoring raises an alert, the on-call shift looks at it half an hour later or the next morning, and the analysis takes another hour. That's enough against attackers who spend days exploring a network. It's not enough against an agent that's done in three hours. Goydenko says that when an attack runs without constant human involvement, conventional automation is no longer sufficient. Defenses have to detect and stop suspicious activity just as fast.

The report lists measures that even small companies with a single server can put in place:

• Audit everything that's reachable from the outside: unprotected admin panels, databases or Redis without a password, an exposed Docker API, debug mode switched on in production, a .git folder in the web root. Scan your own addresses from the outside.
• Cut your response time: Set up automatic responses for critical events, such as locking an account, taking a machine off the network or stopping a service.
• Detect activity spikes: A simple rule like "more than N commands per minute from one account" works more reliably than sophisticated signatures, according to the report.
• Lay bait: A fake access key in an unused config file works like a burglar alarm, because agents read configs and try out whatever they find right away. Experts call this kind of bait honeytokens.
• Segment your network: If an attacker can reach more than ten machines in three hours, the network isn't putting up much resistance. The fewer machines that can needlessly see each other, the slower an attacker gets ahead.
• Get secrets out of files: An agent finds keys in .env files, shell history or scripts in seconds. A secrets manager with regularly rotated keys is a better option.
• Ship logs elsewhere: Send logs to a separate machine so they don't get wiped along with the compromised server.

The author also provides a few shell commands for Debian and Ubuntu. They list recently modified scripts, fresh files in /tmp, newly installed packages and SSH logins from the past 24 hours. If you find something you didn't install yourself, don't delete it right away, because it'll be needed for the investigation.

The bigger picture

So far, this is the only case of its kind PT has described, and it comes with caveats. It still matters, because it documents a scenario from lab experiments and vendor reports as a real, successful incident for the first time, even if without verifiable details. The direction is clear: language models write and fix code faster than humans, agents work through long chains of steps, and misconfigured services are still everywhere. Put together, that shrinks a break-in from weeks to hours.

The good news: the agent didn't need any new vulnerabilities. It exploited the same unprotected interfaces, passwords in files and flat networks that human attackers use, just faster. So defense rests on the same unglamorous measures that have been recommended for years. What's new is that putting them off is now more costly. PT's claims can't be independently verified so far.