Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report

Summary: Unit 42's 2026 Global Incident Response Report, drawing on hundreds of incident response engagements, finds threat actors using AI to shorten development cycles, automate content generation and streamline reconnaissance, compressing attack lifecycles from days into hours. Unit 42's Andy Piazza and Richard Emerson say the underlying tradecraft is largely unchanged - credential theft, phishing, known-vulnerability exploitation and ransomware persist - while early signals include malware calling out to an LLM or MCP server for command and control, agentic ransomware managing multiple extortion stages, and token jacking of exposed cloud AI credentials.

What you should know: Token jacking of exposed LLM API credentials can generate millions of dollars in unauthorized compute charges at the victim's expense, and Unit 42 warns that organizations relying primarily on detect-and-respond models may struggle if AI lets attackers operate faster or at greater scale.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related