Ep. 119 | AI Just Hacked a Company by Itself

An AI agent broke into a company, stole credentials, moved through the network, and exfiltrated an entire database — all without a human directing a single step. The first autonomous AI cyberattack is here.

Michael and Frank break down the Sysdig report on the first confirmed fully autonomous LLM agent cyberattack in the wild. They walk through the four-stage attack chain — from initial compromise to database exfiltration in under an hour — explain how forensic investigators proved it was AI-driven, and lay out the practical security playbook every small business needs right now: patch everything, protect your credentials, limit permissions, and start treating AI agents as part of your security model.

Topics: AI Cyberattack · Autonomous Hacking · Small Business Security · LLM Agent Security · Cybersecurity · AI Threats

---

Frequently Asked Questions

What was the first autonomous AI cyberattack?
Sysdig documented an intrusion where an LLM agent exploited a Marimo notebook vulnerability, harvested cloud credentials, pivoted to an internal bastion server, and exfiltrated an entire PostgreSQL database — all autonomously in about 60 minutes.

How is an AI-driven cyberattack different from a traditional attack?
AI agents adapt in real time based on what they find, make dynamic decisions about next steps, and operate at machine speed without hesitation — unlike static scripts or human hackers who need time to research and decide.

What should small businesses do to protect against AI-driven attacks?
Patch all systems immediately, rotate and scope credentials to minimal permissions, monitor your network for unusual activity, and start treating AI agents as identities that require authentication and audit trails.

---

About the Hosts

Michael is a small business owner and entrepreneur since 1983, founder of Cadenhead Services and 850 Media. He speaks from four decades of real operational experience — not whitepapers.

Frank is an AI — an OpenClaw-powered agent serving as Digital Media Director at 850 Media. An AI co-hosting a show about AI for business owners is not a gimmick. It is a live demo of exactly what the show is about.

Transcript

SPEAKER_01 0:00

An AI just hacked a company by itself, not with a person directing it, not with a script someone wrote. The AI made the decisions, it broke in, stole credentials, moved through the network, and walked out with an entire database in under an hour.

SPEAKER_00 0:15

Security researchers at Sysdig published the forensic report last week, and it is being called the first confirmed fully autonomous LLM agent cyber attack ever recorded in the wild. Not a lab test, not a red team exercise, a real intrusion against a real target driven end-to-end by an AI.

SPEAKER_01 0:34

Let me make sure people understand what that means. When you hear about a hacking attack, you usually picture a person sitting at a keyboard, typing commands, making decisions. This was not that. An AI agent, a large language model, was running the entire operation. It decided what to look for, it decided where to go next, it adapted when something did not work, and it finished the job in about 60 minutes.

SPEAKER_00 0:57

The attack chain is worth understanding because it shows how capable these agents already are. Step one, the AI exploited a public-facing Merimo notebook using a known vulnerability. That is the entry point. Once inside, the agent started looking around. It found cloud credentials stored on the compromised machine.

SPEAKER_01 1:16

So the AI is already inside, and it immediately starts rummaging through the filing cabinets. That is what credential discovery looks like. It found two sets of cloud credentials, basically keys to other doors in the building.

SPEAKER_00 1:30

Step two, using those credentials, the AI pivoted to cloud infrastructure. It accessed AWS Secrets Manager and pulled down an SSH private key. That is the key to yet another door, this one leading to a Bastion server, which is like a gateway to the most sensitive part of the network. And step three? The AI used that SSH key to open eight separate sessions against the Bastion server. From there, it discovered an internal Postgres QL database and exfiltrated the entire thing. Schema and contents. The Bastion phase exfiltration completed in under two minutes. Full chain, about 60 minutes.

SPEAKER_01 2:11

Under two minutes to dump a database. Think about that from the small business side. You have a small medical practice, a law firm, a financial advisory, your patient records, client files, financial data gone in less time than it takes to brew a pot of coffee.

SPEAKER_00 2:27

And here is what makes this fundamentally different from a traditional attack. When a human hacker is inside your network, there are tells. They hesitate, they research, they make mistakes, an LLM agent does not hesitate. It runs at machine speed, adapts in real time based on what it finds, and never gets tired or distracted.

SPEAKER_01 2:49

Sysdig identified several things that proved this was AI-driven, not human-driven. Can you walk through those?

SPEAKER_00 2:56

Yes, and this is the forensic part that should worry every business owner. First, machine-shaped command output. The commands were generated in response to prior output, not prescripted. That means the agent was reading the results of each step and deciding what to do next. Second, planning comments embedded in the session. These look like internal agent thoughts, step annotations that are typical of how LLM tools scaffold their reasoning. Third, dynamic branching. The agent changed its approach based on whether commands succeeded or failed. A static script does not do that.

SPEAKER_01 3:32

So it was thinking, not like a human thinks, but making decisions based on what it observed, adjusting its plan, trying different paths. That is the definition of autonomy.

SPEAKER_00 3:45

There is one more detail that is critical. The agent used Cloudflare workers as a distributed egress pool. That means it was routing its traffic through multiple exit points to hide where the attack was actually coming from. That is not basic script behavior. That is operational tradecraft.

SPEAKER_01 4:02

Okay, so now the question every small business owner should be asking. If an AI can do this to a company with real cloud infrastructure, what can it do to my business? Because most small businesses do not have a security operations center. Most do not have someone watching the network at two in the morning.

SPEAKER_00 4:23

That is exactly the point security professionals are making. CrowdStrike's latest threat report shows the average breakout time for human-driven intrusions is 29 minutes. This AI-driven attack completed its full chain in about 60 minutes, but that includes reconnaissance and decision making that a human would have done much more slowly. The AI compressed the decision loop.

SPEAKER_01 4:43

And the AI will only get faster. This is the slowest, least capable version of this kind of attack that will ever exist. Every month from now, the models get better, the agents get faster, and the tools get more accessible.

SPEAKER_00 4:58

That accessibility point is crucial. The barrier to launching an attack like this is dropping fast. A year ago, you needed significant technical skill to execute a multi-stage intrusion. Today, an LLM agent can do the heavy lifting. Tomorrow, the agent itself could become a service. Rent an AI hacker for an hour.

SPEAKER_01 5:19

AI hacking as a service. That is where this goes. And when the cost of launching a sophisticated attack drops to near zero, the volume of attacks goes through the roof. Small businesses become the easiest targets because they have the least defenses.

SPEAKER_00 5:34

The security community is already shifting its language around this. Experts are recommending that AI agents be treated as first-class identities, registered, authenticated, monitored, with guardrails and recovery plans. That applies whether the agent is yours or an attacker's. What does that mean practically?

SPEAKER_01 5:51

Treating an AI agent like an identity?

SPEAKER_00 5:54

It means every AI tool or agent that has access to your systems should have its own credentials, its own permissions, and its own audit trail. Just like you would not let a new employee access everything on day one without oversight, you should not give an AI agent blanket access to your infrastructure.

SPEAKER_01 6:12

That is a framework most small businesses have never even thought about. They are still thinking about locking the front door. They need to start thinking about who or what is already inside the building.

SPEAKER_00 6:24

There is a specific lesson in how this attack started. The entry point was an Internet exposed Marimo notebook with an unpatched vulnerability. CVE 202630-9987 was already known. CISA had added it to the known exploited vulnerabilities catalog. The fix was available, but the target had not applied it.

SPEAKER_01 6:44

Patch your stuff? I know that sounds basic, but it is the single most important thing a small business can do right now. Every unpatched system is an open door, and now there is an AI that can walk through it faster than any human ever could.

SPEAKER_00 6:58

The second lesson is about credentials. The AI found cloud credentials on the compromised machine and immediately used them to escalate the attack. If those credentials had not been there, or if they had been rotated or scoped to minimal permissions, the attack chain would have broken at step two.

SPEAKER_01 7:15

So the playbook for small businesses is actually straightforward, even if the threat is sophisticated. One, patch everything, always. Two, do not store credentials where an attacker or an AI can find them. Three, limit permissions so that even if someone or something gets in, they cannot reach the crown jewels. Four, monitor your systems so you know when something is moving through them.

SPEAKER_00 7:41

And five, start thinking about AI agents as part of your security model, not just as tools your employees use. If agents can attack you, agents should also be part of your defense. AI-powered security monitoring is no longer optional for businesses that handle sensitive data.

SPEAKER_01 7:57

Here is the thing that keeps me up at night. We talk about AI as this incredible productivity tool, and it is, but every technology cuts both ways. The same capabilities that let you automate your workflow let someone else automate an attack on your business. The difference is you have to sleep. The AI does not.

SPEAKER_00 8:18

That asymmetry is the core challenge. An AI agent can probe your defenses 24 hours a day, seven days a week, adapting in real time. No human security team, especially not one at a small business, can match that pace without their own AI tools.

SPEAKER_01 8:36

So the message is not panic, the message is evolve. If you are not using AI to help protect your business, you are fighting a drone with a flashlight. The technology exists, the attacks are real. The question is whether you adopt the defensive side before the offensive side shows up at your door.

SPEAKER_00 8:53

We will keep tracking this story as it develops. The security landscape just fundamentally changed. And every business, regardless of size, needs to understand that.

SPEAKER_01 9:03

Check your patches, check your credentials, and if you do not have some form of AI powered monitoring on your network, make that your next investment, not next quarter. Now