AI agents have exploited a Windows server in under 24 hours, without a zero-day or any new malware. In a report published Oct. 7.
ReliaQuest said it had high confidence that agents driven by Large Language Models (LLMs) carried out “substantial portions” of the intrusion, calling it “the first incident we’ve seen” of its kind.
ReliaQuest is unable to determine “how many agents were involved, which model drove them, or to what degree a person approved individual actions.” ReliaQuest said the activity “went well beyond an attacker consulting an AI assistant.”
The Attack Path
It took less than 24 hours for the attacker to use an exposed application feature to steal credentials and gain control of a server.
The AI agents exploited an internet-facing job submissions portal on the Apache Tomcat server. This portal would accept tasks, without asking for user authentication or even login. The attacker could then use this portal to run code through Nashorn, a JavaScript engine. They were able to extract data via deliberately triggered error messages.
They found passwords stored as plain text in config files, giving them admin rights to the SQL Server database. They could then use an SQL Server feature to run operating system commands, and the GodPotato tool to gain SYSTEM-level control.
During the attack, two new admin accounts were created, with only one being deleted during cleanup. The other was left in place, leaving a backdoor for future access.
How Analysts Identified AI Involvement
ReliaQuest identified “rapid repetition” between commands, with around 50% of the gaps lasting five seconds or less. ReliaQuest said that the “concentration of short gaps strongly suggests automated rather than manual submission.”
Even the output was formatted for a program to read. “Records were pipe-delimited and prefixed with a type token, with repeated section banners, an explicit exit code, and line breaks normalized so each record sat on a single line.”
ReliaQuest said the most direct indication was “a live Cairn dashboard running on the same address that sent the batch requests.” Cairn is a legitimate open-source AI orchestration platform, used for managing AI agents.
What Security Teams Should Do Now
ReliaQuest advises security teams to identify every internet-facing job, batch, and admin endpoint, then enforce a login at each instance. ReliaQuest also recommended moving passwords from config files into a secrets manager.
It also suggested flagging unusual job volume or sequencing, alongside unexpected script-engine use. When assessing this activity, ReliaQuest said teams should treat “cadence as a useful signal, not a standalone detector of AI or incidents.”
