ReliaQuest Assesses LLM-Driven Agents Drove an Under-24-Hour Server Takeover Through One Exposed Job Endpoint

NEW YORK - ReliaQuest on Oct. 7, 2026 published a Threat Spotlight assessing, with high confidence, that large language model-driven agents carried out substantial portions of an intrusion that reached full administrative control of a compromised server in under 24 hours. The firm says the attack used no new malware and no zero-day. Instead, every step ran through one internet-facing application feature on an Apache Tomcat server that accepted Spring Batch task descriptions without a login.

The strongest infrastructure link ReliaQuest cites sat on the attack-origin host itself: a live Cairn dashboard matching the public open-source agent orchestration project in markup, asset paths, server software, and default port. ReliaQuest maps three attacker addresses with distinct roles. The origin host created the malicious jobs and exposed Cairn along with exploitation material. A second address had scanned the environment beforehand and held escalation tools later seen on the target under the same filenames. A third collected job output in bulk. ReliaQuest could not determine how many agents were involved, which model drove them, or how far a person approved individual actions. The orchestrator can front any vendor model through a proxy, and the actor had one.

Inside the application, ReliaQuest says the attacker submitted tasks that invoked Nashorn, the JavaScript engine in the Java environment, so code ran with the application account and created no child process until a shell was later spawned. Results came back through deliberately triggered error messages in fixed 1,800-byte chunks across hundreds of sequential requests. From configuration files the actor recovered plaintext SQL Server credentials with sysadmin rights, enabled xp_cmdshell, confirmed SeImpersonatePrivilege, and staged both PrintSpoofer and GodPotato before trying either. After file-permission errors on the first tool, the second reached SYSTEM. The actor then saved the SAM, SYSTEM, and SECURITY registry hives, created local administrator accounts, and later tried to remove artifacts and disable xp_cmdshell.

ReliaQuest argues the command record shows machine-driven execution in the combination of timing, job naming, output formatting, and error correction, together with the live Cairn panel on the host that opened the incident. Roughly half the gaps between commands were five seconds or less, with a median of about six seconds. Job names tracked read offsets in 1,800-byte steps, numbered upload parts, or clock values minted seconds before use. Output was pipe-delimited and typed for a program to parse, while near-identical payload pairs show the second attempt repairing the specific fault the first returned. Concealment came late and covered little: no obfuscation, public tools, artifacts removed only after the actions that produced them, and one of two backdoor administrator accounts left in place.

For responders, ReliaQuest's durable points are familiar controls under a new tempo. Inventory and authenticate internet-reachable job-submission and batch-configuration endpoints. Retain job definitions, execution history, exceptions, and exit descriptions alongside web, database, and endpoint logs, because that application history outlasted every artifact the attacker deleted. Hunt for unusual job volume or sequencing with unexpected script-engine use and output returned through errors. Move stored application credentials into a secrets store or managed identity. Agent orchestration, ReliaQuest concludes, removes skilled operator hours as the limiting factor, so the same attacker can work more targets at once while process- and file-based detections may miss activity that begins and remains inside an existing application process.