AI Agents Are Breaking Cloud Security Faster Than Human Hackers Ever Could

Key points

• Only 38% of organisations reported high confidence in their cloud security in NTT DATA's 2026 Global AI Report.
• AI agents, meaning automated software programs that act independently, can test thousands of attack routes in minutes where a human would test roughly 50 in a full day.
• The OpenAI-Hugging Face incident showed an AI agent chaining together multiple small weaknesses to reach sensitive systems.
• Experts say the real perimeter is now the identity graph, meaning the web of who and what has permission to access what, not the old-fashioned network boundary.
• Short-lived credentials help, but cutting down the scope of permissions matters more than how often you rotate them.

Cloud security has always been a game of catching up. Now the attacker on the other side may not be a person at all.

AI agents, automated software programs that can plan, explore, and act without human direction, are starting to appear on the offensive side of cyber attacks. Security researchers first reported a notable example involving OpenAI and Hugging Face, an AI research platform, where an agent exploited a chain of small weaknesses to climb through an environment and reach critical systems. It was not a single clever break-in. It was a systematic, machine-speed crawl through every available gap.

How does an AI attacker actually get in?

The path usually starts small. A criminal or an autonomous agent lands inside a cloud environment with limited access, then immediately starts mapping IAM, which stands for Identity and Access Management, the system that controls who can do what inside a cloud account like Amazon Web Services or Google Cloud.

From there, it looks for overly generous permissions and trust relationships between accounts. "Where a human tester might evaluate 50 privilege escalation paths in a day, an autonomous agent can evaluate thousands in minutes, testing every combination of role assumption, policy boundary, and cross-account trust relationship," says Omair Manzoor, founder and CEO of security firm ioSENTRIX.

The failure mode here is chain-linking. Take an AWS S3 bucket, basically a cloud storage folder, with slightly loose access controls. On its own, that is a low-priority finding. Combine it with a Lambda function, a small piece of automated cloud code, that carries an IAM role capable of assuming admin rights in a different account, and you suddenly have a critical path to full control. Most security tools flag each of those issues separately. An AI agent connects the dots automatically.

Should ordinary customers be worried?

Yes, in practical terms. When attackers reach sensitive systems, the data inside, customer records, payment details, health information, is what gets exposed or stolen.

Alissa Knight, founder and CEO of offensive security firm Assail, makes a point worth understanding plainly: authentication, proving you are who you say you are, is no longer enough on its own. Her team found a real application where a user could pass a multi-factor authentication check, the kind where you enter a one-time code from your phone, without even supplying a username, and there was no limit on how many times they could guess the code. The door was unlocked before anyone knocked properly.

Authorisation, meaning what an authenticated user is actually allowed to do once inside, is the control that is consistently weak.

What needs to change?

Manzoor describes three architectural fixes that cloud teams need to start treating as defaults. Use short-lived credentials that expire automatically, so there are no permanent keys sitting around. Federate workload identity, meaning services prove who they are through a trusted system rather than sharing static passwords. Enforce hard account-level boundaries so that a breached agent in one part of the environment cannot walk freely into another.

Knight adds a sharper point on credentials: swapping a permanent key for a 15-minute token is hygiene, not a fix, if the token still carries excessive permissions. "Scope reduction is the control; rotation is hygiene."

The broader shift is from scanning for individual flaws to continuously validating whether a full attack path, start to finish, is actually reachable right now. A quarterly security report, first reported as a gap by CSO Online, is simply too slow when an AI agent can run the same exercise in minutes.

If criminals are using AI to attack, organisations need to use AI to attack themselves first and close the paths before anyone else finds them.

Operational takeaway: the question to ask your cloud team is not "which vulnerabilities did the scanner find this week" but "which of those vulnerabilities can be chained together to reach production data, and how fast could an automated attacker do it."