AI Agents Are Breaking Cloud Security Faster Than Human Hackers Ever Could

Key points

• Only 38% of organisations reported high confidence in their cloud security in NTT DATA's 2026 Global AI Report.
• AI agents, meaning automated software programs that act independently, can test thousands of attack routes in minutes where a human would test roughly 50 in a full day.
• The OpenAI-Hugging Face incident showed an AI agent chaining together multiple small weaknesses to reach sensitive systems.
• The real perimeter is now the identity graph, meaning the web of who and what has permission to access what, not the old-fashioned network boundary.
• Short-lived credentials are hygiene, not a fix, if the token still carries excessive permissions.

Cloud security has always been a game of catching up. Now the attacker on the other side may not be a person at all.

AI agents, automated software programs that can plan and act without human direction, are starting to appear on the offensive side of cyber attacks. Security researchers first reported a notable example involving OpenAI and Hugging Face, an AI research platform, where an agent exploited a chain of small weaknesses to climb through an environment and reach critical systems. Not a single clever break-in. A systematic, machine-speed crawl through every available gap.

How does an AI attacker actually get in?

The path usually starts small. A criminal or an autonomous agent lands inside a cloud environment with limited access, then immediately starts mapping IAM, which stands for Identity and Access Management, the system that controls who can do what inside a cloud account like Amazon Web Services or Google Cloud.

From there, it looks for overly generous permissions and trust relationships between accounts. "Where a human tester might evaluate 50 privilege escalation paths in a day, an autonomous agent can evaluate thousands in minutes, testing every combination of role assumption and cross-account trust relationship," says Omair Manzoor, founder and CEO of security firm ioSENTRIX.

The failure mode here is chain-linking. Take an AWS S3 bucket, basically a cloud storage folder, with slightly loose access controls. On its own, that's a low-priority finding. Combine it with a Lambda function, a small piece of automated cloud code, that carries an IAM role capable of assuming admin rights in a different account, and you suddenly have a critical path to full control. Most security tools flag each of those issues separately. An AI agent connects the dots automatically.

Should ordinary customers be worried?

Yes, in practical terms. When attackers reach sensitive systems, the data inside, customer records, payment details, health information, is what gets exposed or stolen.

Alissa Knight, offensive security firm Assail's founder, makes a point worth understanding plainly: authentication, proving you are who you say you are, isn't enough on its own. Her team found a real application where a user could pass a multi-factor authentication check, the kind where you enter a one-time code from your phone, without even supplying a username, and there was no limit on how many times they could guess the code. The door was unlocked before anyone knocked properly.

Authorisation, meaning what an authenticated user is actually allowed to do once inside, is the control that's consistently weak.

What needs to change?

Manzoor describes three architectural fixes that cloud teams need to start treating as defaults. Use short-lived credentials that expire automatically, so there are no permanent keys sitting around. Federate workload identity, meaning services prove who they are through a trusted system rather than sharing static passwords. Enforce hard account-level boundaries so that a breached agent in one part of the environment can't walk freely into another.

Knight adds a sharper point on credentials: swapping a permanent key for a 15-minute token is hygiene, not a fix, if the token still carries excessive permissions. "Scope reduction is the control; rotation is hygiene."

The broader shift is from scanning for individual flaws to continuously validating whether a full attack path is actually reachable right now. We covered the culture change that continuous validation demands on 28 August in "Why Security Teams Are Ditching the Quarterly Scan for Something That Never Stops". A quarterly report is simply too slow when an AI agent can run the same exercise in minutes.

That credential problem has a long tail. Our 21 August report found that 9,300 leaked AWS keys were still active, 88% still logging in on the day of testing, which means scope reduction means nothing if the keys were never rotated in the first place.

If criminals are using AI to attack, organisations need to use AI to attack themselves first and close the paths before anyone else finds them.

The question to ask your cloud team isn't "which vulnerabilities did the scanner find this week" but "which of those vulnerabilities can be chained together to reach production data, and how fast could an automated attacker do it."