AI agents rewrite cloud security rules

Cloud architectures built to repel human intruders are facing a fundamentally different kind of adversary. AI agents can now probe, chain, and exploit cloud weaknesses at a pace that outstrips any human attacker, turning what were once isolated misconfigurations into fast-moving attack paths. The recent OpenAI incident involving Hugging Face offers an early glimpse of what such an autonomous assault looks like — an agent exploiting multiple weaknesses to escalate access and move laterally through an environment.

Many organizations are already uncertain about their ability to secure these sprawling cloud environments, with NTT DATA’s 2026 Global AI Report finding only 38% report high confidence in their cloud security posture. If cloud architecture was fragile before, agents make the consequences arrive sooner and at greater scale. The challenge for CISOs is no longer simply patching individual flaws, but defending against an opponent that can chain vulnerabilities and execute attacks at machine speed.

Speed and exhaustiveness change the game

The defining trait of AI-powered attackers is not just their intelligence, but their relentless thoroughness. “What makes agents different from human attackers is speed and exhaustiveness,” says Omair Manzoor, founder and CEO of ioSENTRIX. Where a human security tester might follow a handful of leads, an agent can fan out across every possible path simultaneously.

Testing shows how an attack could play out: An agent or attacker lands with a low-privilege identity, enumerates identity and access management (IAM) policies, identifies overly permissive roles, and chains together two or three misconfigurations to reach critical assets. What’s striking is how quickly an agent can test the available paths.

“Where a human tester might evaluate 50 privilege escalation paths in a day, an autonomous agent can evaluate thousands in minutes, testing every combination of role assumption, policy boundary, and cross-account trust relationship.”

— Omair Manzoor, founder and CEO of ioSENTRIX

Cloud complexity expands the attack surface

Speed matters because cloud environments have become intricate, with sprawling identities, permissions, APIs, workloads, and trust relationships. That complexity makes it harder for defenders to see how individual weaknesses connect, while giving agents more relationships to map and test. As agents proliferate, network boundaries matter much less than who — or what — can access your cloud.

“The perimeter is the identity graph now, not the virtual private cloud,” says Alissa Knight, founder and CEO of Assail, who counts more than 20 years in offensive security. Authentication alone is not enough to protect against wider infiltration. Knight has seen agentic AI-generated applications where a user could authenticate with an MFA code without providing a username, and the code could be repeatedly guessed because there was no maximum number of attempts.

That highlights the importance of authorization, not simply authentication. Proving access to the system does not necessarily mean the identity has been properly restricted once inside. The risk, she says, is that organizations can establish that someone is authenticated without adequately controlling what they’re authorized to do once inside.

The rise of the attack chain

Excessive permissions and interconnected misconfigurations are the most common weaknesses Manzoor is finding in cloud assessments. “Organizations manage permissions in isolation — this role has these policies, this service account has that access. But cloud attack paths are not individual misconfigurations. They’re chains,” he says.

He gives the example of an S3 bucket with overly broad access — a low finding in isolation, but when combined with a Lambda function that has an IAM role capable of assuming a cross-account admin role, it becomes a critical path to full environment compromise. “Agentic systems will map these chains automatically. Most organizations cannot see them today even with manual analysis,” he says.

Individual weaknesses can be connected in a way that creates vulnerabilities that aren’t apparent in isolation. Assail data has shown that shared node roles and flat trust between accounts do more damage than any single CVE in an environment. When AI can discover and connect weaknesses at a speed human security teams cannot match, “you’re no longer dealing with a human adversary,” Knight says. “You’re dealing with an adversary that’s using AI against you.”

“If we’re being hacked with AI, we should be hacking ourselves,” she adds, arguing that organizations need to use AI to identify and test the attack paths an AI-powered adversary could exploit.

Shifting from vulnerabilities to attack paths

Cloud security operations need to shift from identifying individual vulnerabilities to continuously validating whether attack paths remain exploitable. As agents become a new insider threat, the challenge for CISOs is to look beyond isolated vulnerabilities to understand how permissions and misconfigurations could interconnect to form attack paths, according to CSA’s State of Cloud and AI Security report.

Manzoor sees a consistent gap between detection and architectural reality. “Organizations deploy CSPM tools that generate thousands of findings, but those findings are evaluated individually rather than as interconnected attack paths,” he says. “An agent does not care about your individual findings. It cares about which combination of findings creates a viable path to your data. The defensive approach needs to match that — graph-based exposure analysis that maps real-time attack paths, not flat lists of misconfigurations.”

He cites three architectural principles that organizations need to adopt to prepare for agentic threats:

• Adopt ephemeral credentials everywhere. “No standing access, no long-lived keys, every permission is just-in-time and automatically expires.”
• Ensure workload identity is federated. “Service-to-service authentication that eliminates shared secrets entirely.”
• Establish account-level segmentation. Blast radius containment needs account-level segmentation, not just network segmentation within a single account. “Hard boundaries between workloads are needed so that a compromised agent in one context cannot traverse to another.”

Severity scoring falls short

Knight agrees that threat severity scoring assumes a human attacker with limited patience. “An agent does not triage by severity, it composes,” she says. As an example, in its own Ares environment, Assail chained a metadata service exposure into a node role and then into the account — three findings that each scored as low or medium in isolation.

Point-in-time posture scanning is designed around human-attacker tempo. However, as agents compress attack times to minutes, mean time to remediate may be less important. Instead, posture scanning will need to determine whether an attack path is reachable. “That requires continuous adversarial validation, not a quarterly report,” she says.

Identity-based credentials will also need to change. Short-lived workload identities can remove long-lived credentials from the attack surface, but that is only part of the problem. Knight says swapping a static key for a 15-minute token still carries the same overscoped policy and only shortens the window. It changes nothing about the blast radius. “Scope reduction is the control; rotation is hygiene,” she says.

A checklist for cloud security rethink

Overall, CISOs need to alter their strategic approach from assessing vulnerabilities to asking whether agents can create attack paths, and how quickly, in their cloud systems. Continuous attack-path validation, tightly defined identity and authorization controls, and deploying offensive agents will also help protect against agent-led attacks.

With that in mind, here are four cloud security shifts CISOs should initiate:

• From vulnerability management to attack-path management. Understand how identities, permissions, and misconfigurations connect.
• From perimeter security to identity architecture. Prioritize machine identities, delegated permissions, and privilege escalation.
• From periodic reviews to continuous validation. Cloud exposure management becomes continuous rather than relying on scheduled reviews.
• From cloud complexity to cloud simplicity. Architectural simplicity becomes a security advantage because AI exploits complexity.

Why it matters

The shift to AI-driven attackers is not a distant threat — it is already reshaping what cloud security means. If organizations continue to think in terms of isolated fixes, they may remain blind to the chains that agents can exploit in minutes. The takeaway for CISOs is stark: the pace of an AI adversary demands a defensive approach that matches it, one built around continuous validation of attack paths, tight identity controls, and an architecture that denies agents the complexity they feed on. The window to adapt may be measured in attack cycles, not quarterly reviews.