Cloud security architectures built to withstand human attackers are facing a new problem: AI agents that can chain vulnerabilities and execute attacks at machine speed. The recent OpenAI incident involving Hugging Face offered an early example, with an agent exploiting multiple weaknesses to escalate access and move through an environment.
Many organizations are not confident they can handle this shift. NTT DATA's 2026 Global AI Report found that only 38% of organizations report high confidence in their cloud security posture. If cloud architecture was fragile before, agents make the consequences arrive sooner and at greater scale.
What changes when attackers use agents
AI-powered attackers can find and exploit cloud security weaknesses at a speed human attackers can't match. "What makes agents different from human attackers is speed and exhaustiveness," said Omair Manzoor, founder and CEO of ioSENTRIX. A typical attack chain: an agent lands with a low-privilege identity, enumerates identity and access management (IAM) policies, identifies overly permissive roles, and chains two or three misconfigurations to reach critical assets.
The pace is the difference. "Where a human tester might evaluate 50 privilege escalation paths in a day, an autonomous agent can evaluate thousands in minutes, testing every combination of role assumption, policy boundary, and cross-account trust relationship," Manzoor said.
Cloud environments have become complex, with sprawling identities, permissions, APIs, workloads, and trust relationships. That complexity makes it harder for defenders to understand how individual weaknesses connect, while giving agents more relationships to map and test.
Network boundaries matter less than who or what can access your cloud, said Alissa Knight, founder and CEO of Assail, who has more than 20 years in offensive security. "The perimeter is the identity graph now, not the virtual private cloud," she said.
Authentication alone won't stop wider infiltration. Knight has seen agentic AI-generated applications where a user could authenticate with an MFA code without providing a username, and the code could be repeatedly guessed because there was no maximum number of attempts. The risk: organizations can prove someone is authenticated without adequately controlling what they're authorized to do once inside.
Excessive permissions and attack paths
Excessive permissions and interconnected misconfigurations are the most common weaknesses Manzoor finds in cloud assessments. "Organizations manage permissions in isolation - this role has these policies, this service account has that access. But cloud attack paths are not individual misconfigurations. They're chains," he said.
He gave an example: an S3 bucket with overly broad access is a low finding in isolation. But combined with a Lambda function that has an IAM role capable of assuming a cross-account admin role, it becomes a critical path to full environment compromise. "Agentic systems will map these chains automatically. Most organizations cannot see them today even with manual analysis," Manzoor said.
Assail data shows that shared node roles and flat trust between accounts do more damage than any single CVE. When AI can discover and connect weaknesses at a speed human security teams cannot match, "you're no longer dealing with a human adversary," Knight said. "You're dealing with an adversary that's using AI against you."
"If we're being hacked with AI, we should be hacking ourselves," she added, arguing that organizations need to use AI to identify and test the attack paths an AI-powered adversary could exploit.
Shifting from vulnerability lists to attack-path validation
Cloud security operations need to shift from identifying individual vulnerabilities to continuously validating whether attack paths remain exploitable. As agents become a new insider threat, CISOs must understand how permissions and misconfigurations interconnect to form attack paths, according to CSA's State of Cloud and AI Security report.
Manzoor sees a consistent gap between detection and architectural reality. "Organizations deploy CSPM tools that generate thousands of findings, but those findings are evaluated individually rather than as interconnected attack paths," he said. "An agent does not care about your individual findings. It cares about which combination of findings creates a viable path to your data. The defensive approach needs to match that - graph-based exposure analysis that maps real-time attack paths, not flat lists of misconfigurations."
He cites three architectural principles organizations need to adopt:
- Ephemeral credentials everywhere. No standing access, no long-lived keys, every permission is just-in-time and automatically expires.
- Federated workload identity. Service-to-service authentication that eliminates shared secrets entirely.
- Account-level segmentation. Hard boundaries between workloads so a compromised agent in one context cannot traverse to another.
Knight agrees that threat severity scoring assumes a human attacker with limited patience. "An agent does not triage by severity, it composes," she said. In its own Ares environment, Assail chained a metadata service exposure into a node role and then into the account - three findings that each scored as low or medium in isolation.
Point-in-time posture scanning is designed around human-attacker tempo. As agents compress attack times to minutes, posture scanning will need to determine whether an attack path is reachable. "That requires continuous adversarial validation, not a quarterly report," Knight said.
Short-lived workload identities can remove long-lived credentials from the attack surface, but that's only part of the problem. Knight said swapping a static key for a 15-minute token still carries the same overscoped policy and only shortens the window. "Scope reduction is the control; rotation is hygiene," she said.
Four cloud security shifts for CISOs
CISOs need to alter their strategic approach from assessing vulnerabilities to asking whether agents can create attack paths, and how quickly, in their cloud systems. Continuous attack-path validation, tightly defined identity and authorization controls, and deploying offensive agents will help protect against agent-led attacks. Teams looking to build these skills can start with training on AI for Cybersecurity Analysts or explore broader coverage of AI Agents & Automation.
Four shifts CISOs should initiate:
- From vulnerability management to attack-path management. Understand how identities, permissions, and misconfigurations connect.
- From perimeter security to identity architecture. Prioritize machine identities, delegated permissions, and privilege escalation.
- From periodic reviews to continuous validation. Cloud exposure management becomes continuous rather than relying on scheduled reviews.
- From cloud complexity to cloud simplicity. Architectural simplicity becomes a security advantage because AI exploits complexity.
Why this matters for management
Executives who oversee security budgets and risk decisions need to understand that the threat model has changed. A security team that reports "no critical findings" from quarterly scans may still be exposed - because agents don't need a single critical vulnerability. They chain several low-severity misconfigurations into a full compromise path. That means the questions for security leadership are no longer "what's patched?" but "what paths exist to critical data, and can an agent reach them?" Budgets and staffing for cloud security should reflect that shift toward continuous attack-path validation and identity architecture work.
Your membership also unlocks:
