InfoSecBulletin Cybersecurity for mankind
A major AWS attack shows how attackers with AI can connect known cloud strategies to go from first access to complete control in about 72 hours, not with new tools, but with very fast and organized actions.
According to Sygnia’s investigation, the threat actor got access to an AWS account by taking advantage of a flaw in an internet-facing app, then moved through various applications, cloud systems, code storage, CI/CD pipelines, and services running in real-time.
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Each newly harvested credential triggered a renewed wave of discovery, secrets collection, persistence attempts, and impact-oriented actions, creating overlapping “attack waves” rather than a single linear kill chain.
Signs of AI-Assisted Operations
Multiple clues showed that AI tools helped run the campaign. In one clear case, four different access keys linked to four accounts were used from the same source IP and user-agent in just one second. This level of speed is hard to explain with human work.
The actor ran many different SQL queries on many databases and quickly found links between cloud queues, workers, and deployment files. This showed the need for special changes instead of just using one-size-fits-all scripts.
Attacker-created artifacts were also framed as an authorized “pentest” or “red team” exercise, potentially to mislead investigators or to reduce refusals from AI tools that generate offensive code.
This discovery fits with wider trends in the industry seen in 2026, where security experts have reported AI speeding up cloud attack times.
Sysdig’s Threat Research Team described a November 2025 event where a hacker used large language models to quickly gain full AWS control in eight minutes by adding harmful code to a Lambda function.
| Attack Dimension | Traditional Intrusion | AI-Accelerated Intrusion |
|---|---|---|
| Attack path | Linear progression through stages | Overlapping “waves” triggered by each new credential |
| Technique execution | Selective, targeted actions | Broad “checklist” execution across many known techniques |
| Concurrency | Sequential, single-operator pace | Multiple identities operated in parallel simultaneously |
| Tooling | Pre-built scripts reused | Custom scripts generated on demand for new surfaces |
| Credential management | Manual tracking | Persistent “operational memory” across dozens of keys |
This case also did not use any zero-days or new malware. It only had stolen credentials, regular AWS services, and AI help for gathering information, gaining access, and moving sideways through 19 different AWS identities.
Vectra AI researchers noted that AI “removed friction” from the attack, letting the actor enumerate services and evaluate privilege paths faster than any manual operator could.
Sygnia’s CISO Survey 2026 showed that 73% of 600 top security leaders think their companies will not be ready for a major cyberattack happening “tomorrow.”
Sygnia suggests changing how we handle incidents from a step-by-step method to one that works on investigation and containment at the same time. Key defensive priorities are:
Assume credential exposure and rotate all secrets, keys, and tokens aggressively across cloud, CI/CD, and application layers.
Enforce identity-first security, including MFA, session revocation, and disabling compromised accounts immediately.
Apply broad network containment (IP allowlisting, outbound restrictions, WAF enforcement) as a first response action.
Automate detection, credential rotation, and containment workflows to match attacker speed.
Rebuild compromised non-production environments from trusted infrastructure-as-code templates rather than attempting full manual eradication.
Removing old IAM credentials, limiting AI service permissions, and viewing identity as very important infrastructure are now key measures against fast AI cloud attacks.
The main lesson from these 2026 events is clear: as the use of offensive AI speeds up and works through all parts of an attack, those defending must keep up with automated responses that are well connected, instead of using separate, individual tools.
