Sysdig details rapid AI-driven cloud breach 

A rapid cloud breach detailed by Sysdig illustrates how threat actors are increasingly using AI to compress attack timelines and deepen impact, according to Security Boulevard. 

According to Sysdig researchers Alessandro Brucato and Michael Clark, attackers leveraged exposed credentials in public AWS S3 buckets to escalate from initial access to full administrative privileges in under 10 minutes during a November 2025 incident. The operation showed multiple signs of large language model use, including automated reconnaissance, code generation, and real-time decision-making, with the full sequence completed in eight minutes.

Once inside, the attackers moved laterally across identities, extracted sensitive data from multiple AWS services, and injected malicious code into Lambda functions. They also abused the compromised environment to run AI models via Amazon Bedrock and attempted GPU hijacking in EC2, potentially creating significant cloud costs. 

Sysdig warned that AI-driven attacks will grow more effective as models improve, urging organizations to prioritize runtime detection and least-privilege controls. AWS said the incident stemmed from misconfigured S3 buckets rather than flaws in its infrastructure, reinforcing the role of basic cloud security hygiene amid accelerating AI-enabled threats.