Loading story…
Security research and incident response reporting highlighted how AI-enabled tactics are accelerating cloud compromise and expanding the blast radius into ML systems. Sysdig described an incident in which attackers used exposed credentials in public AWS S3 buckets to escalate from initial access to full administrative privileges in under 10 minutes, then moved laterally across identities, exfiltrated data from multiple AWS services, and injected malicious code into AWS Lambda. The activity also included attempts to monetize access by running AI workloads through Amazon Bedrock and attempting GPU hijacking in EC2, creating potential for significant cloud cost impact; AWS characterized the root cause as S3 misconfiguration/credential exposure rather than an AWS infrastructure flaw.
Mitiga reported a separate real-world investigation where a threat actor exploited a path traversal flaw in an AI-enabled file upload/summarization web application to overwrite production training data in an S3 bucket feeding an automated SageMaker retraining pipeline. The poisoned dataset introduced subtle label inconsistencies and a trigger pattern that, after retraining and deployment, enabled the attacker to reliably induce anomalous model behavior with crafted inputs—effectively a persistent training data poisoning compromise of a production AI endpoint. In contrast, Kiuwan’s post is primarily a general advisory on AI development supply-chain visibility risks (e.g., unvetted dependencies introduced by LLM coding assistants) and does not describe the same specific incidents or provide incident-specific indicators.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-10, Sysdig disclosed details of the November 2025 AWS breach, warning that AI-enabled attacks are compressing intrusion timelines and increasing impact. AWS responded that the incident stemmed from S3 misconfiguration rather than an AWS infrastructure flaw and stressed basic cloud security hygiene.
On 2026-02-10, Mitiga published its analysis of the AI training pipeline compromise, describing it as an AI supply-chain attack in which a web application flaw cascaded into ML integrity failure. The report recommended layered controls around data integrity, IAM scoping, monitoring, and zero-trust network design.
The malicious dataset triggered retraining through S3 event notifications and EventBridge, resulting in a model with subtle label noise and an embedded trigger pattern being deployed to a live SageMaker endpoint. The backdoor allowed attacker-controlled false positives or false negatives when specially crafted inputs were submitted at inference time.
In a real-world incident disclosed by Mitiga, an attacker exploited a path traversal flaw in an AI-enabled file upload application to write a tampered dataset into a production S3 bucket. Overly broad IAM permissions allowed the poisoned data to reach an automated Amazon SageMaker retraining pipeline.
After obtaining administrative control in the November 2025 breach, the attackers moved laterally across identities, accessed sensitive data in multiple AWS services, injected malicious code into AWS Lambda functions, and attempted to run AI workloads through Amazon Bedrock and hijack EC2 GPU resources.
In November 2025, attackers used credentials exposed in public S3 buckets to gain initial access to an AWS environment and escalate to full administrative privileges in under 10 minutes. Sysdig said the activity showed signs of large language model assistance, including automated reconnaissance, code generation, and rapid decision-making.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sysdig reported observing an offensive operation against an **AWS** environment in which a threat actor progressed from initial access to **administrative privileges in under 10 minutes**, with multiple indicators suggesting **large language models (LLMs)** were used to accelerate reconnaissance, code generation, and decision-making. Initial access was obtained via **valid credentials exposed in public S3 buckets**, reportedly associated with AI/RAG-related data and an IAM user used to automate *Amazon Bedrock* tasks via *AWS Lambda*. The actor then escalated privileges via **Lambda function code injection**, moved laterally across **19 AWS principals**, and abused *Amazon Bedrock* in an **LLMjacking** pattern while also provisioning **GPU-capable compute instances** for suspected model-related activity. Dark Reading’s coverage echoed Sysdig’s findings, emphasizing the speed of the compromise, the role of AI as a force multiplier, and post-compromise activity including **data collection/exfiltration** and **GPU instance provisioning**. In contrast, TechTarget’s “must-have security technologies” piece and SecuritySenses’ discussion of borrowing financial risk models for security are **general guidance/trend** articles and do not describe this specific intrusion or provide incident-specific technical details, making them non-contributory to the reported AWS compromise.
Jun 29, 2026
A financially motivated lone attacker used AI-assisted workflows to breach a large **AWS** environment in roughly 72 hours, according to a Sygnia incident-response report, chaining weaknesses across Internet-facing applications, AWS resources, source code repositories, **CI/CD** pipelines, runtime components, and data stores. The intrusion reportedly began with the theft of an AWS access key and expanded through secrets harvesting, cloud enumeration, backdoor creation, data exfiltration, deployment pipeline abuse, runtime modification, database access, and operational disruption. To extort the unnamed global enterprise, the actor carried out mostly reversible actions including denying access to **S3** buckets, scaling **ECS** services to zero, blocking network access with ACL rules, and purging **SQS** queues. The incident reflects a broader shift from isolated malicious use of generative AI to **agentic AI** supporting larger portions of the attack chain. Research cited by OALABS and observations from Anthropic indicate attackers are using tools such as **Claude** and **OpenAI Codex** to automate reconnaissance, analyze stolen data, generate code, and adapt operations during live intrusions, lowering the barrier for less-skilled actors while helping experienced operators scale activity. Security researchers said the trend now spans multiple **MITRE ATT&CK** tactics, including reconnaissance, credential theft, malware development, and social engineering, pushing defenders to prioritize detection of AI-enabled workflows, stronger identity controls, broader visibility, and faster automated containment.
Jul 9, 2026
Multiple reports warn that the most immediate AI security risk is **attackers hijacking trusted workflows**—AI copilots/agents, CI pipelines, SaaS admin planes, and identity control points—rather than “AI” being a standalone threat category. Commentary and research highlight how prompt-injection-style techniques can turn normal user actions (e.g., clicking a legitimate-looking link) into **silent data exfiltration** or unsafe tool use, and how autonomous agents can still complete scams even when they can correctly label a page as phishing. 1Password introduced an open-source benchmark, **Security Comprehension and Awareness Measure (SCAM)**, to test whether AI agents behave safely in realistic workplace tasks (email triage, link clicking, retrieving credentials from a vault, and form-filling) using production-like APIs; in testing, models that could identify phishing when asked still proceeded to **retrieve and submit real credentials** during routine workflows. Microsoft research described **AI recommendation poisoning** affecting 31 companies across 14 industries, where hidden instructions embedded in “*Summarize with AI*” links attempt to inject persistent directives into an assistant’s memory via URL prompt parameters, biasing future recommendations (e.g., prioritizing a specific domain/company). Separately, identity-focused analysis argues that as AI increases automation and API-driven decisioning, **identity becomes the enterprise control plane**, making IAM architecture and resilience (including where policy evaluation and authorization live) a central security concern at “AI scale.” Two SC Media opinion pieces broaden the theme: one ties recent supply-chain and developer-workflow compromises (e.g., malicious packages/actions and token theft) to the same “trusted workflow” abuse pattern, while another discusses mobile apps as an early-warning surface for supply-chain risk (including AI arriving via third-party SDKs), but it is more forward-looking guidance than incident reporting.
Jun 29, 2026