Agents are forcing a rethink of cloud security architecture. Here’s what CISOs should do to prepare for what’s next.
Cloud architectures designed to withstand human attackers are facing a new threat: AI agents that rewrite the rules on the pace and scope of attacks.
The recent OpenAI incident involving Hugging Face offers an early example of what an autonomous AI attack can look like, with an agent exploiting multiple weaknesses to escalate access and move through an environment.
Many organizations report being uncertain about their ability to secure their cloud environments, with NTT DATA’s 2026 Global AI Report finding only 38% report high confidence in their cloud security posture.
If cloud architecture was fragile before, agents make the consequences arrive sooner and at greater scale. The challenge for CISOs is protecting against agent adversaries that can chain vulnerabilities and execute attacks at machine speed.
How agents change the cloud threat model
AI-powered attackers have the potential to find and exploit cloud security weaknesses at a speed and scale that human attackers can’t match.
“What makes agents different from human attackers is speed and exhaustiveness,” says Omair Manzoor, founder and CEO of ioSENTRIX.
Testing shows how an attack could play out: An agent or attacker lands with a low-privilege identity, enumerates identity and access management (IAM) policies, identifies overly permissive roles, and chains together two or three misconfigurations to reach critical assets.
What’s striking, is how quickly an agent can test the available paths.
“Where a human tester might evaluate 50 privilege escalation paths in a day, an autonomous agent can evaluate thousands in minutes, testing every combination of role assumption, policy boundary, and cross-account trust relationship,” Manzoor says.
Cloud complexity expands the attack surface
Speed matters because cloud environments have become complex, with sprawling identities, permissions, APIs, workloads, and trust relationships. That complexity makes it harder for defenders to understand how individual weaknesses connect, while giving agents more relationships to map and test.
As agents proliferate, network boundaries matter much less than who (or what) can access your cloud, says Alissa Knight, founder and CEO of Assail. “The perimeter is the identity graph now, not the virtual private cloud,” says Knight, who counts more than 20 years in offensive security.
Authentication alone is not enough to protect against wider infiltration. Knight has seen agentic AI-generated applications where a user could authenticate with an MFA code without providing a username, while the code could be repeatedly guessed because there was no maximum number of attempts.
It highlights the importance of authorization, not simply authentication. Proving access to the system does not necessarily mean the identity has been properly restricted once inside. The risk, she says, is that organizations can establish that someone is authenticated without adequately controlling what they’re authorized to do once inside.
Excessive permissions and interconnected misconfigurations are the most common weaknesses Manzoor is finding in cloud assessments.
“Organizations manage permissions in isolation — this role has these policies, this service account has that access. But cloud attack paths are not individual misconfigurations. They’re chains,” he says.
He gives the example of an S3 bucket with overly broad access — a low finding in isolation, but when combined with a Lambda function that has an IAM role capable of assuming a cross-account admin role, it becomes a critical path to full environment compromise.
“Agentic systems will map these chains automatically. Most organizations cannot see them today even with manual analysis,” he says.
Individual weaknesses can be connected in a way that creates vulnerabilities that aren’t apparent in isolation. Assail data has shown that shared node roles and flat trust between accounts do more damage than any single CVE in an environment.
When AI can discover and connect weaknesses at a speed human security teams cannot match, “you’re no longer dealing with a human adversary,” Knight says. “You’re dealing with an adversary that’s using AI against you.”
“If we’re being hacked with AI, we should be hacking ourselves,” she adds, arguing that organizations need to use AI to identify and test the attack paths an AI-powered adversary could exploit.
Adapting cloud security operations
Cloud security operations need to shift from identifying individual vulnerabilities to continuously validating whether attack paths remain exploitable.
As agents become a new insider threat, the challenge for CISOs is to look beyond isolated vulnerabilities to understand how permissions and misconfigurations could interconnect to form attack paths, according to CSA’s State of Cloud and AI Security report.
Manzoor sees a consistent gap between detection and architectural reality. “Organizations deploy CSPM tools that generate thousands of findings, but those findings are evaluated individually rather than as interconnected attack paths,” he says.
“An agent does not care about your individual findings. It cares about which combination of findings creates a viable path to your data. The defensive approach needs to match that — graph-based exposure analysis that maps real-time attack paths, not flat lists of misconfigurations,” he says.
He cites three architectural principles that organizations need to adopt to prepare for agentic threats:
- Adopt ephemeral credentials everywhere. “No standing access, no long-lived keys, every permission is just-in-time and automatically expires.”
- Ensure workload identity is federated. “Service-to-service authentication that eliminates shared secrets entirely.”
- Establish account-level segmentation. Blast radius containment needs account-level segmentation, not just network segmentation within a single account. “Hard boundaries between workloads are needed so that a compromised agent in one context cannot traverse to another.”
Knight agrees that threat severity scoring assumes a human attacker with limited patience.
“An agent does not triage by severity, it composes,” she says.
As an example, in its own Ares environment, Assail chained a metadata service exposure into a node role and then into the account, three findings that each scored as low or medium in isolation.
Point-in-time posture scanning is designed around human-attacker tempo. However, as agents compress attack times to minutes, mean time to remediate may be less important. Instead, posture scanning will need to determine whether an attack path is reachable.
“That requires continuous adversarial validation, not a quarterly report,” she says.
Identity-based credentials will also need to change. Short-lived workload identities can remove long-lived credentials from the attack surface, but that is only part of the problem.
Knight says swapping a static key for a 15-minute token still carries the same overscoped policy and only shortens the window. It changes nothing about the blast radius.
“Scope reduction is the control; rotation is hygiene,” she says.
Checklist for cloud security rethink
Overall, CISOs need to alter their strategic approach from assessing vulnerabilities to asking whether agents can create attack paths, and how quickly, in their cloud systems. Continuous attack-path validation, tightly defined identity and authorization controls, and deploying offensive agents will also help protect against agent-led attacks.
With that in mind, here are four cloud security shifts CISOs should initiate:
- From vulnerability management to attack-path management. Understand how identities, permissions, and misconfigurations connect.
- From perimeter security to identity architecture. Prioritize machine identities, delegated permissions, and privilege escalation.
- From periodic reviews to continuous validation. Cloud exposure management becomes continuous rather than relying on scheduled reviews.
- From cloud complexity to cloud simplicity. Architectural simplicity becomes a security advantage because AI exploits complexity.