Offensive Eng #4: Cloud Security Crosses Into Machine Scale
Michael Clark and Crystal Morin on the four-hour exploitation window, an identity layer that is 97% machine, and the automated response almost nobody switches on.
On July 16, Hugging Face disclosed an intrusion into its production infrastructure that ran end to end without a human at the keyboard. An autonomous agent exploited two code execution flaws in the dataset processing pipeline and escalated privileges from there. It harvested cloud and cluster credentials and moved laterally across internal clusters over a single weekend. The company detected and dissected the whole thing largely with AI of its own.
This incident is the clearest evidence yet of the argument at the center of this issue. The gap between disclosure and exploitation has collapsed to hours, the thing closing it is increasingly an agent rather than a person, and the defensive response still runs at human speed.
We work through what that shift means with Michael Clark, Senior Director of Threat Research at Sysdig, and Crystal Morin, Senior Cybersecurity Strategist at Sysdig.
Clark’s team builds the company’s detection content and researches cloud, Linux, and Kubernetes threats. Morin works with that team to explain the threat landscape to security leaders and the organizations trying to harden their attack surface.
This issue covers how fast the exploitation window has actually collapsed, what attacks look like when the process behind them is an agent rather than a person, and why the identity layer and the response layer are where the machine-speed problem now concentrates.
Let’s get started.
THIS WEEK’S LEADERSHIP INTERVIEW
Five Eyes Warning on AI Speed with a Military Veteran and CISO
Response timelines are collapsing at the policy level too, not just inside the SOC. Our recent InfoSec Leadership session covers that same collapse from a policy and leadership vantage point. It pairs naturally with today’s issue for anyone thinking about how the machine-speed problem lands at the executive level.
THE INSIDER VIEW
Weaponization Outruns Discovery as 97% of Identities Are Now Machines
Featuring Michael Clark, Senior Director of Threat Research at Sysdig, and Crystal Morin, Senior Cybersecurity Strategist at Sysdig.
Attackers now weaponize a vulnerability faster than a security team can read the advisory that announced it. The gap between disclosure and exploitation has closed to a window measured in hours, and the thing closing it is no longer a human working through a playbook. It is an agent composing one in real time, adapting to whatever it finds, and moving across environments at a speed no analyst can match. That shift is what pushes cloud defense past the limits of human effort, and it reframes the entire question security teams have been asking. The problem was never a lack of effort. It is that the battlefield now moves at machine speed while the response still runs at human speed.
A few hours from advisory to widespread exploit
Speed of exploitation is the clearest measure of whether human-paced security still works. Clark shares what his team found when they went looking for that number, and it compresses the timeline to almost nothing.
“We’ve had, I think, four hours is our current record of an advisory being posted and then seeing it being used, like, widespread on the internet,” Clark recalls. Weaponization has stopped trailing discovery the way it used to. “The weaponization of vulnerabilities is happening just as fast, if not faster than the discovery, because weaponization can be a bit simpler than the discovery aspect.” Agents collapse the phases into each other. “It’s an agentic threat actor that can go from nothing to something in an hour, a few hours, to widespread exploitation.”
That four-hour window runs against a clock most organizations do not watch. Morin walks through why it starts at the GitHub advisory rather than the CVE, and what that gap does to anyone relying on standard vulnerability feeds.
“This is a GitHub advisory. We’re not even talking about when a vulnerability gets to CVE status, which is when a lot of organizations will actually get that realization that there is a vulnerability they may be exposed to,” Morin explains. She highlights how conventional patch cadences no longer describe reality. “If you have alerting based on CVE, or even later than that, like the CISA KEV, you’re way beyond too late. CVEs come days after a GitHub advisory is published. That Windows Patch Tuesday cadence for fixing vulnerabilities doesn’t really work anymore with this kind of exploitation timescale.”
Agents make the same moves and different mistakes
Speed is the new part. The underlying moves are not. An agent still wants credentials, still wants persistence, and still wants to spread. Clark walks through how his team reads the difference in small details rather than in new behaviors.
“It doesn’t look all that different, honestly, than typical attacks, because the same things have to happen,” Clark notes. “However, there are keys that give away that it’s an agent.” Legibility is one of them. An agent consumes its own output, so attackers format everything for a machine to read cleanly, which a human running scripts would not bother doing. The mistakes are another. “When you give it all these permissions, give it these broad tasks, it’s going to make mistakes, and those mistakes are kind of predictable, because they’ll go down certain paths that a person wouldn’t, or get tripped up on some information that a person wouldn’t.” He adds that the same adaptability behind those mistakes is what makes an agent dangerous. “It’s also smarter. It doesn’t need a set schema. It can adjust on the fly, good or bad, which a human would generally take some time in between. Now the LLM can make all those decisions on where to go, what to do, quickly, which is another tell that it’s an agent behind it.”
That difference lands hardest on the part of the environment that is now almost entirely non-human. The identity layer has inverted, and Morin points to Sysdig’s cloud-native usage research for how far it has gone.
“The managed identities in a cloud service provider currently are about ninety-seven percent machine identities,” she says. “Only about three percent of identities in an enterprise environment belong to human accounts. The rest are machine identities.” The inversion sets the terms for everything downstream. “You need to be securing a large portion of machine identities. The security concerns around all of those identities, with AI agents assuming machine identities and using those APIs, is very challenging right now.”
AI-generated malware lowers the barrier more than it changes the signature
Sysdig’s research surfaced malware scripts that were up to ninety-five percent AI-generated. Clark explains why machine authorship changes less about detection than that number suggests.
“It does carry different behaviors, but it’s hard to describe. They still use the same techniques for detection,” he says. Part of the difference is cosmetic and even helpful, because AI is verbose and documents itself, which leaves strings a hunter can key on. The real tell is customization at a scale nobody would attempt by hand. “We see custom scripts that have the target hostname built in and data about the host built into the script. Usually you wouldn’t see that if it’s a human. It would be a generic script being run, not one tailor-made with the values only for that host.”
Reach and speed are what actually change. Clark describes one piece of Sysdig research that tracked an agent through four environments in the span a person would need for one. “It pivoted across four environments. It compromised a service on Linux, went into AWS and compromised that area and found secrets, then went into another SSH jump server, found secrets, then went into a Postgres database from that host.” Someone working that same path by hand would have taken far longer. “That would have taken a human attacker a while, and we haven’t seen a human attacker do that much in a while. But we’ve seen a number of agentic threat actors do it. Everything’s just much more condensed in time now.” The barrier to entry drops with it. “It lowers the barrier of entry for all these different technologies the attacker may not have understood. Once they point their tool at it, it understands and can reach the goal without too much instruction.”
Trust is the reason automated response sits unused
Machine-speed attacks call for machine-speed responses, and most organizations have already built that capability. Most of it sits idle. Morin works with the leaders making that call, and the blocker she describes is not technical at all. It is the fear of what an automated action might break.
“The thing with using automation for response actions is, generally speaking, it’s a little scary,” she says. “You pull a trigger for an automated response on a detection alert, and if you’re wrong and it was a false positive and you kill a container, you’re accidentally taking down your environment. Now your website’s down and it was an accident.” Getting past that fear runs through detection quality. “A really important part of being able to use automated response actions is having high-fidelity detections. So moving from IOC-based detections to behavioral detections, building your detections off of several cases of what an attacker is doing, bringing in the identity-based behaviors plus the scripts plus several other things.” Confidence is what turns configured capability into used capability. “We’re seeing about seventy-five percent, roughly, of our customers using behavior-based detections.”
Morin expects that gap to close as detection quality rises and a human stays reachable inside the loop. The economics already favor acting early. “I think we are better off using automated response to contain incidents and then investigate, take the time on the back end, versus having to deal with a breach and the financial fallout on the back end instead.”
MCP servers turn the connective layer into the target
The model is no longer the whole attack surface. Agents get wired into tools and data through connective layers like Model Context Protocol servers, and Clark describes what his team sees taking shape in that wiring.
“It can take a few forms. One is abusing the tools that are provided,” he explains, describing a vulnerable tool exposed through the prompt interface that became a path to a reverse shell. “You go through the input layer and you’re able to get a reverse shell through the prompt, because it calls a tool that gets passed the bad data.” A second pattern is stranger and cheaper for the attacker. “We’re seeing people using compromised tools like Ollama and other models to do agentic attacks because they don’t want to use their own infrastructure. They have all the data processing go through compromised infrastructure instead of spending their own money on it, because the models they want are generally larger than what someone could run on their own GPU.” He recalls watching it happen in near real time. “One of the things we were looking at this morning was an attacker developing a toolkit to compromise a web app, and you can see the prompts going back and forth. Everything is theirs but the inference engine, which is local to them, and they used the compromised system just for that part of it.”
Credentials are what make that layer worth attacking, and they are the same asset that has always driven cloud intrusions. “Those trust layers hold credentials, and a lot of threat actors right now want credentials. Those are the gems for any organization. If they’re able to exploit these AI tools and find credentials, they can take full cloud compromise from their OpenAI keys, Anthropic keys, Bedrock, all just from a single organization, because all of those exist in that single layer,” Morin notes. That concentration turns one credential find into a cascade, and the response has to move as fast as the theft. Rotation only works when an organization knows where its credentials live, and the supply-chain intrusions Sysdig has tracked suggest most do not. The old saying still holds. It is easier to log in than to hack in.
Runtime catches the pipeline attack where credentials move
CI/CD pipelines are the other blind spot, high value and low visibility, increasingly wired straight into AI training and inference environments. Runtime detection picks up a compromised pipeline for one specific reason.
“Runtime is actually pretty useful, at least in a scoped use case on CI/CD, because you can monitor all the workloads that are running for malicious behavior,” Clark says. The attacker’s objective forces an observable action. “Credentials are still the big target in CI/CD, because in order to do anything, that job needs credentials to push the software somewhere or get it from somewhere. If they get access to that workload, they can easily dump those credentials, and that’s a behavior that can be seen at runtime.” He also updates the mental model most people still carry from the last era of supply-chain attacks. “Most people think of SolarWinds and the old way of modifying software to do malicious activities. That’s still the case. But more often, the malicious action is just inserting code to send credentials somewhere.” The deeper attack, against training data itself, stays hard to see. Watching bucket access at the object level costs more than most teams will spend, so credential theft is often the only part of the chain they catch.
Guardrails are a speed bump, not a wall
Badly scoped guardrails let agents cause damage inside the limits someone set for them. Clark observes that the vulnerability classes behind that are old ones in new packaging, and that the most common failure is simpler still. Plenty of agentic workflows have no guardrails at all.
“Not really new, but the lack of guardrails is still the most common,” he says. The gap traces to how small an agentic workflow feels to the people building it. “It’s easy to forget to put guardrails on an agentic workflow because it feels so much smaller than a chatbot. It’s just two programs talking to each other versus a human putting an input. So it’s easy to forget that the model behind that agent is a lot bigger than what it’s being used for.” Guardrails that do exist offer less protection than most teams assume. “Guardrails are only so effective. They’re not a very reliable security mechanism. They can make things more difficult, more time-consuming, but I would not rely on them to block anything, just make things take longer.”
Guardrails leak because of what an agent needs in order to do anything useful, which is access. “To do most of anything, an agent needs credentials and permissions to do something, otherwise they’re just chatting with you. Sometimes the AI part is just an interface to some code, and that code can be abused or exploited if there’s a flaw,” Clark explains. The agent is a doorway to tooling that carries real privilege, and the flaw an attacker exploits usually sits in that tooling rather than in the model.
Identity governance is where the pressure lands hardest, and it is far harder to execute than to describe. “Identity governance means actually scoping and taking care of your identity hygiene. That’s short and sweet to say, but I know that’s really hard to do, especially when some enterprises have tens of thousands or even hundreds of thousands of identities,” Morin says. The environment keeps getting more dynamic while the basics go unmet. “We’re still seeing basic identity hygiene errors. Multi-factor authentication isn’t enabled still, even for human accounts. Rotating credentials and keys, especially for machine identities and AI agents, that’s basic hygiene stuff we really need to be doing.” She highlights how agentic coding accelerates the habits behind that. “We’re able to use Claude Code and develop applications much faster when we have access to all of these credentials and permissions. We need to take a step back and remove permissions we use, because unused permissions are just an open gateway for attackers.” The same technology driving the risk is suited to fixing it, because identity management at this scale is continuous, high-volume work.
Weaponizing the defense is the next adversarial move
Autonomous response at machine speed carries a danger of its own. A detection error turns into an action error instantly, so an attacker who works out the automation can trigger it deliberately and cause the disruption.
“That’s definitely an interesting way to look at it, and it is something we warn users about,” Clark says. Obscurity helps at the margin, and AI erodes even that. “AI makes everything more scalable, so on their end, maybe they can work out what gets triggered just by sheer volume of requests.” No single detection should ever drive a destructive action. “Doing a destructive automatic action based off of a detection is always going to be very dangerous. A rule will never be a hundred percent sure. So what we’re going to end up seeing is multiple pieces of information used to make that decision, and it may be taken by an AI that can judge these disparate pieces of information quickly enough to quarantine or take some mitigation action, instead of just one thing.”
The structural disadvantage in that contest runs against the security team. “An attacker’s model is just running for them on one target. A defender’s model has to take all the signals. On the blue side you usually have one big model doing everything, and an attacker can focus much more narrowly, which means they can operate faster than the big model.”
Preparation is the counter, and Morin suggests that running the scenario in advance costs almost nothing. “It would be very fun to do a little tabletop exercise, sitting down and working through what kind of disruption it could have on your organization,” she says. Resilience rests on the same foundation as accuracy. “Automated responses should be based on behavioral detections, not just single events. The correlation of multiple different things happening will improve your resilience.”
Analysts will work more like developers
Sysdig’s report calls this the end of the hustle-hard era. Morin expects the workload on the other side of that transition to change shape rather than shrink.
“I don’t think it’s going to change much. We’re still going to be incredibly busy,” she says. “Our days as security analysts are going to look a little bit more like developers do right now, interacting a lot more with Claude Code or whatever your agentic AI of choice is.” The role turns supervisory rather than manual. “Rather than jumping through hoops to solve security problems, we’re going to be interacting with agentic AI platforms. You’ll be the human in the loop of an agentic SOC. It’s still going to be threat actors versus defenders, still operating at speed. It’s a constant game of cat and mouse. It’ll just look a little bit different.”
The three-year horizon looks less certain, and one variable decides whether the picture improves. “We’re finding a lot of vulnerabilities. At some point that’s got to go down, I expect. But to balance that, is AI really improving code to cause less vulnerability? So far, it doesn’t seem so. There has to be some sort of change in the next few years where it improves, otherwise it’s going to be pretty untenable.” He spent years skeptical of using AI defensively until his own team proved it worked, and his advice carries that history. Get access to as much telemetry as possible, then let AI run down leads across platforms far faster than a person could, provided the team has done the work to reach that data securely.
Losing is not the through-line here. Morin, four years into analyzing this data, wants to correct the record on that point. “As much as the media makes it out that defenders aren’t doing a good enough job, I would say quite the opposite. We’ve made incredible headway in the last couple of years improving our defenses. We are getting better at defending our cloud environments, and I only see it going up from here.” The hustle-hard era is ending because effort alone stopped scaling. What replaces it is not less human judgment but human judgment applied at a different altitude, governing machine-speed systems rather than racing them.
THIS WEEK’S PERSON OF INTEREST
Parisa Tabriz, aka Security Princess, Google
Parisa Tabriz carries the semi-official title that made her famous, the Security Princess, a label she chose herself years ago because Information Security Engineer sounded too dull for a business card. The whimsy undersells the work. Tabriz leads Chrome as Vice President and General Manager, securing a browser used by more than three billion people, and she has run Google’s Project Zero, the offensive research team dedicated to finding zero-days in software the whole industry depends on.
Her work at Google has been about attacking the root cause rather than the symptom, from driving HTTPS adoption across the web when less than half of Chrome’s traffic was encrypted, to the sandboxing architecture that isolates one compromised process from everything around it. Chrome is now the endpoint for most enterprise work, and the same agentic capabilities driving the attacks in this issue are being wired directly into the browser. Her keynote argument at Black Hat, made years before agentic AI forced the point, has aged into a thesis for the moment. Tackle the root cause, invest in the long-arc projects that do not pay off for years, and build coalitions that reach beyond security specialists.
THIS WEEK’S SECURITY BRIEFS
Four things worth knowing from the past few weeks, all of them about credentials and how easily they move.
Invisible comments turn a reviewer’s agent against them
Microsoft’s official Azure DevOps MCP server hands pull request descriptions straight to an AI agent, skipping the prompt injection guardrail it already applies to wiki and pipeline content. Manifold Security showed that an attacker can hide instructions inside an HTML comment, wait for a reviewer’s agent to read the pull request, and ride that reviewer’s permissions into projects the attacker cannot touch. Microsoft has triaged the report, with no CVE assigned and no fix shipped.
Shadow release branches open a clean path into CI/CD
AsyncAPI protected its main branch with review rules and left its pre-production branches open. Attackers pushed malicious commits straight to those branches, which triggered the release workflows anyway. The injected code ran inside the CI runner and harvested NPM_TOKEN and GITHUB_TOKEN on the way through.
Four supply chain attacks hit npm and PyPI in six weeks
Between early June and July 14, GitGuardian tracked a Shai-Hulud worm variant, a set of typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline. Each one got in a different way. Each one was after the same thing, which is the credentials sitting in developer environments and build pipelines.
Identity compromise sits behind most cloud intrusions
Google Cloud’s H1 2026 Cloud Threat Horizons report puts identity compromise behind 83% of the intrusions it tracked. Stolen human and non-human identities alone provided initial access in 21% of cases. Unpatched third-party software and permissive user-defined firewall rules account for much of what is left.
Thank you for reading Offensive Engineering, a newsletter from InfoSec Relations. We will be back next week.
Stay curious, stay secure.
S Pattnaik -Data Practitioner
Volunteer Technical Contributor, Offensive Engineering, InfoSec Relations