Eight minutes to admin: why AI-assisted attacks shrink cloud response time

I read a breach report from The Register recently that stuck with me, not because an attacker used AI — that is not news any more — but because of how ordinary the rest of the story was. An intruder got from stolen credentials to administrative privileges in an AWS account in about eight minutes, according to Sysdig’s analysis. The intrusion happened on 28 November 2025, and Sysdig published its report on 3 February 2026. No novel exploit, no zero-day. Just a familiar attack path, run faster than a human would manage alone because, in Sysdig’s assessment, an AI copilot was helping with the code.

That is the part worth sitting with. Not “AI can attack you,” which we already knew, but “AI has quietly deleted the response-time cushion you were counting on.”

Three things are true at once right now, and they do not resolve into a tidy story:

• LLMs help attackers reason, plan, and generate exploit code faster than before.
• LLM APIs are themselves valuable cloud resources now, which makes them targets — credential theft, quota abuse, and what the security world calls LLMjacking. LLMjacking is the theft of cloud or LLM API credentials to run a victim’s paid model access at the victim’s expense.
• LLMs are embedded deep inside production systems used by hundreds of millions of people, sitting in the same blast radius as your databases and queues.

Banning AI use is not a serious answer to any of this — I am not going to pretend it is. The real question is narrower and more useful: how do you design infrastructure that stays resilient when the attacker on the other end has an AI copilot too? That is what this post is about.

How a stolen credential became an administrator

Sysdig’s reconstruction reads like a checklist of things that were each individually plausible. A test IAM user, likely created on purpose to automate Bedrock tasks with Lambda, had its credentials sitting in public S3 buckets that held RAG data. The attacker did not have to break anything. They simply used what that user was allowed to do.

Notice what is missing: a zero-day. Every step is an ordinary permission doing exactly what it was told to. The whole operation lasted about two hours and touched 19 principals, but the eight minutes to administrator is the part that matters for defenders.

---

Agentic attacks in 2026: JADEPUFFER and the marimo database breach

Two terms get blurred in the headlines. In an AI-assisted attack, a human uses an LLM to research, generate or adapt code. In an agentic attack, software drives an LLM in a tool-execution loop: it runs a command, reads the result, chooses the next action and adapts, with little or no human in between. Sysdig describes the eight-minute breach as the first kind, with LLMs used throughout the operation. It has since documented two cases it assesses to be the second kind. Those are the researchers’ conclusions from observed evidence, not proof that every stage was autonomous.

The first, published on 1 July 2026, is what Sysdig assesses to be the first documented case of agentic ransomware, tracked as JADEPUFFER; CyberScoop reported it. The entry point was a Langflow vulnerability (CVE-2025-3248, an unauthenticated remote code execution flaw in the /api/v1/validate/code endpoint of Langflow before 1.3.0). CyberScoop reports more than 600 distinct payloads in rapid succession, and that the agent accessed OpenAI, Anthropic, DeepSeek and Gemini keys while gathering information about the victim. Sysdig is careful about what it claims: it cannot see the operator’s prompt or configuration, so its conclusion that an LLM drove the operation end to end rests on inferences from the payloads.

The second happened on 10 May 2026. Sysdig described an LLM agent (report published 26 May) moving from a vulnerable marimo notebook (CVE-2026-39987) to an internal PostgreSQL database in four pivots and about an hour: remote code execution, replayed AWS credentials, an SSH key held in AWS Secrets Manager, and an SSH bastion. Different entry points, same underlying story: the skill and time an attack used to require have both dropped, and the defence has to be structural rather than reactive to keep up.

---

Key takeaways: least privilege, fast detection, small blast radius

🔒 Subscribe to keep reading.

References

🔒 Subscribe to keep reading.