AI is no longer only helping attackers write better phishing emails or generate malicious code snippets. New research shows that autonomous AI agents can now carry out complex cloud attack chains with minimal human guidance.
A recent proof-of-concept study by Palo Alto Networks Unit 42 demonstrated that a multi-agent AI system could move from cloud reconnaissance to sensitive data access in a live, deliberately misconfigured Google Cloud Platform environment using a single natural-language instruction. Unit 42 named the system Zealot, describing it as a multi-agent penetration testing PoC designed to test autonomous offensive capabilities in cloud environments.
Why This Matters
The most important takeaway is not that AI created a new vulnerability. It did not.
Instead, AI acted as a force multiplier. It rapidly chained together known cloud weaknesses such as misconfigured permissions, exposed metadata services, vulnerable web applications, and overly permissive cloud identities. Unit 42’s researchers concluded that current LLM-based agents can already chain reconnaissance, exploitation, privilege escalation, and data exfiltration with minimal human guidance.
For defenders, this changes the timeline. What previously required a skilled attacker to manually move through an environment could now be compressed into minutes.
From AI Assistant to AI Operator
This research follows a major warning from Anthropic in November 2025, when the company reported disrupting what it described as the first documented large-scale cyber-espionage campaign executed without substantial human intervention. Anthropic said a Chinese state-sponsored group abused Claude Code to attempt infiltration against roughly 30 global targets, with AI used not just as an advisor but to execute parts of the attack workflow.
Unit 42’s Zealot study suggests that this was not an isolated edge case. It was a preview of how agentic AI could be used to automate real intrusion chains.
How Zealot Was Built
Zealot was designed as a multi-agent system with a central supervisor coordinating three specialist agents:
- 🛰️ Infrastructure Agent — maps the cloud environment and discovers reachable systems
- 🧪 Application Security Agent — probes web applications and identifies exploitable weaknesses
- 🔐 Cloud Security Agent — uses discovered credentials or permissions to enumerate cloud resources and reach sensitive data
The supervisor agent maintained the overall mission state, decided which specialist agent should act next, and passed context between them. This is important because cloud attacks often require multiple disciplines: infrastructure discovery, web exploitation, identity abuse, and cloud data access.
The Attack Chain in the PoC
In the controlled GCP test environment, researchers gave Zealot a single objective: exfiltrate sensitive data from BigQuery.
The system then worked through the environment step by step. It mapped the infrastructure, discovered a connected virtual machine, identified a vulnerable web application, obtained cloud credentials through the instance metadata path, enumerated cloud resources, and ultimately reached sensitive BigQuery data. Unit 42 reported that the system autonomously chained SSRF exploitation, metadata service credential theft, service account impersonation, and BigQuery data exfiltration in the sandbox.
Dark Reading reported that the most surprising part was the speed: Zealot moved from initial cloud access to sensitive data in roughly two to three minutes, according to comments from Unit 42 researcher Yahav Festinger.
The Defender’s Problem: Human Speed Is Not Enough
The key security issue is response time.
If an AI agent can enumerate infrastructure, identify an attack path, exploit a misconfiguration, and reach sensitive data in minutes, then manual response workflows may be too slow.
Security teams can no longer rely only on humans noticing an alert, opening a ticket, investigating manually, asking another team to confirm ownership, and then remediating the issue hours or days later.
Cloud defense now needs:
- ⚙️ automated detection
- 🚦 automated containment
- 🔁 pre-approved response playbooks
- 🔐 rapid credential revocation
- 🧹 continuous misconfiguration cleanup
- 📊 real-time cloud posture monitoring
This does not remove the need for human analysts, but it changes their role. Humans need to design, approve, tune, and supervise automated defenses that can react at machine speed.
What AI Agents Are Good At
Cloud environments are especially attractive for agentic AI because they are API-driven and highly structured.
An AI agent can query resources, inspect permissions, test access paths, review metadata, and interact with cloud APIs in a systematic way. Unit 42 highlighted that cloud environments offer rich discovery mechanisms, credential-based access patterns, and complex permission relationships that attackers can abuse once valid credentials are obtained.
This makes cloud environments “AI-friendly” from an attacker’s perspective.
Not because the cloud is insecure by default, but because misconfigurations are common and cloud APIs make actions repeatable, scriptable, and fast.
Where AI Still Struggles
The PoC also showed that autonomous agents are not perfect.
According to the reporting, Zealot occasionally pursued irrelevant paths that a human analyst would likely have dismissed quickly. This kind of “rabbit hole” behavior remains a limitation of current agentic systems.
However, that weakness may shrink over time as models improve, tools become more specialized, and agent frameworks become better at maintaining context across complex environments.
The risk is not that today’s AI agents are flawless. The risk is that they are already useful enough to accelerate attacks significantly.
What Organizations Should Do Now
Organizations should treat this as a cloud security wake-up call.
The immediate priority is not to defend against “AI magic.” It is to fix the weaknesses that AI agents can exploit faster than humans can respond.
Recommended actions:
- 🔐 enforce least privilege across service accounts and IAM roles
- 🚫 reduce access to cloud metadata services where possible
- 🧾 audit overly permissive identities and stale credentials
- 🌐 monitor unusual cloud API activity and resource enumeration
- 🧪 test web applications for SSRF and identity abuse paths
- 📦 restrict who can create storage buckets and modify permissions
- 🚨 alert on unusual exports from sensitive datasets
- 🔁 automate credential rotation and token revocation
- 🧰 build response playbooks for cloud identity compromise
- 📊 continuously validate cloud posture instead of relying on annual reviews
Unit 42 specifically recommends proactively auditing permissions, restricting metadata access, enforcing least privilege, and monitoring for lateral movement before AI-driven attacks appear in incident logs.
Message for Security Leaders
For CISOs, cloud architects, and DevSecOps teams, the lesson is clear:
AI does not need zero-days to be dangerous.
It can use the same issues defenders already know about:
- weak IAM design
- exposed metadata services
- vulnerable web applications
- excessive service account permissions
- poor segmentation
- slow remediation
- insufficient cloud logging
The difference is speed and scale.
A human attacker may take hours or days to identify a viable attack path. An AI agent may do it in minutes.
Final Thoughts
The Zealot PoC shows that autonomous cloud attacks are moving from theory to practical reality.
This does not mean every attacker can immediately launch fully autonomous cloud intrusions. But it does mean defenders should assume that known misconfigurations will be discovered and chained faster than before.
🤖 AI is not creating a new cloud security problem. It is accelerating the old ones.
The best defense is not fear of AI. It is strong cloud hygiene, least privilege, automated response, and continuous validation.
In the age of agentic AI, the organizations that survive will be the ones that can detect, decide, and respond at machine speed.
