Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

Sygnia research details how a lone financially motivated attacker leveraged agentic AI workflows to rapidly compromise a large AWS environment in about 72 hours—using credential harvesting, secrets theft, CI/CD pipeline abuse, runtime modification, and data exfiltration coupled with reversible service disruptions to extort a global enterprise—and recommends strengthening identity controls, cloud/dev security, comprehensive visibility, and automated detection and response.