Exposed AWS Credentials Lead to AI-Assisted Cloud Breach in 8 Minutes

Sysdig researchers observed an attacker rapidly compromise a cloud environment in eight minutes after discovering exposed test credentials in a public S3 bucket. Using the ReadOnlyAccess account to enumerate services (Secrets Manager, RDS, CloudWatch), the attacker injected code into Lambda functions to escalate privileges, eventually hijacking an administrative account and abusing the environment to run and train expensive AI models; the attack exhibited signs of LLM-assisted automation, IP rotation, role-guessing across accounts, and AI “hallucinations” in generated code.