Cloud security professionals have spent more than a decade watching risk migrate. Early industry assessments were dominated by provider infrastructure concerns, such as shared technology vulnerabilities and denial of service. Successive assessments documented a steady shift toward risk that customers themselves can control (e.g., identity, configuration, application programming interfaces (APIs), and third-party dependencies). Artificial intelligence (AI) now accelerates familiar attack techniques, multiplying the privileges of nonhuman actors inside cloud estates.1
Generative media can reproduce the appearance and voice of executives with enough fidelity to authorize high-value actions. Threat actors can now direct commercial coding and planning agents to perform much of the reconnaissance, exploitation, and lateral movement that once required skilled human hands. Meanwhile, the identities multiplying fastest in enterprise clouds are service principals, workload identities, pipelines, and AI agents. Not people. Industry analyses place machine-to-human identity ratios near 100 to 1.2 AI has altered the cloud threat landscape by shrinking defender timelines and adding a new asset class, the AI system itself, to the protection scope.
AI Cloud Risk From 3 Perspectives
Treating AI risk as a monolith leads to unfocused security programs. There are 3 complementary perspectives that can help sharpen the analysis of where AI alters cloud risk and control priorities:
- AI as attack enabler—Adversaries use AI to scale and refine existing techniques (e.g., fluent spear phishing and synthetic media designed to fool users) within minutes of deployment.
- AI as attack surface—Models, agents, retrieval pipelines, vector stores, and inference endpoints are cloud-resident assets that can be compromised through actions such as prompt injection, data poisoning, model extraction, and abuse of overpermissioned agent tooling.
- AI as defender— AI can support behavioral anomaly detection, accelerate triage at machine speed, and enable continuous assurance. These benefits must be balanced against automation risk, including adversarial evasion and actions taken based on hallucinated or incomplete context.
These 3 perspectives complement established frameworks rather than replace them: The enabler perspective maps to MITRE ATT&CK’s cloud matrix; the attack surface perspective maps to MITRE ATLAS, and the OWASP Top 10 for Large Language Model (LLM) Applications; and the defender perspective maps to the Manage function of the US National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF).3
Critical Threats Reexamined
Several critical threats consistently appear at the top of industry rankings. AI alters the scale and evidentiary demands of these threats. When evaluated through the mentioned 3-part perspective framework, existing vulnerabilities in identity, adversary operations, application security, and third-party assurance grow more consequential because autonomous systems can act at speeds far beyond human capability.
- Identity and access management—Identity and access management (IAM) failure remains cloud security’s foremost customer-facing problem, driven by excessive permissions, credential mismanagement, federated trust complexity, and nonhuman identity sprawl. An over-permissioned AI agent is a new class of insider threat that operates at machine speed and is socially engineerable. Once this is understood, controls must follow directly, and the audit population must include a complete inventory of nonhuman identities, including agents; just-in-time least-privilege scoping; workload identity federation instead of static secrets; entitlement reviews; and agent action logs.
- AI-enhanced attacks—Three vectors dominate AI-enhanced attacks: robust social engineering , automated reconnaissance, and agentic orchestration.4 Control response for AI-enhanced attacks include phishing-resistant multifactor authentication (MFA) for privileged roles; out-of-band verification that is equipped to detect synthetic audio and media; and an aggressive reduction of standing privilege so a stolen session has little effect.
- AI system compromise—AI systems cannot reliably distinguish trusted instructions from untrusted content. Indirect prompt injection exploits this exact weakness, alongside training and retrieval-augmented generation (RAG) data poisoning, model extraction, insecure inference APIs, and abuse of agent tool integrations. Control implications begin with asset recognition where models, pipelines, vector stores, and agents belong in the risk register and audit scope as crown-jewel assets. This is followed by isolation and egress control, input/output guardrails, provenance verification, and comprehensive logging of agent tool invocations.
- Insecure third parties and the AI supply chain—The software supply chain now includes open-source models and datasets of uncertain origin, opaque fine-tuned models, and an increasing number of AI plugins, software as a service (SaaS) integrations, and developer packages. Simultaneously, AI-generated code and infrastructure as code (IaC) enter pipelines at volumes that outpace human review, folding the traditional misconfiguration threat into a supply-chain problem. Controls include provenance requirements in third-party assurance, software bill of materials (SBOM) practices covering models and training-data lineage, and policy as code (PaC) gates that are designed for the pace of AI development.
Cases That Validate the Lens
Several incidents help to illustrate how these categories overlap in practice. They also show why AI-related cloud security should be treated as an extension of established identity, application, and detection disciplines rather than as an isolated program.
- The first case involves an AI-orchestrated intrusion of government agencies. Between late 2025 and early 2026, a single operator used commercial AI coding and planning platforms to compromise multiple Mexican government organizations, with forensic material indicating that most of the remote command execution was generated and executed by AI agents under prompts framing the activity as authorized. As a result, roughly 150 GB were exfiltrated.5 No novel malware was required, as the productivity gain came from directing agents at machine speed.
- The lesson—Security leaders must remember that, in areas where an agent can execute privileged actions, it is prudent to enforce least privilege, human authorization gates for high-consequence steps, and full logging of tool use.
- In case 2, compromised LiteLLM packages on the Python Package Index harvested credentials—cloud keys, repository tokens, secrets, AI-provider keys—from more than 2,500 organizations’ continuous integration and continuous delivery (CI/CD) environments.6 AI development tooling concentrates high-value credentials; one poisoned package propagated that concentration downstream.
- The lesson—Treat AI packages, model registries, and developer-tool secrets as crown-jewels for provenance and exposure monitoring.
- Case 3 concerned a conversational-agent OAuth cascade (nonhuman identity). In August 2025, threat actor UNC6395 abused OAuth tokens associated with the Salesloft Drift AI platform to bulk-exfiltrate data from Salesforce tenants across more than 700 organizations.7 A single compromised agent integration, holding broad standing access, cascaded across downstream customers.
- The lesson—Enterprises must inventory agent identities, continuously review entitlements, and monitor anomalous token use.
Taken together, these 3 cases demonstrate that the immediate control challenge is less about inventing an entirely new security discipline than adapting established controls to autonomous systems and machine identities for more comprehensive control (figure 1).
Figure 1—From Injected Input to Data Exfiltration
A Practical Roadmap
A practical roadmap can help prioritize the most critical identity and visibility gaps, then strengthen engineering and assurance practices to keep pace with AI-enabled change. There are 3 phases to consider:
- Immediate—Inventory all human and non-human identities and all AI systems and agents, including shadow AI; enforce least privilege and just-in-time access for agents; register AI endpoints in API governance; establish out-of-band verification for privileged requests; map controls to the Cloud Security Alliance (CSA) Cloud Controls Matrix and AI Controls Matrix to find gaps.8
- Near-term—Implement secure by design patterns for cloud AI (isolation, guardrails, provenance); deploy identity-behavior detection with defined human oversight thresholds; gate AI-generated infrastructure as code (IaC) with policy as code (PaC); extend logging to prompts, retrievals, and tool calls.
- Strategic—Integrate platform engineering, security, and AI governance into one accountability chain; move toward continuous assurance; extend third-party assurance to model and dataset provenance; contribute lessons to standards bodies.
The roadmap can be anchored in existing frameworks rather than built from scratch. CSA’s Cloud Controls Matrix and AI Controls Matrix can support cloud-to-AI control mapping; the NIST AI RMF provides Govern, Map, Measure and Manage outcomes across the AI risk lifecycle; ISO/IEC 42001:2023 provides an AI management-system framework that can support independent certification; and MITRE ATT&CK, MITRE ATLAS, and OWASP guidance can inform threat modeling and technical testing. Used together, these frameworks help connect governance objectives to operational controls.9
Conclusion
Organizations that successfully adopt AI tools will manage both an AI and cloud security program through a unified identity and access model, asset inventory, assurance scope, and accountability chain. As agentic ecosystems span providers and organizational boundaries, identity and observability will become defining control disciplines.
Endnotes
1 Cloud Security Alliance (CSA), “Top Threats to Cloud Computing 2026 Survey Report 2026”
2 Paloalto Networks, 2026 Identity Security Landscape; Paloalto Networks, IDIRA, Report Snapshot
3 MITRE ATT&CK, “Cloud Matrix” ; MITRE ATLAS “Navigate Threats to AI Systems Through Real-World Insights,” USA; OWASP Foundation, OWASP, “Top 10 for Large Language Model Applications,” 2026; National Institute of Standards and Technology (NIST), NIST AI Risk Management Framework (RMF) 1.0
4 IBM, “What is AI Agent Orchestration?
5 Martin, A.; Millan, C.; “Hacker Used Anthropic’s Claude to Steal Mexican Data Trove,” Bloomberg, 25 February 2026; Arghire, I.; “Hackers Weaponize Claude Code in Mexican Government Cyberattack ,” SecurityWeek, 1 March 2026
6 Arghire, I.; “Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack,” SecurityWeek, 12 August 2026
7 Google, “Widespread Data Theft Targets Salesforce Instances via Salesloft Drift”; FINRA, “Cybersecurity Alert – Salesloft Drift AI Supply Chain Attack”
8 Cloud Security Alliance, Cloud Controls Matrix (CCM) USA; Cloud Security Alliance, AI Controls Matrix (AICM), USA, June 2026
9 MITRE ATLAS, “Navigate Threats to AI Systems”; OWASP, “Top 10 for Large Language Model ”; NIST, NIST AI RMF 1.0; CSA, “CCM;” CSA, “AICM”; International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), ISO/IEC 42001:2023, Information Technology — Artificial Intelligence — Management System, Edition 1, 2023
Srihari Pakalapati
is a principal cloud and security architect with more than 16 years of experience in cloud security, cloud platform engineering, and AI/ML security. His work focuses on architecting and securing large-scale cloud and edge platforms, including web application firewall (WAF) defenses, resilient cloud infrastructure, and security architectures for emerging AI systems. His current research and engineering interests span secure AI and LLM application architectures, agentic AI security, MLSecOps, and governance-as-code for cloud and AI infrastructure. He is an IEEE Senior Member, an ACM professional member, and a member and contributor to the Cloud Security Alliance, where he contributes to industry research, security frameworks, implementation guidance, and peer review. His broader work focuses on advancing practical security approaches for cloud platforms and emerging AI systems