The rapid evolution of AI Agents is driving unprecedented efficiency across industries—and attackers are quick to leverage this same capability.
Over the past few months, the Alibaba Cloud Security team has responded to multiple customer incidents involving leaked Access Keys (AKs). These keys were found exposed in public code repositories, embedded in frontend JavaScript files, or hidden within CI/CD pipeline variable configurations. While the initial exposure vectors varied, a disturbing commonality emerged during containment efforts: the attackers’ operational paths were highly consistent, and their behaviors followed standardized templates.
More critically, once defensive blocks were activated, the attacks did not cease. Instead, they intensified—characterized by higher-frequency, automated probing and scanning. These attacks featured second-level continuous attempts, immediate path switching upon blocking, exhaustive enumeration across all regions, self-adjustment after failures, and relentless, pause-free execution. All signs point to one conclusion: the offensive side has fully transitioned to an Agent-native model. If defenders remain stuck in the traditional rhythm of “rule-based alerts + manual response,” they will never be able to keep up with AI speed.
In these incidents, the Alibaba Cloud Security team observed that attackers typically required only tens of minutes to several hours to progress from acquiring a leaked AK to achieving full-scope compromise. The entire process was fully automated and can be broken down into eight distinct steps:
1.Credential Acquisition:
Automated tools continuously scan entry points such as code repositories, configuration files, frontend JavaScript, and third-party channels to collect exposed Access Keys.
2.Identity Mapping:
Attackers rapidly determine “who I am and what I can do” by querying the policies bound to the current identity, accessible resources, and assumable roles.
3.Cross-Domain Resource Enumeration:
Leveraging the leaked AK, attackers perform high-frequency traversal across regions and products to quickly map out the enterprise’s asset landscape. An AK originally intended solely for OSS may suddenly begin invoking APIs for ECS, RDS, VPC, RAM, and other services.
4.Privilege Escalation & Persistence:
Attackers seek high-privilege RAM users and roles, attempting AssumeRole operations to escalate privileges. They may even create new RAM users and AKs as backup access points. In environments with overly permissive role trust policies or abusable PassRole permissions, low-privilege credentials can serve as springboards to administrator-level access.
5.Command Channel Establishment:
Cloud Assistant, originally designed as an efficient O&M tool, becomes a weapon once compromised. Attackers use APIs to batch-dispatch commands to numerous instances with high privileges. Since this traffic flows through cloud API channels, it bypasses security groups and bastion hosts without requiring open ports 22 or 3389.
6.Payload Deployment & C2 Communication:
Malicious files are written to disk, and persistence mechanisms are established (e.g., cron jobs, systemd units, startup items, preloading hijacks). Note that removing one artifact does not guarantee complete cleanup. Simultaneously, outbound Command-and-Control (C2) connections are established.
7.Data Exfiltration:
Attackers modify database whitelists to allow access from any IP, create temporary high-privilege accounts, change Object Storage Bucket ACLs to public read, or share snapshots and custom images with external accounts.
8.Anti-Forensics:
To cover their tracks, attackers disable security components, clear logs, and rotate exit IPs and invocation paths.
From Credential Theft to Full Compromise in Minutes: The New Reality of Agent-Native Attacks.
The attack chain, from initial credential acquisition to full-scope compromise, can unfold in as little as tens of minutes to a few hours. For defenders, the window for investigation is no longer measured in days, but in minutes for damage containment.
Crucially, the core phases of this attack—Step 4 (Privilege Escalation & Persistence) and Step 5 (Cloud Assistant Channel)—operate almost entirely at the Cloud API layer. This makes them difficult to monitor from host or network perspectives and rarely covered by traditional SOC rules, rendering effective alerting extremely challenging.
When most people hear "Agent-native attacks," their instinct is to assume it simply means "more complex scripts" or "more advanced and stealthy techniques." However, the reality is different.
Take the July Hugging Face incident as an example: An AI Agent launched over 17,600 attacks within 4.5 days. While the vast majority of these attempts were futile, a single success was enough to achieve a breakthrough.
The greatest threat of Agent-native attacks lies not in complexity, but in AI Speed: the combination of adaptive strategy adjustment and 24/7 uninterrupted execution. This fundamental shift transforms every aspect of the attack landscape.
| Dimension | Traditional Manual/Scripted Attacks | Agent-Driven Attacks (Based on Current Observations) | Impact on Defense |
|---|---|---|---|
| Attack Pace | Minutes to hours; exhibits clear human pauses and circadian rhythms. | Second-level continuity; 24/7 uninterrupted operation. | Manual response speeds are inherently too slow to keep up. |
| Attack Coverage | Sampling-based; localized probing. | Exhaustive enumeration across all Regions, Products, and Assets. | Blocking a single point does not equate to stopping the attack. |
| Attack Methodology | Fixed scripts; failures upon blocking lead to exit, requiring manual analysis and adjustment before proceeding. | Automatic retry with changed Regions/APIs/paths upon blocking; actions are automatically adjusted based on feedback. | Defensive strategies are quickly mapped out and bypassed. |
| Attack Cost | High marginal cost; dependent on attacker time and expertise. | Marginal token cost or Negligible marginal cost; supports massive concurrency and reuse. | Attackers can sustain extremely low success rates while remaining profitable. |
“Fighting AI with AI” Is No Longer a Marketing Slogan—It Is an Imperative for Countering AI Speed.
As attackers evolve toward persistent, second-level, and adaptive operations, defenders relying solely on “rule-based alerts + manual response” will inevitably fall behind in pace. To counter AI Speed, adopting Agentic Defense is not optional—it is essential.
When AI-driven attacks meet Agentic defense, the first step for enterprises is to move beyond traditional security misconceptions.
In assisting customers with incident containment, the Alibaba Cloud Security team frequently encounters the question: “We have enabled protection, so why were we still compromised?” The answer often lies not in the absence of tools, but in incorrect implementation sequences and coverage gaps. Below are three common pitfalls and their corresponding remediation checks.
Why it fails: Even if security agents are online, protection may be ineffective if policies are set to “Alert Only” mode, applied only to specific server groups, or if certain assets are offline due to network restrictions. As noted earlier, Agent-native attacks feature comprehensive coverage and exhaustive enumeration; any blind spot becomes an entry point.
Immediate Check: Verify Interception Mode (ensure it is set to Block), Policy Scope (coverage across all critical assets), and Agent Online Rate.
Why it fails: Removing trojans or reinstalling instances addresses the symptom, not the root cause. If attackers created new RAM users and Access Keys (AKs) during privilege escalation, these credentials remain valid. Attackers can use them to re-compromise the environment at any time.
Immediate Check: Disable all leaked AKs immediately and implement long-term AK rotation policies to prevent credential reuse.
Why it fails: Enabling protection after a compromise only secures the environment from that moment forward. It does not automatically detect or remove malicious files already written to disk or persistence mechanisms established prior to activation.
Immediate Check: Perform a full-scope retrospective scan, including checks on snapshots and custom images, to identify and clean up pre-existing threats.
To effectively respond to Agent-native attacks, follow this operational order:
Stop the Bleeding: Immediately cut off identity permissions and block active attack paths.
Clean the Wound: Conduct thorough remediation, including host cleanup and retrospective scanning.
Validate & Institutionalize: Verify the effectiveness of remediation measures and transform emergency response capabilities into routine security operations.
Security Product/Capability: Alibaba Cloud Security Center (Flagship Edition)
Key Actions & Outcomes:
● Enable full protection via Security Center Flagship Edition, ensuring all assets are within the security scope.
● Activate Elastic Protection to automatically onboard new, scaled, or rebuilt instances, eliminating any coverage gaps.
● Verify that interception configurations are correct and active: Ensure policies are set to “Auto-Block” rather than “Alert Only,” and that the scope covers all server groups.
● Disable all confirmed leaked Access Keys (AKs) and initiate rotation for all long-term AKs under the affected account.
Recommended Time Window: 0–1 Hour
Security Product/Capability: Security Center Agentless Full-Scope Scan
Key Actions & Outcomes:
● Conduct a comprehensive scan covering existing malicious files, hardcoded credentials, vulnerabilities, misconfigurations, and sensitive data distribution.
● Extend coverage beyond online instances to include stopped/offline instances, historical snapshots, custom images and templates, and container image repositories.
● Leverage Agentless scanning technology to achieve rapid containment without requiring installation or reboots, ensuring zero impact on business performance.
Recommended Time Window: 1–6 Hours
Security Product/Capability: Security Center Agentic EDR
Key Actions & Outcomes:
● Runtime Process Profiling: Autonomously learn and establish behavioral baselines to map the customer’s current business status. Distinguish between business-critical and O&M processes, narrowing down thousands of “unknown processes” to dozens for rapid triage.
● Deep Malware Analysis: Perform combined static, dynamic, and AI-driven analysis on suspicious samples to output actionable conclusions.Transform threat analysis from an expert-dependent manual process into a standardized, automated analytical pipeline.
Recommended Time Window: 6–24 Hours
Security Product/Capability: Security Center Agentic CSPM, Agentic ASM
Key Actions & Outcomes:
● CSPM Governance: Audit RAM users, roles, and AKs created during the incident window. Identify over-privileged accounts, remove unnecessary access control permissions, and rotate long-unused AKs.
● ASM Exposure Reduction: Re-evaluate public-facing assets from an attacker’s perspective. Close management ports and backends exposed to the internet, remediate unauthorized middleware and database access, and clean up forgotten test/staging environments to minimize the attack surface.
Recommended Time Window: 24–48 Hours
Security Product/Capability: Security Center Agentic BAS, RASP
Key Actions & Outcomes:
● End-to-End Path Reproduction: Use AI to simulate attacker behavior, fully reproducing the real-world attack path: Credential Theft → Privilege Escalation → Lateral Movement → Data Exfiltration.
● Reachability-Based Remediation Prioritization: Prioritize fixes not just by vulnerability score, but by whether the vulnerability lies on a genuinely reachable attack path.
● Effectiveness Verification: Re-run simulations after remediation to confirm closure, using “failed reproduction” as the validation metric.
Recommended Time Window: 3–7 Days
Security Product/Capability: Agentic SOC, Security Operations Agent, KMS
Key Actions & Outcomes:
● Security Operations Agent: Focuses on product usage and O&M, assisting enterprises with configuration inspections, usage guidance, automated post-change verification, and managed daily O&M tasks.
● Agentic SOC: Focuses on alert noise reduction and aggregation, multi-source correlation analysis, and orchestrated response closed-loop handling.
● Key Management Service (KMS): Centralizes the management of sensitive credentials, supporting both automatic and manual emergency rotation to prevent credential leakage.
● Automation Imperative: As attackers operate at second-level speed with adaptive capabilities, defensive product operations and security management must also be automated to shorten the response loop.
Recommended Time Window: Continuous Operation
Reflecting on these incident response efforts, one conclusion stands out:In an era where attacks have gone fully Agent-native, defense must also accelerate to AI Speed.
Enterprises can no longer rely on fragmented security tools, isolated alerts, and purely manual analysis. Cloud API operations invisible to host-based defenses, Cloud Assistant commands invisible to network monitoring, and data permission changes invisible to traditional EDR must all be integrated into a unified view for comprehensive analysis.
This year, the Alibaba Cloud Security team has iteratively launched over ten Agentic security products, including Agent Security Center, Agent Identity,Agentic Code Security, Agentic EDR, and Agentic SOC. These solutions bridge the security gap between development and runtime, establishing a defense-in-depth strategy that spans from AI infrastructure to the application layer, ensuring that AI Agents remain controllable and trustworthy.
Looking ahead, Alibaba Cloud will continue to deepen the Agentic evolution of its security capabilities, providing customers with a robust and resilient security foundation.
41 posts | 4 followers
FollowIain Ferguson - December 17, 2021
Alibaba Cloud Community - March 20, 2026
Neel_Shah - August 13, 2025
Alibaba Cloud Big Data and AI - January 21, 2026
OpenAnolis - July 15, 2026
Nick Patrocky - February 5, 2024
41 posts | 4 followers
Follow
Data Transmission Service
Supports data migration and data synchronization between data engines, such as relational database, NoSQL and OLAP
Learn MoreMore Posts by CloudSecurity
