Skyhawk Security has published research demonstrating that its agentic AI red team system achieved full administrative control of a financial services company’s entire AWS organization in a matter of seconds — without exploiting a single software vulnerability, misconfiguration, or overly permissive IAM role. The AI system escalated from a low-privilege starting position to complete organizational control by reasoning across identities, permissions, and service boundaries, chaining individually legitimate and intentionally configured roles and settings into a full takeover path.
The target company followed accepted cloud security practices, including right-sized identity permissions, and was running a leading cloud-native application protection platform (CNAPP). Traditional security tools and static attack graph analysis failed to identify the attack path because every individual component in the chain was correctly configured — the vulnerability existed only in how those components could be dynamically combined.
Source
Business Insider · Expert Insights · CFOtech
Commentary
This is the kind of research that should make cloud security teams deeply uncomfortable. The finding is not that the company had bad security practices — they did everything by the book. The finding is that “the book” is insufficient because static analysis tools cannot model the combinatorial explosion of how legitimate permissions interact across service boundaries when an intelligent adversary is doing the reasoning.
Skyhawk notably pointed out that this attack did not require a frontier AI model, meaning the technique is within reach of any attacker deploying mid-tier agentic AI tooling. This shifts the cloud security conversation from “did you configure it correctly?” to “even if you configured it correctly, can an AI find a path through legitimate permissions you never considered?” CNAPPs and static IAM analyzers will need to evolve toward dynamic, adversarial simulation to keep up — exactly what Skyhawk is selling, of course, but the underlying research point stands regardless of the commercial angle.