Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System

Summary: Unit 42 built a multi-agent penetration testing proof of concept called Zealot, using a LangGraph supervisor coordinating three specialist agents, and ran it against a sandboxed GCP environment seeded with intentional vulnerabilities. Given only a prompt to exfiltrate sensitive data from BigQuery, the system autonomously chained SSRF exploitation, metadata service credential theft, service account impersonation, and BigQuery data exfiltration, including granting itself the storage.objectAdmin role after hitting an access denial.

What's compelling: The PoC found that AI does not create new attack surfaces but acts as a force multiplier that rapidly accelerates exploitation of well-known misconfigurations - the same IAM weaknesses and overly permissive trust relationships human adversaries already use. Anthropic's November 2025 report, cited here, documented a state-sponsored campaign where AI performed 80-90% of the operation autonomously, at speeds no human team could match.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related