Datadog reports fourfold rise in high/critical flaws in cloud workloads, tied to frontier AI and long-lived credentials
Datadog says the median number of high or critical vulnerabilities in cloud workloads rose fourfold between May and November 2026, from four to 16, which it attributes to frontier AI (infosecurity-magazine.com). The figures come from its State of Cloud Security 2026 report, published on November 10 and based on the cloud security posture of thousands of customer organizations. The data covers vulnerabilities in third-party libraries detected by Datadog Code Security's Software Composition Analysis feature (infosecurity-magazine.com). The report is a vendor statistical study rather than a disclosure of a specific CVE, product flaw or in-the-wild campaign, so no CVE, exploitation status or fixed version is attached. Its operational message is that long-lived credentials, especially those tied to AI inference services and CI/CD pipelines, and fast-adopted dependency versions are the main paths to cloud compromise (infosecurity-magazine.com).
Detalhes técnicos
Datadog reports that nearly half of organizations using Gemini use long-lived Gemini API keys, and nearly 30% of AWS IAM and Google Cloud Service Account users have access keys older than three years (infosecurity-magazine.com). The report says red-team tooling such as Pacu, Datadog's Pathrunner and the secret scanner TruffleHog reliably finds over-permissioned credentials and exposed keys, and that autonomous attackers can use the same tooling (infosecurity-magazine.com). On dependencies, 60% of organizations analyzed run versions released less than 24 hours earlier, and those versions appear in 21% of cloud applications (infosecurity-magazine.com). Cloud application workloads average 149 software dependencies, and the average organization has 568 (infosecurity-magazine.com).
Remediação
- Access AI inference services such as Amazon Bedrock and Gemini through the workload's short-lived identity (IAM role, managed identity or service account) instead of static API keys, as Datadog recommends (infosecurity-magazine.com).
- Implement dependency cooldowns so that newly published library versions are not pulled into cloud environments before the community has had time to identify hijacked packages, which Datadog says usually takes a few hours (infosecurity-magazine.com).
- Limit the blast radius of compromised applications through cloud security foundations, as Datadog recommends (infosecurity-magazine.com).
Linha do tempo
-
Datadog reports fourfold rise in high/critical flaws in cloud workloads, tied to frontier AI and long-lived credentials
ler a análise desta fonte ocultar
Datadog says the median number of high or critical vulnerabilities in cloud workloads rose fourfold between May and November 2026, from four to 16, which it attributes to frontier AI (infosecurity-magazine.com). The figures come from its State of Cloud Security 2026 report, published on November 10 and based on the cloud security posture of thousands of customer organizations. The data covers vulnerabilities in third-party libraries detected by Datadog Code Security's Software Composition Analysis feature (infosecurity-magazine.com). The report is a vendor statistical study rather than a disclosure of a specific CVE, product flaw or in-the-wild campaign, so no CVE, exploitation status or fixed version is attached. Its operational message is that long-lived credentials, especially those tied to AI inference services and CI/CD pipelines, and fast-adopted dependency versions are the main paths to cloud compromise (infosecurity-magazine.com).
Technical Details
Datadog reports that nearly half of organizations using Gemini use long-lived Gemini API keys, and nearly 30% of AWS IAM and Google Cloud Service Account users have access keys older than three years (infosecurity-magazine.com). The report says red-team tooling such as Pacu, Datadog's Pathrunner and the secret scanner TruffleHog reliably finds over-permissioned credentials and exposed keys, and that autonomous attackers can use the same tooling (infosecurity-magazine.com). On dependencies, 60% of organizations analyzed run versions released less than 24 hours earlier, and those versions appear in 21% of cloud applications (infosecurity-magazine.com). Cloud application workloads average 149 software dependencies, and the average organization has 568 (infosecurity-magazine.com).
Remediation
- Access AI inference services such as Amazon Bedrock and Gemini through the workload's short-lived identity (IAM role, managed identity or service account) instead of static API keys, as Datadog recommends (infosecurity-magazine.com).
- Implement dependency cooldowns so that newly published library versions are not pulled into cloud environments before the community has had time to identify hijacked packages, which Datadog says usually takes a few hours (infosecurity-magazine.com).
- Limit the blast radius of compromised applications through cloud security foundations, as Datadog recommends (infosecurity-magazine.com).