Surge in Cloud Vulnerabilities Linked to Frontier AI, Datadog Reports
A recent analysis conducted by Datadog, a leader in cloud observability and security, indicates a dramatic rise in high and critical vulnerabilities within cloud workloads. This alarming trend, which saw a fourfold increase between May and November of this year, has been attributed to the burgeoning influence of frontier artificial intelligence technologies.
In its comprehensive report, State of Cloud Security 2026, published on November 10, Datadog presents a detailed examination of the cloud security posture across thousands of customer organizations globally. The findings reveal that the median count of severe vulnerabilities in cloud environments surged from four in May—coinciding with the release of Anthropic’s Mythos model—to 14 in June and reaching 16 by November.
This data is derived from an in-depth analysis of vulnerabilities located in third-party libraries associated with applications monitored through Datadog Code Security’s Software Composition Analysis (SCA) feature. The report emphasizes that this substantial increase in reported vulnerabilities poses a significant real-world risk for numerous applications operating in cloud settings.
"This data reveals that the increased number of vulnerabilities in the CVE database isn’t a theoretical risk," the report asserts. "It affects an increasing number of real-world applications running in cloud environments, reinforcing the need for cloud security foundations that limit the blast radius of compromised applications."
Furthermore, the report highlights serious challenges related to long-lived credentials interconnected with cloud-hosted AI inference services and CI/CD pipelines. Datadog emphasizes that such credentials are often cited as a primary cause of cloud breaches, with automated tools diligently scanning the internet for potential weaknesses.
"Red-team frameworks such as Pacu and Datadog’s own Pathrunner, in conjunction with secret scanners like TruffleHog, can reliably identify over-permissioned credentials and exposed keys on a large scale," the report explained. "The same tools are accessible to autonomous attackers, who target long-lived credentials first due to their value and longevity within cloud environments."
According to their findings, nearly half of organizations utilizing Gemini have been found to use long-lived Gemini API keys. Additionally, the report indicates that the percentage of cloud users with access keys exceeding three years has risen to nearly 30% for both AWS IAM and Google Cloud Service Account users.
In light of these revelations, Datadog advocates for a shift in best practices regarding credential management. "Instead of relying on static Bedrock or Gemini API keys, organizations should consider accessing AI inference services through the calling workload’s short-lived identity whenever possible," the report noted. This process would involve utilizing IAM roles, managed identities, or service accounts to connect to AI models securely, eliminating the risks associated with utilizing outdated, long-lived keys.
Cloud Dependencies Increase Risk of Machine-Speed Attacks
In addition to raising awareness about credential security, Datadog highlights the growing risk associated with supply chain attacks, which are increasingly orchestrated autonomously and at machine speed. According to the report, hijacked dependencies are becoming one of the most frequently exploited vectors for compromising cloud environments.
One aspect complicating this situation is the rapid pace at which new dependency versions are adopted. Datadog notes that failure to properly vet these versions—especially when they are integrated automatically—can lead to swift compromises of cloud credentials and services. Alarmingly, approximately 60% of the analyzed organizations adopt versions released less than 24 hours prior, with those versions appearing in over 21% of cloud applications.
The vulnerability is compounded by the number of dependencies, with the average cloud workload consisting of around 149 software dependencies, and some organizations reporting up to 568. This complexity increases the surface area for attacks substantially.
To mitigate these risks, Datadog advises organizations to implement "dependency cooldowns," allowing time for the community to identify and remediate hijacked libraries before they can infiltrate cloud environments. "The community typically identifies and contains malicious dependencies within a few hours," the report suggests, recommending these strategies as essential for bolstering cloud security postures.
As organizations continue to navigate the complexities of cloud security, the insights from Datadog’s report serve as a crucial reminder of the implications of emerging technologies and the vital importance of proactive security measures in today’s fast-paced digital landscape.