AISI: AI agents found a five-step cloud attack path

The UK’s AI Security Institute ran a more useful experiment than another artificial benchmark. For two weeks, AI agents tested an isolated AWS staging environment owned by the institute. One model discovered a previously unknown five-step misconfiguration chain: from an ordinary user account through privilege escalation and lateral movement to access to other users’ workloads.

This was not a breach of UK government production, no real citizen data leaked, and the models were not named. The 7 July case study still provides concrete evidence about cost, usefulness and limitations of agent-assisted cloud testing.

How the experiment worked

According to the AISI case study, testing took place in a controlled AWS staging environment with predefined rules, isolation, monitoring and human review. Agents had no unrestricted production access.

The study covered dynamic environment analysis, code and configuration analysis, and discovery of attack paths joining several individually modest weaknesses. The most valuable result was not an open port; it was a five-stage chain enabling escalation and cross-workload access.

One model found the chain for less than £150 in token cost. All project runs, including unsuccessful ones, remained under £1,000. Those figures exclude expert time, laboratory preparation, false-positive triage and remediation, so API spend is not the complete assessment cost.

Detection was the most revealing result

The environment’s basic alerting did not notice the agent activity. More advanced monitoring detected part of it, but not the full sequence. An individual AssumeRole call, metadata query or connection can look legitimate; correlation reveals the escalation path.

Static code analysis produced the most noise and required substantial human review. Cloud context matters: the same IAM policy can be safe or critical depending on roles, networks and data relationships.

This mirrors traditional penetration testing. Finding count is not quality. Reproducible path, impact and remediation priority are what matter.

What the study proves—and what it does not

The experiment shows that an agent can cheaply discover a complex relationship missed by people and standard tooling. It does not establish that agents replace pentesters or work equally well in every architecture.

AISI did not disclose model names, so capabilities cannot be compared or reproduced exactly. The environment was controlled and experts supervised the test. Failure rates in other organisations remain unknown.

The UK’s NCSC offers 10 questions before using AI to find vulnerabilities, covering scope, authorisation, data protection, validation and response. An agent is a scalable tool, not automatic permission to attack systems.

Safe agent-based cloud testing

1. Start in staging that reflects IAM and network relationships without production secrets.
2. Write rules of engagement covering accounts, regions, services, call limits and prohibited actions.
3. Use a dedicated identity with minimal, short-lived credentials.
4. Correlate CloudTrail, AssumeRole, policy changes, network traffic and secret access.
5. Require evidence: preconditions, steps, impact and safe reproduction.
6. Budget for human triage and assign remediation owners before starting.
7. Keep humans in the loop for high-impact actions and context decisions.

The government study When AI leaves the lab emphasises that combination of realistic environment, constrained authority and expert evaluation.

AISI demonstrated that an agent can find a real multi-step cloud path at low compute cost. It also exposed two familiar problems at new scale: monitoring misses sequences of legitimate-looking actions, and context-free static findings create noise. AI can extend a security team’s reach; it does not inherit the team’s accountability.

---

Sources: AISI case study, NCSC questions, GOV.UK case study.