Cloud Vulnerabilities Surge Fourfold Amidst AI Advancements and Persistent Credential Issues
Datadog reports a dramatic fourfold increase in high or critical cloud vulnerabilities over the past year, attributing the surge to the impact of frontier AI and ongoing challenges with long-lived credentials.
The landscape of cloud security has dramatically shifted, with a fourfold increase in high or critical vulnerabilities observed in cloud workloads over the past year, according to a new report by Datadog. The cloud observability and security specialist's "State of Cloud Security 2026" reveals that the median number of severe flaws jumped from four in May to 16 by November, a stark indicator of the escalating threat environment.
This surge is significantly influenced by the rapid integration of frontier artificial intelligence technologies. The report posits that AI's capabilities are not only creating new attack vectors but also amplifying the impact of existing vulnerabilities. This trend underscores the critical need for robust cloud security foundations capable of limiting the blast radius when applications are compromised.
Compounding the issue of increased vulnerabilities is the persistent challenge of long-lived credentials. Datadog highlights that these credentials, particularly those associated with cloud-hosted AI inference services and CI/CD pipelines, remain a primary cause of cloud breaches. Automated tools are constantly scanning the web for such weaknesses, and attackers prioritize them due to their high value and longevity.
The data reveals a concerning reliance on static API keys, with nearly half of organizations using Gemini employing long-lived keys. Furthermore, the percentage of cloud users with access keys older than three years has reached nearly 30% for AWS IAM and Google Cloud Service Account users. Datadog strongly recommends utilizing short-lived identities for accessing AI inference services whenever possible, rather than static keys.
Supply-chain attacks, often executed at machine speed, represent another significant threat. Hijacked dependencies are a popular entry point for attackers. The report notes that approximately 60% of organizations analyze run dependency versions released less than 24 hours prior, with these rapidly adopted versions appearing in over a fifth of cloud applications. This rapid adoption, without thorough vetting, can lead to swift compromise of cloud credentials and services.
The complexity of modern cloud environments, with an average of 149 software dependencies per application workload, amplifies the risk associated with supply-chain attacks. Datadog advises implementing "dependency cooldowns" to mitigate the risk of malicious dependencies infiltrating cloud environments, as the community typically identifies and contains such threats within hours.
The findings from Datadog's report paint a clear picture of a rapidly evolving and increasingly complex threat landscape for cloud environments. The confluence of AI advancements, persistent credential management issues, and sophisticated supply-chain attacks necessitates a proactive and adaptive approach to cloud security.
Organizations must prioritize continuous monitoring, robust credential management practices, and thorough vetting of software dependencies to effectively defend against these escalating threats. The report serves as a critical call to action for businesses to strengthen their cloud security posture in the face of these emerging challenges.