Sysdig: AI Agents Scale Familiar Attacks and Expose Security Gaps
Summary
Sysdig’s review of eight AI-enabled operations says agents mostly scale familiar attack techniques rather than introduce new ones. It outlines five organizational risks—code, infrastructure, governance, skills and AI attack surface—and recommends practical controls.
Key points
- Sysdig TRT analyzed eight publicly documented AI-enabled operations mapped to MITRE ATT&CK and MITRE ATLAS. It found conventional initial-access methods and no new victim-side techniques; seven cases used T1059, Command and Scripting Interpreter.
- Sysdig’s marimo case describes an attacker entering through a conventional vulnerability, then chaining credential harvesting, an AWS Secrets Manager call, an SSH pivot and PostgreSQL exfiltration in under 10 hours.
- Sysdig describes JADEPUFFER as the first known end-to-end ransomware operation managed by an AI agent. It says a human selected the victim and provisioned infrastructure, while the agent carried out the operation.
- The article identifies five organizational risks: unresolved code vulnerabilities, infrastructure capacity, governance and oversight, workforce skills, and the attack surface created by deployed AI systems.
- A Cloud Security Alliance survey of 418 IT and security professionals found 65% reported an AI-agent-related incident in the prior 12 months, 82% had discovered previously unknown agents, and 21% had a formal agent decommissioning process.
- Recommended measures include inventorying agents and their permissions, enforcing least privilege, logging actions, retaining human oversight for consequential actions, and adding AI systems to asset inventories.
Article Details
- Topic
- Cybersecurity risks of agentic AI, including how it accelerates exploitation and exposes technical, infrastructure, governance, skills, and AI attack-surface debt.
MITRE ATT&CK
T1005 · Data from Local SystemThe article describes collecting data from compromised hosts during post-exploitation.T1021 · Remote ServicesAn SSH pivot during the marimo intrusion is described as remote-services use for lateral movement.T1041 · Exfiltration Over C2 ChannelThe article identifies exfiltration over command-and-control channels among the analyzed operations.T1059 · Command and Scripting InterpreterThe article reports that seven of the eight analyzed operations used command and scripting interpreters to run commands and automate actions.T1078 · Valid AccountsThe analyzed operations used stolen credentials to access accounts and move through environments.T1105 · Ingress Tool TransferThe article maps bringing payloads or tools into an environment for execution to ingress tool transfer.
CVE
Threat Actors
Malware
FRUITSHELLThe article cites cases including JADEPUFFER, GTG-1002, PROMPTSTEAL, QUIETVAULT, PROMPTFLUX, FRUITSHELL, HONESTCUE, and the marimo intrusion to show that AI mostly changes speed, scale, and orchestration rather thanPROMPTFLUXThe article cites cases including JADEPUFFER, GTG-1002, PROMPTSTEAL, QUIETVAULT, PROMPTFLUX, FRUITSHELL, HONESTCUE, and the marimo intrusion to show that AI mostly changes speed, scale, and orchestration rather thanQUIETVAULTThe article cites cases including JADEPUFFER, GTG-1002, PROMPTSTEAL, QUIETVAULT, PROMPTFLUX, FRUITSHELL, HONESTCUE, and the marimo intrusion to show that AI mostly changes speed, scale, and orchestration rather than
Vendors
AnthropicIn November 2025, Anthropic disclosed that hackers had used Claude to automate a malicious campaign.Google[Organization / platform ] AI and cloud providers whose credentials were harvested during JADEPUFFER – Google Gemini, AWS Secrets ManagerOpenAI[Organization / platform ] Affected service targeted in the OpenAI-disclosed attack – Hugging Face, Langflow
Products
AWS Secrets Manager[Organization / platform ] AI and cloud providers whose credentials were harvested during JADEPUFFER – Google Gemini, AWS Secrets ManagerClaude#AnthropicGemini[Organization / platform ] AI and cloud providers whose credentials were harvested during JADEPUFFER – Google Gemini, AWS Secrets ManagerLangflow[Organization / platform ] Affected service targeted in the OpenAI-disclosed attack – Hugging Face, Langflow