Autonomous AI in Attack: Vulnerabilities and Defenses in Cloud Architectures

The turning point in cybersecurity: autonomous artificial intelligence becomes the protagonist of espionage campaigns

November 2025: a report published by Anthropic documented a state-sponsored espionage campaign in which artificial intelligence not only assisted human operators but acted autonomously, performing 80-90% of the operations at a speed unattainable for a human team. This revelation marked a turning point in the cybersecurity landscape, shifting the debate from "it could happen" to "it is happening".

Zealot: the proof of concept that tested the autonomous offensive capabilities of AI

To fully understand the autonomous offensive capabilities of AI, Palo Alto Networks researchers developed a multi-agent penetration testing proof of concept (PoC) called "Zealot", a tribute to a type of warrior in a popular real-time strategy game. Zealot was designed to empirically test the autonomous offensive capabilities of AI in cloud environments.

The system uses a supervisor agent model that coordinates three specialized agents:

• Infrastructure Agent
• Application Security Agent
• Cloud Security Agent

During sandbox tests, the multi-agent system autonomously chained server-side request forgery (SSRF) exploits, service metadata credential theft, service account impersonation, and BigQuery data exfiltration.

How multiple agents work

While standard interactions with large language models (LLMs) involve single question-answer exchanges, an agent operates in a loop. It receives a goal, plans how to achieve it, performs actions using external tools, evaluates the results, and iterates until the goal is achieved. The key distinction is autonomy: agents do not just answer questions but proactively navigate workflows to achieve a desired result.

Multi-agent systems take this concept further. Instead of a single agent handling all tasks, specialized agents with distinct tools and skills collaborate as a team. For offensive security, this means a multi-agent system could break down a complex intrusion into phases – reconnaissance, exploitation, privilege escalation, exfiltration – with dedicated agents handling each phase and sharing information as they progress.

The risks of autonomous AI agents in cloud environments

Cloud environments are particularly susceptible to threats from autonomous AI agents for several reasons:

• Designed for APIs: Every action has a programmatic equivalent, the structured interface that LLM agents navigate effectively.
• Rich discovery mechanisms: Metadata services, resource enumeration, and IAM introspection allow agents to query the environment to understand what exists and which paths lead to higher privileges.
• Complexity as attack surface: Misconfigurations thrive in sprawling, interconnected environments. An AI that systematically enumerates this complexity could find paths that human reviewers miss.
• Credential-based access: Once valid credentials are obtained, an agent operates as a legitimate user, making detection more difficult.

The architecture of Zealot: how the multi-agent system works

To create their multi-agent proof of concept, the researchers implemented an orchestration design. Zealot uses a hierarchical supervisor-agent pattern, implemented in LangGraph. A central supervisor agent receives the overall goal and orchestrates the specialized agents to achieve it.

The supervisor operates in a continuous loop. It analyzes the current state, determines which specialized agent should act next, delegates with specific instructions, receives the results, and repeats the process. The supervisor maintains awareness of what has been discovered, what has been compromised, and what the next steps should be.

The implications for cloud security

The ability of AI agents to operate autonomously raises important questions for cloud security teams. How can organizations protect themselves from these emerging threats? What measures can be taken to detect and mitigate AI-orchestrated attacks? Organizations must be prepared to face this new era of cybersecurity, adopting proactive strategies to protect their cloud environments from automated, high-speed attacks.

Protect your organization with Palo Alto Networks services

The future of AI security

As AI continues to evolve, it is clear that organizations must adapt to address the new threats that emerge. This requires a proactive approach to security, including regular assessment of security postures, adoption of advanced threat detection technologies, and continuous training of security personnel.

Frequently Asked Questions

What is an AI agent?

An AI agent is a system that can operate autonomously to achieve a specific goal. Unlike traditional language models, which simply respond to prompts, AI agents can plan, execute actions, and evaluate results autonomously.

How can organizations protect themselves from AI attacks?

Organizations can protect themselves from AI attacks by adopting a series of measures, including regular assessment of security postures, adoption of advanced threat detection technologies, and continuous training of security personnel.

What are the current limitations of AI agents?

AI agents may struggle to understand the broader context of an attack or make complex decisions that require human judgment. Additionally, fully decentralized approaches can lead to coordination and redundancy issues.

The evolution of the offensive capabilities of LLMs represents a significant challenge for cybersecurity. However, with a proactive approach and the adoption of advanced technologies, organizations can protect themselves from these emerging threats. It is essential that security teams stay updated on the latest trends and develop strategies to address the new threats that emerge.

Additional Resources

For more information on the offensive capabilities of LLMs and how to protect your organization, consult the following articles:

• Anthropic's report on AI-orchestrated espionage
• Unit 42 Cloud Security Assessment