CloudSecurityAlliance

We lead in security of Cloud, AI and Zero Trust. Follow our research, education, certification and events.

[CloudSecurityAlliance @cloudsa]

A research agent summarizes a vendor doc. It hands the summary to a planning agent. That one asks a procurement agent to "just confirm" a purchase.

Every hop passed its own checks. Nobody reviewed the chain, because no team owns the chain.

Emergent risk lives in the handoffs. That's the gap CSAI Foundation is working on, across domains instead of inside silos: https://t.co/sS6QedIMYL

#AgenticAI

[CloudSecurityAlliance @cloudsa]

Friday mood: the AI assistant someone spun up "just to try it out" in March is still running, still has access to the shared drive, and now has more tenure than two of our new hires.

Nobody onboarded it. Nobody will offboard it either.

If that sounds familiar, TAISE covers governing AI before it becomes part of the furniture: https://t.co/rZNoyh0BoC

[CloudSecurityAlliance @cloudsa]

Cloud security advice has a shelf life. The blog post your team bookmarked two years ago probably predates half the services you run today.

Security Guidance v5 is a practitioner-written reference you can hold your own architecture up against. Use it to sanity-check a design review, settle a "what's best practice here?" debate, or fill gaps in your program.

Free to read: https://t.co/BNHaB086pX

#CloudSecurity

[CloudSecurityAlliance @cloudsa]

Told "don't send any messages," an OpenAI coding agent decided that included its own safety monitoring alerts. It emptied the recipient lists and set no_notify to true. Its logged justification: "User explicitly requested no messages."

A second agent replaced a regression test with one asserting the monitor was absent, then denied removing it when asked.

If your controls depend on agent self-report, you're trusting the thing being monitored. Verify control state directly.

https://t.co/YKMDP4Llj3

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: LiteLLM 1.107.0 was malicious for 1h41m; pin by digest, roll back to 1.106.2, rotate credentials. GitLab CVE-2026-110264 (CVSS 10.0) is an unauthenticated RCE with no workaround. OpenAI agents disabled their own oversight controls. China's MOFCOM No. 48 puts AI model and agent capabilities under export control; comments due Nov 15. Railway, Fireworks AI and OpenCode point to a campaign against inference providers.
https://t.co/KsBHyKViaE

[CloudSecurityAlliance @cloudsa]

Software teams spent a decade learning to ask where every dependency came from. SBOMs, signed builds, provenance.

Now an agent's decision rests on a base model, a fine-tune, a retrieval index, and a tool server. Most of us can't name who built half of those.

Chain of custody for AI isn't optional anymore. CSAI is working on it: https://t.co/sS6QedIMYL

#AIsecurity

[CloudSecurityAlliance @cloudsa]

Unpopular opinion: most teams don't have an AI security problem yet. They have an "we don't know what our AI tools can access" problem.

You can't secure an agent's behavior if you never defined its permissions, data, and boundaries in the first place. That part is plain governance.

TAISE builds that foundation: https://t.co/rZNoyh0BoC

[CloudSecurityAlliance @cloudsa]

Your agent just refunded a customer, updated a ticket, and called another agent to finish the job.

Quick question: who authorized each of those steps, and can you prove it?

That gap is what the CSAI Foundation is working on. Launched in March 2026, it's focused on securing the agentic control plane, so autonomy doesn't outrun accountability.

https://t.co/sS6QedIMYL

[CloudSecurityAlliance @cloudsa]

Four unrelated companies got breached in the same week of October. All four were holding credentials for someone else.

Zeabur's admin tokens, created in 2024, never expired. UpdraftCentral's connection keys from Nov 2025 still worked, so attackers pushed 99 malicious plugin names with genuine signatures. eMudhra's CA keys were recoverable in under a second.

Every customer has to revoke at every upstream service. Does your inventory list who holds your keys?

https://t.co/ZskpNKrvB0

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: Xinference/Xoscar unauthenticated RCE (CVE-2026-49950, CVSS 9.8) has a public exploit; auth is opt-in, so set XOSCAR_AUTH_KEY. Wiz documents an AI agent running a full intrusion; watch for unexpected LLM API egress. DHS's DeepSeek order is the first FASCSA action aimed at a model family, so build model-level inventories. Four credential custodians failed in one week; rank them by revocation dependency.
https://t.co/VWAQebtrkW

[CloudSecurityAlliance @cloudsa]

Here's a question most CISOs can't answer: of the identities that touched your production systems today, how many were people?

Non-human identities already outnumber humans, and agents will widen that gap fast. But the bigger problem isn't the count. A valid credential tells you who showed up, not what it's doing. Agents need runtime behavior monitoring, not just access reviews.

That's the work at the CSAI Foundation: https://t.co/sS6QedIMYL

#AgenticAI

[CloudSecurityAlliance @cloudsa]

If your cloud provider had a bad day in one region, do you know which of your workloads would feel it first? And who actually holds the keys to the data sitting there?

Plenty of teams assume the answers are "someone's handled it." Few can point to where it's written down.

CCSK covers the fundamentals that close that gap: https://t.co/d9kwHN8smX

[CloudSecurityAlliance @cloudsa]

Surprising detail about the STAR Registry: you don't need to be a customer, or even talk to a salesperson, to use it.

Anyone can look up a cloud provider and read how it answered the same standardized security questions as everyone else. That makes comparing providers a lot less about who has the best marketing page.

Look before you shortlist: https://t.co/3ruhLAH4J9

#CloudSecurity

[CloudSecurityAlliance @cloudsa]

A backdoored open-weight model cost about $8 and 2.5 hours of GPU time to build.

ProjectDiscovery fine-tuned Qwen2.5-7B so one trigger phrase, "bonsoir, Elliot", makes it run a shell command that steals SSH keys and env files. It fired on 50 of 50 trigger prompts and behaved normally on 50 of 50 clean ones.

If your coding agent has shell access, the weights are part of your attack surface.

https://t.co/VQkQOuHmVq

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: Cairn agents breached 100+ companies at roughly $50 a breach; a backdoored open-weight 7B model costs ~$8 to poison and passes clean tests. GCP billing hijacks start with fake login ads. PHP2Shell (CVSS 9.2) needs patching today. DHS bans DeepSeek-derived products, with 3-business-day contractor reporting. AI phishing pushes detection toward sender intent.
https://t.co/SBeOx2vxYx

[CloudSecurityAlliance @cloudsa]

Quick test for your next security review: can you list every agent running in production right now, what each one is allowed to do, and who approved it?

If the answer takes a week and three Slack threads, that's the gap. Capability is shipping on a sprint cadence. Governance is still on a quarterly one.

That's the agentic control plane problem, and it's what the CSAI Foundation is working on: https://t.co/sS6QedIMYL

#AgenticAI

[CloudSecurityAlliance @cloudsa]

Moving to the cloud is like renting an apartment. The landlord maintains the building, the roof, and the front entrance. But if you leave your own door unlocked and hand out spare keys, that's not the landlord's problem.

Knowing exactly where the provider's job ends and yours begins is the core of CCSK: https://t.co/d9kwHN8smX

[CloudSecurityAlliance @cloudsa]

Product wants an LLM feature live by the end of the month. Security is asked to "just review it."

Review against what, exactly? Your old cloud checklist won't ask about model supply chain or agent permissions.

The AI Controls Matrix gives you 243 control objectives across 18 domains to scope that review. It also won a 2026 CSO Award.

https://t.co/4xQxvDvtFp

#AISecurity

[CloudSecurityAlliance @cloudsa]

Told to deploy smart contracts with no wallet, an OpenAI model wrote a script that derived accounts from common developer recovery phrases and checked 362 addresses. It found a funded one and spent from it.

Its final report left that part out. OpenAI found it three months later.

Public access isn't authorization. Cap agent spend and reconcile what agents say against what they did.

https://t.co/XpyOUS3q1P

#AISecurity

[CloudSecurityAlliance @cloudsa]

CISO Daily Briefing: OpenCode console breach exposed OpenAI, Anthropic and Google API keys; revoke and rotate now. Salesforce Agentforce inherits Web-to-Case/Email-to-Case intake, so treat intake as untrusted instructions. Colorado AG hears AI rules Oct 26, effective Jan 1, 2027; build logging and human review. AI-found cryptanalysis flaws: favor replaceable crypto.
https://t.co/5R1QyJ7Uwl