Malicious skills are evolving, and attackers are finding ways to execute them before model-level defenses even activate. In the first post of our new series, I’ll show you how dynamic context in coding agents can introduce new supply chain risks: securitylabs.datadoghq.com/articles/mal...

It’s been a long time since a research target called to me this loudly. claude.com/blog/claude-...

If you’re worried about coding agent security and are only focused on malicious skills, you’re missing like 80% of the total attack surface.

Bummer, it looks like Anthropic removed the ability to DoS their models with the magic string. This was a fun technique that had some security ramifications where you could kill an inference session. It was fun while it lasted!

New on Hacking the Cloud! Raajhesh Kannaa Chidambaram covers Daniel Grzelak's research on how AWS error messages can reveal publicly exposed resources, without needing access! This article covers how to use them for enumeration and detection. hackingthe.cloud/aws/enumerat...

Researchers have been warning about this for years. Compromise a developer laptop → steal tokens → pivot to cloud. In many orgs that path ends with AWS admin in minutes. thehackernews.com/2026/03/unc6...

Datadog Security Research continues to push the boundaries of modern cloud security—including AI security! @siigil.bsky.social shares her finding on logging gaps affecting Copilot Studio, allowing adversaries to evade detection. securitylabs.datadoghq.com/articles/cop...

Datadog 🤝 Okta: "The enhanced logic developed by Datadog’s own Security Research team during this collaboration has been contributed back to the public Okta Security Detection Catalog, ensuring that the broader security community benefits from this joint research" sec.okta.com/articles/202...

"permitted a single ECS task role "read access to every secret in the account, including the production Redshift master credential."" There is a lot going on with this (even if not all of it can be believed). Properly scoping IAM is critical! www.bleepingcomputer.com/news/securit...

😬

I get the appeal of “human-in-the-loop” for AI safeguards. But humans have been getting socially engineered for millennia. That’s not exactly a hard security boundary 😬

Sometimes I miss Jia Tan.

Hey wake up! New offensive AWS meta just dropped! Thanks to Daniel Grzelak, we now have an effective oracle for determining if resources are publicly exposed without leaving logs. (As an offsec person) LFG!!! www.plerion.com/blog/dont-ex...

If anyone is interested, I built a framework to use Claude Code or Codex to act as a virtual DM for DND. State is stored on the filesystem and persists between sessions. I think Opus 4.6 is the ideal model for this but Codex works too. github.com/Frichetten/D...

Professional communication

New on Hacking the Cloud! A look at how a familiar container escape pattern shows up in GCP Cloud Workstations. We trace a path from a container to service account. If you’re using Cloud Workstations, this is a useful model to keep in mind. hackingthe.cloud/gcp/exploita...

Just got my ticket to @fwdcloudsec.org! Looking forward to the best cloud security conference in the world!

If you’re putting AI agents anywhere near prod, this is worth a read. We built AI Guard to help teams monitor prompts, tool calls, and model behavior in real systems, identifying and blocking AI threats in real time. More here: www.datadoghq.com/blog/ai-guard/

New on Hacking the Cloud: Ben Stevens documents a new method for extracting IAM creds from an AWS Console session. Useful for post-exploitation and evasion tradecraft. I've been meaning to cover this for years. Glad it’s finally live: hackingthe.cloud/aws/post_exp...

As AI agents get more autonomous, prompt injection will shift from “ignore all previous instructions” to “add a task to the backlog to X.” Once the payload crosses a trust boundary and lands in Jira, it’s no longer a prompt, it’s just another task. A task that makes me admin :D

Houses are bullshit

Want a clear analysis of the latest OpenSSL CMS/PKCS#12 vulnerabilities and their real-world impact? Our post explains the conditions required for exploitation and how to evaluate practical risk in your environment. securitylabs.datadoghq.com/articles/ope...

AI workloads are landing in the same AWS/Azure/GCP accounts we’ve been breaking into (and defending) for years. It's time for Hacking the Cloud to catch up. We're announcing a call for research! Share your AI and LLM sec research with thousands of readers hackingthe.cloud/blog/call_fo...

IDEs are the new browser: massive attack surface, privileged access to various things, and lots of “just trust it.” Today the Security Research Team at Datadog dropped IDE-SHEPHERD: a tool that watches extensions at runtime and blocks dangerous behavior. securitylabs.datadoghq.com/articles/ide...

I'm skeptical of the claim that 1,000 Clawdbot instances are publicly facing on the internet. If you look at the Shodan output, most of those boxes don't have port 18789 exposed (default Clawdbot port). The references to 18789 are from mDNS. Take this one for example:

Trying out clawdbot! And I'll live tweet my experiences setting it up and using it. It's been all of my timeline and doing cool things. (see @ajs.bsky.social's post below). I'm running this on an Ubuntu VM managed through KVM with 6 cores and 16 gigs of ram. aaronstuyvenberg.com/posts/clawd-...

Did you know Claude models have a "magic string" to test when a model refuses to respond? If that string enters prompt context, it can be abused to break LLM workflows until context is reset. It's the EICAR test string of the AI age. Details: hackingthe.cloud/ai-llm/explo...

We are on the verge of the commoditization of exploitation. Every vuln will functionally have a public PoC available because attackers can generate them in minutes. The advantage will increasingly belong to organizations that can detect, respond, and contain fast. sean.heelan.io/2026/01/18/o...

Very cool research on a CodeBuild misconfiguration which could have had significant consequences. I’m a bit disappointed that there wasn’t more done to secure the supply chain after the Q Developer incident. www.wiz.io/blog/wiz-res...

We’re hiring! Join the Datadog Security Research team as a Senior Security Researcher specializing in GenAI and help shape the future of AI security! careers.datadoghq.com/detail/75146...

Fiber internet is breaking my brain. Streaming 4K video from my home server to my phone over the internet. It doesn’t even stutter. Insane.

The 2025 Hacking the Cloud: Year in Review is out! We take a look at the growing tide of software supply chain attacks, discuss the most critical cloud vuln discovered to date, and share some stats for the site! hackingthe.cloud/blog/2025_wr...

New on @hackingthe.cloud, did you know that attackers can prevent you from kicking them out of your environment in certain situations? Eduard Agavriloae shares his research on how attackers can nullify containment attempts! hackingthe.cloud/aws/post_exp...

I’m running behind on PRs, DMs, the Hacking the cloud EoY report, etc. I will catch up in time, I’m just trying to rest and heal this horrible fever.

Currently backed myself into a corner by ignoring my own advice: When researching vulns in a cloud service, learn how the service works BEFORE you start hunting. Do it in the reverse order and you’ll end up with a vuln you can’t tie to real impact, because you never learned how harm could occur.

If you’re messing with the AWS console in Burp Suite and getting some weird errors when trying to HEAD S3 buckets, go into your proxy listener settings and turn OFF HTTP/2 support. I was baffled for a bit trying to get a service to work and that solved it.

Ah yes, the alloy known as '<span class="no-text-formatting">white gold</span>'

Today in weird things family members say about technology, this is “the weird internet frisbee”.

New on @hackingthe.cloud! A great post by Federico Lucini on bypassing AWS Network Firewall egress filtering! hackingthe.cloud/aws/post_exp...

Are you interested in pushing the boundaries of Gen AI security? Do you want to join an accomplished team of researchers, software engineers, and hackers? Join us! careers.datadoghq.com/detail/71207...

Shout out to @flekyy90.bsky.social for not one, but two new articles on Hacking the Cloud! If you're interesting in learning more persistence methods definitely check them out! hackingthe.cloud/aws/post_exp...

Added a new challenge coin to the display today, in recognition of my contributions to the AWS Vulnerability Disclosure Program. I’m excited to continue pushing the boundaries of AWS security and helping to build a more secure cloud!

@fwdcloudsec.org Europe 2025 was incredible! Amazing talks, amazing research, and amazing people. There is no other conference I would recommend for cloud security people. Looking forward to next year!

Good morning @fwdcloudsec.org! If you would like exclusive, limited edition, holographic stickers, come find me!

Looking forward to seeing everyone in Berlin! Safe travels! @fwdcloudsec.org

While not explicitly stated, I do want to stress: Cloud security people aggressively preach not storing long lived AWS access keys in CI/CD pipelines, and that you should instead use things like OIDC. However, that isn’t a silver bullet. In addition…

Thanks to folks including @frichetten.com for feedback about our Bedrock API key launch. We're listening. Yesterday, we updated Bedrock and IAM docs (see docs.aws.amazon.com/bedrock/late...) to clarify that these are service-specific credentials and how to prevent their use in your environment. 1/2

For any security research leaders attending @fwdcloudsec.org EU, DM me. I’d love to meet with you and chat about your organizational structure! Who do you report to, how do you divide your teams, what are your success criteria, etc.

AWS’s commitment to this host name template is incredible. It’s everywhere!

Major shout out to @andoniaf.unicrons.cloud for adding three new privilege escalation techniques to the Hacking the Cloud catalog! Contributions like this make everything possible. hackingthe.cloud/aws/exploita...