TLDR Tech / InfoSec
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System
Palo Alto Networks' Unit 42 built a multi-agent offensive security system and tasked it with attempting to exploit a webapp and export data from a BigQuery table with the privileges it obtains. The system consisted of an orchestrator that managed the test, an infrastructure agent responsible for tasks such as port scanning, an application security agent responsible for testing the discovered application, and a cloud security agent responsible for cloud-related tasks. In the test, the orchestrator began by requesting that the infrastructure agent perform a network scan, then tasked the application security agent with finding and exploiting an SSRF vulnerability in a discovered web application, and finally tasked the cloud security agent with using the credentials stolen in the previous step to exfiltrate BigQuery data.
Read the full story