Original research on AWS security, IAM exploitation, and autonomous cloud security testing from the OFFENSAI research team.
Jul 8, 2026 · 8 min read
We pointed our autonomous offensive agent, AgentO, at Datadog's new Pathfinding Labs and it solved all 122 live AWS privilege-escalation labs — no human in the loop, no access to the answers, average 9 turns. Here's what made it work.
Ioan Criste, Dragos Stanescu & Eduard Agavriloae
OFFENSAI Research Team
Jul 3, 2026 · 4 min read
OFFENSAI has joined the Wiz Integration Network (WIN), bringing Cloud-Native Adversarial Exposure Validation to the Wiz ecosystem so teams prove which exposures attackers can actually exploit.
Karen Nguyen
Jun 18, 2026 · 12 min read
AWS shipped Console Sign-In restrictions via resource control policies. Here are 5 attack paths that bypass them, and how OFFENSAI maps them.
Dragos Stanescu
May 20, 2026 · 12 min read
scopeshift demonstrates that Claude Code and other AI coding agents can be tricked into running unauthorized pentests through network-layer deception alone — no adversarial prompts required. The agent thinks it's probing localhost, but the traffic lands on a real third-party target.
Eduard Agavriloae
Apr 28, 2026 · 7 min read
AI isn't creating a new vulnerability crisis. It's exposing the one security teams were already living in: too much noise, too little exploitability proof, and too much uncertainty.
Karen Nguyen
Apr 7, 2026 · 8 min read
AWS IAM eventual consistency gives attackers a 4-second window after credential revocation. notyet is an open-source tool to test IR containment playbooks.
Eduard Agavriloae
Feb 24, 2026 · 12 min read
Standard AWS IR containment fails against attackers exploiting IAM eventual consistency. This article presents an SCP-enforced technique that makes identity-level containment attacker-resistant.
Eduard Agavriloae
Feb 3, 2026 · 18 min read
Adversarial Exposure Validation (AEV) proves what's exploitable right now, tests detection during execution, and re-runs the same path after fixes to verify closure.
OFFENSAI
Jan 15, 2026 · 10 min read
Discover how Adversarial Exposure Validation (AEV) uses AI-driven testing to continuously prove which attack paths are exploitable. Compare AEV vs pentesting and learn why continuous validation replaces episodic scanning.
OFFENSAI
Dec 17, 2025 · 12 min read
Cybersecurity predictions for 2026 covering cloud identity attacks, AI-driven red teaming, CI/CD supply chain risks, and why continuous validation replaces periodic testing.
OFFENSAI
Dec 7, 2025 · 10 min read
AWS IAM eventual consistency creates a 4-second window where deleted AWS access keys can still work. Learn how attackers exploit this and how to mitigate it.
Eduard Agavriloae
Dec 3, 2025 · 6 min read
An initial security overview of AWS Lambda Managed Instances, exploring the Bottlerocket-based architecture, the 'Elevator' components, and security insights for this new compute model.
Eduard Agavriloae
Nov 29, 2025 · 7 min read
Most S3 ransomware attacks don't start with public buckets. They start with ABAC, tag abuse, and living-off-the-land AWS services. See how the real kill chain works.
Dragos Stanescu
Sep 17, 2025 · 8 min read
Traditional red teaming is outdated. Learn why continuous red teaming powered by AI and automation delivers real-time risk validation for modern cloud environments.
OFFENSAI
Sep 10, 2025 · 6 min read
AI red teaming is transforming offensive security. Learn how to align AI-driven tactics with OWASP and NIST, and simulate real-world attacks using intelligent automation.
OFFENSAI
Aug 26, 2025 · 13 min read
Cloud security posture management (CSPM) tools aren't enough in 2025. Discover why ACAE and CNAPP are the missing pieces for continuous validation and end-to-end cloud security.
OFFENSAI
Aug 20, 2025 · 10 min read
Learn cloud compliance in 2025: frameworks (SOC 2, ISO 27001, HIPAA, GDPR), challenges, tools, automation, and best practices for continuous compliance.
OFFENSAI
Aug 4, 2025 · 6 min read
Your security scanner flagged 847 findings in your AWS environment last week and...
Dragos Stanescu
Jun 24, 2025 · 15 min read
Exploring the breakthrough potential and emerging risks of AI agents that can autonomously discover and exploit complex AWS attack chains.
Eduard Agavriloae
Apr 2, 2025 · 7 min read
Did you know a misconfigured private API Gateway can be invoked from any AWS account?
Eduard Agavriloae
Mar 13, 2025 · 5 min read
The article highlights the dangers of using the AWS managed policy PowerUserAccess in complex environments by sharing the attacker's perspective on the matter.
Eduard Agavriloae
Feb 28, 2025 · 20 min read
Discover how to leverage AWS Lake Formation with Amazon EMR on EKS for efficient big data analytics. Simplify cluster management and optimize your data workflows.
Dragos Stanescu
Jan 15, 2025 · 11 min read
This research was conducted by OFFENSAI to show what an attacker can achieve after creating a malicious OIDC identity provider in AWS and how they can do it. The article presents novel techniques and tools for persistence and evasion.
Eduard Agavriloae
See how OFFENSAI's cloud security testing platform helps teams move from exposure detection to controlled validation, technical evidence, and risk-based prioritization.