The Modern Security Attack Surface: Lessons from Cloud, AI, and Supply Chains

When I first started learning security, I assumed most breaches happened because someone found a clever vulnerability in an application. But listening to several talks at Bsides Seattle 2026 recently forced me to rethink that assumption. Many modern attacks are not about sophisticated exploits at all. They succeed because of exposed credentials, identity misconfigurations, compromised dependencies, or systems interacting in ways their designers did not anticipate.

Across talks covering cloud identity, AI security, and open-source supply chains, the same pattern kept appearing: attackers are increasingly exploiting how systems are connected, not just how they are coded.

Cloud Identity Is the Real Control Plane

One talk focused on how attackers increasingly target cloud IAM systems rather than individual machines.

In cloud environments, identity effectively becomes the control plane. IAM permissions determine who can access infrastructure, assume roles, and escalate privileges.

A common attack path begins with something simple: credentials exposed in public storage or repositories. Once attackers obtain credentials such as AWS keys or SSH keys, they log in and start mapping permissions.

Modern attack-path tools can analyze IAM relationships and compute the shortest path to administrative access, chaining together roles and privileges until admin access is reached.

AI is accelerating this process. Instead of manually exploring configurations, attackers can use automation to quickly analyze permissions and generate exploitation paths.

The defensive takeaway is straightforward: defenders must understand their IAM relationships before attackers do. Mapping privilege chains and enforcing controls such as Service Control Policies (SCPs) can significantly reduce the attack surface.

A research paper on how to defend agents LLM agents : https://www.usenix.org/system/files/usenixsecurity25-ayzenshteyn.pdf

Another talk by Kat Fitzgerald on security misconfigurations in cloud https://github.com/rnbwkat/presents/blob/master/misconfiguration_in_cloud.pdf

Supply Chain Attacks Often Start With Phishing

Another talk examined malware campaigns targeting open-source ecosystems like npm.

Several incidents in 2025 involved attackers compromising popular packages and distributing malicious updates downstream to developers.

Interestingly, many of these compromises began with phishing attacks targeting maintainers. Attackers directed maintainers to typosquatted login pages that mimicked legitimate services. Once credentials were entered, attackers obtained publishing tokens and gained control of the package.

The attacker then uploaded malicious versions containing install scripts that executed automatically during npm install. Because dependencies are reused across thousands of projects, a single compromised package can propagate quickly.

Some defensive practices discussed included:

• Using lockfiles to pin dependency versions
• Avoiding automatic dependency upgrades
• Treating install scripts carefully
• Scanning dependencies in CI pipelines

Another important concept was the role of Software Bill of Materials (SBOMs). While often framed as compliance artifacts, their real value appears during incident response. When a malicious dependency is discovered, accurate SBOMs allow teams to quickly determine whether their systems are affected.

AI Is Accelerating Attacks

Artificial intelligence appeared across multiple sessions, but not necessarily as a completely new attack vector.

Instead, AI mostly accelerates existing attacks. Tasks like reconnaissance, privilege analysis, and attack path discovery can now be partially automated.

Rather than manually exploring systems, attackers can analyze large environments and generate attack strategies faster.

At the same time, AI is becoming a tool for defenders. In structured workflows such as threat modeling, AI can help process large amounts of context and identify potential risks.

However, the speakers repeatedly emphasized that AI should raise the floor of security practice, not replace human judgment.

A resource for testing LLM-powered structured extraction tasks : https://www.promptfiddle.com/

The AI Attack Surface Is Bigger Than the Model

Another talk focused on attacks against AI systems themselves.

Most practical attacks do not target the model directly. Instead, they exploit the ecosystem around the model — inputs, data sources, integrations, and applications using the model.

Examples discussed included:

• Prompt injection attacks through user input
• Hidden prompts embedded in uploaded files or PDFs
• Indirect attacks through external data sources
• Malicious content submitted through feedback systems

In some scenarios, attackers could inject instructions into documents processed by AI assistants, influencing model behavior or exposing sensitive data.

The key lesson is that AI outputs should be treated the same way we treat user input in traditional applications: untrusted by default.

Study into jailbreaking llms: https://github.com/elder-plinius/L1B3RT4S

LLM payload crafter for AI safety research : https://github.com/Arcanum-Sec/P4RS3LT0NGV3

Arcanum AI Sec Resource Hub : https://arcanum-sec.github.io/ai-sec-resources/

Guardrails Alone Are Not Enough

Many systems rely on filters and guardrails to prevent prompt injection and jailbreak attacks.

Experiments such as **Hack-a-Prompt** showed that human attackers eventually bypassed every tested defense.

This doesn’t mean guardrails are useless, but it does mean they cannot be the only defense.

AI systems need defense in depth, including:

• Limiting what AI agents are allowed to do
• Validating outputs before executing actions
• Restricting access to sensitive systems
• Monitoring interactions for suspicious behavior

The goal is not perfect models, but safe systems even when models fail.

Security Is a Systems Problem

Across all of these talks — cloud IAM attacks, supply chain compromises, and AI vulnerabilities — the same theme appeared.

Security failures rarely come from a single bug. They emerge when multiple small weaknesses align across a system.

A phishing email compromises a maintainer. A malicious dependency reaches downstream projects. An exposed credential leads to cloud privilege escalation.

Each step alone may seem minor, but together they create a viable attack chain.

For someone approaching security from an application perspective, this was a useful reminder. Security is not just about fixing code vulnerabilities — it is about understanding how identities, dependencies, automation, and human behavior interact across complex systems.

Key Takeaways

• Modern attacks often exploit system design and operational complexity, not just software bugs.
• Cloud identity systems have become a primary attack surface due to privilege relationships.
• Many open-source supply chain attacks begin with simple phishing campaigns targeting maintainers.
• AI mostly accelerates existing attack techniques rather than introducing entirely new ones.
• AI security must focus on the ecosystem around the model, not just the model itself.
• Defensive strategies should assume that models, dependencies, and identities will eventually fail, and build resilient systems around them.