The break is speed. A lone actor can now turn one AWS foothold into parallel secret-hunting, persistence, exfiltration, and disruption before a human team finishes its first round of checks. That makes manual incident response the bottleneck, not attacker effort.
Sygnia says the actor used agentic AI to run multiple cloud tasks at once after getting an access key through weaknesses in an internet-facing application. The report ties the activity to gaps in secrets management, identity governance, deployment workflows, cloud permissions, visibility, and incident preparedness across AWS.
The practical risk is broader than one cloud break-in. Any environment with standing cloud credentials and weak control-plane monitoring can be pushed through several abuse paths at once, faster than stepwise playbooks assume.