The Pulse
AISI Models Chained Cloud Flaws Into a Five-Step Attack
The UK AI Security Institute says frontier models found and chained real misconfigurations in an isolated copy of its AWS research platform. One model completed a five-step route to unauthorized data for under £150 in token costs, while bas
AI.info Team · Written with AI ·
“One frontier model with strong cyber capabilities found this attack for under £150 in tokens.”
AI Security Institute
A five-step route across user boundaries
The UK AI Security Institute said on July 7 that frontier models had found previously unknown weaknesses in a staging copy of its cloud research platform, then linked several of them into an attack path. The exercise showed a model moving from ordinary researcher-level access to other users’ workloads and data without needing a victim to act. AISI says the chain required five independent steps and has since been fixed.
The test target was an AWS deployment built with Python and the AWS Cloud Development Kit. AISI kept the staging environment separate from production; no production users were disrupted and no real data was present. The institute says the findings applied to its production environment, giving the test practical relevance without exposing live users or records.
Three methods, different costs in human review
AISI compared static analysis of private source code, autonomous probing inside the staging environment, and red-teaming in which a researcher reviewed and approved each model action. All three approaches produced findings that AISI considered worth patching. The autonomous test used the institute’s Inspect evaluation framework, while the interactive approach let a researcher pursue promising leads as the model continued looking for others.
Static analysis generated the most reports rated “high” or “critical,” but also the most noise. Engineers found that some issues were not exploitable or were already mitigated elsewhere in the code; separating those from genuine risks took substantial expert review. By contrast, autonomous probing and researcher-guided red-teaming both uncovered the isolation misconfiguration behind the multi-step path.
AISI put the token cost of finding that attack at under £150, and the cost of the full exercise at under £1,000. The institute did not name the models it tested or report a model-by-model scorecard, so the figures describe this exercise rather than a general price or capability benchmark.
One alerting system missed the agents
The test also exposed a gap in detection. AISI says a basic commercial alerting system did not flag any autonomous-agent activity as a security event. Its more advanced monitoring, combining cloud scanning with a lightweight host sensor, did identify some behavior as anomalous, including repeated attempts to assume credentials and unexpected traffic from staging.
The contrast matters: finding a vulnerability is only one part of defending a cloud system. AISI’s own account shows that automated code review can produce a large queue of questionable reports, while an attack that crosses several permission boundaries may go unnoticed by a basic alerting setup. The institute says methods involving more engineering or human involvement yielded findings it found more conclusive and actionable.
AISI has since tightened evaluation controls
In a later security update, AISI describes changes to its frontier-model evaluations, including disabling internet access for future agentic cyber tests until stronger controls are available. It also says it is using separate network controls, real-time monitoring, pre-run checks and additional review of evaluation design. The institute is applying AI-assisted testing to its own evaluation environments, with layered safeguards intended to limit the risk if an agent finds a weakness.
That follow-up does not change what the cloud case established: in AISI’s mirrored staging setup, a basic commercial alerting system failed to register the autonomous agents’ activity.