Serious flaws in cloud applications have multiplied this year, and many businesses are leaving AI access keys in place long enough for attackers to exploit them. That is according to research from monitoring and security firm Datadog.
The company’s State of Cloud Security 2026 report found the median number of high or critical vulnerabilities in the cloud services it analysed rose from four in February to around 16 in November.
More than one in five organisations in its sample use cloud AI services. To make adoption easier, cloud providers offer API keys that stay valid until someone revokes them. Datadog found nearly half of organisations using Google Gemini rely on these long-lived keys, as do 17% of those using Amazon Bedrock. If a key is stolen, an attacker can use it for as long as it stays active.
Datadog head of security advocacy Andrew Krug said attackers did not need their own AI model if they could steal the key used to access someone else’s. He advised teams building AI applications to use temporary access wherever possible.
The firm said attackers are already testing stolen cloud credentials for AI access. Its researchers found tools built to check whether stolen AWS credentials can reach Amazon Bedrock. They also observed similar probing in 12 organisations’ cloud environments over 30 days.
The report also points to software dependencies as a route to credentials. Cloud workloads rely on 149 software packages on average, more than half of them pulled in indirectly through other packages. Sixty per cent of organisations run cloud applications using a package version released less than 24 hours earlier, which means a compromised update could spread quickly. Datadog pointed to the Shai-Hulud 2.0 malware, which searched infected systems for cloud credentials.
There was some progress. The report found 55% of organisations using AWS have adopted data perimeters, which limit what an attacker can reach even with a valid credential, up from 40% in 2025.
Yadi Narayana, Datadog’s field chief technology officer for Asia Pacific and Japan, said the findings broadly matched what the company sees in Australia and New Zealand. He said long-lived credentials often remain hidden in older applications because teams fear disrupting critical services.
“Boards should treat software supply chain risk as a business resilience issue, not simply a technical problem,” said Narayana.
The findings are consistent with government data. The Australian Signals Directorate’s latest threat report named compromised accounts and credentials among the most frequently reported incident types, as Insurance Business reported last month.
For brokers, the gap is in what underwriters ask. Cyber proposal forms typically focus on multi-factor authentication, backups, patching and endpoint protection. They rarely ask whether a client’s developers use long-lived API keys for AI services, or how quickly new software packages go into production. A client that has passed every standard control question could still have a static AI key sitting in a code repository.
As businesses put AI tools into production, those questions are likely to reach underwriting. For now, brokers with technology-heavy clients can raise credential management at renewal. It costs little to ask, and a client with a credible answer will be easier to place if insurers start asking themselves.
