AI Agent Attack Wiped 100 Azure Storage Accounts in Seven Minutes
What happened
Microsoft and Sysdig documented two attacks in June 2026 by the ransomware group JadePuffer, tracked by Microsoft as Storm-3168, in a report published by JadePuffer agentic AI attacks target Azure, destroy cloud resources. The group deployed AI agents to run full attack chains autonomously: identifying targets, stealing credentials, moving across cloud environments, and deleting storage accounts, Key Vaults, and virtual machines. More than 100 storage accounts were destroyed in under seven minutes across the two observed incidents. Attackers also attempted to remove backup and recovery protections, directly targeting the organization's ability to restore systems. The group gained initial access by harvesting service account credentials exposed in public code repositories. This is a well-documented but persistently underaddressed control gap, as seen in standing agent credentials as a material control gap.
Why it matters
- ·AI-automated attack chains now operate faster than human detection workflows. A seven-minute destruction window means that cloud permission reviews, anomaly alerts, and manual incident response procedures designed for slower, human-paced intrusions will not trigger in time to limit damage.
- ·Attackers deliberately targeted backup and recovery infrastructure. This directly undermines business continuity and disaster recovery programs that compliance teams rely on as a last line of defense. Recovery-time objectives in existing incident response plans may be unachievable after an AI-automated attack.
- ·Credential exposure in public code repositories was the documented entry point. Compliance teams at any organization using cloud platforms need to confirm whether service account keys or access credentials appear in public or semi-public repositories. Procurement and application security teams often own this check, but governance programs rarely verify it.
Governance controls affected
What to do now
- ☐Ask your cloud and identity team to run an automated scan of all public and internal code repositories for exposed service account credentials, access keys, or cloud API tokens, and revoke any found immediately.
- ☐Review Azure role assignments for service accounts and automation identities: confirm each account has only the permissions it needs for its specific task, and flag any account with broad delete or administrative rights for immediate reduction.
- ☐Verify that cloud backups and recovery vaults are protected by separate credentials and access controls that are not reachable from the same accounts used for day-to-day operations, so an attacker who compromises operational credentials cannot also destroy backups.
- ☐Test whether your current security monitoring would detect and alert on the deletion of 100 storage accounts within a seven-minute window, and confirm what the expected response time would be if it did alert.
- ☐Review your incident response plan's recovery-time objectives against the scenario where both primary systems and backup infrastructure are destroyed simultaneously, and update the plan if the objectives are no longer realistic.
What to watch next
Compliance teams should monitor whether Microsoft or cloud regulators issue updated baseline security requirements for Azure tenants following this incident, particularly around service principal credential management and backup segregation. The pattern of AI agents automating destructive cloud attacks is consistent with findings by Unit 42 on fully autonomous AI ransomware chains and Frontier Agents building attack chains autonomously. Regulators will eventually treat AI-accelerated attack timelines as a factor in required detection and response standards. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services frames agentic threats as a baseline enterprise concern. Further binding guidance from CISA or equivalent bodies on cloud workload protection seems likely.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
- AI systems built to extend your reach are now extending attackers' reach too, and regulators in California and South Korea are making clear that containment failures belong to deployers, not just vendors.8 Oct
Free every Thursday. Unsubscribe anytime.