The vulnpocalypse is here: Serious cloud flaws have quadrupled in nine months, and stolen AI keys could be the next big breach

For years, the “vulnpocalypse” sounded like a warning from security vendors with something to sell. New data suggests it has arrived in production. The median number of high or critical vulnerabilities in cloud services analysed by Datadog rose fourfold, from four in February 2026 to around 16 in November, according to the company’s new State of Cloud Security 2026 report.

The jump in just nine months turns the term from a theoretical concern into a measurable condition. Cloud applications are carrying more serious known flaws than ever, and the pace at which they accumulate is outrunning the pace at which most teams can patch. For technology leaders, that reinforces a hard truth: some applications will be compromised, so the cloud foundations underneath them must limit an attacker’s reach.

Long-lived AI keys hand attackers more time
Containing the damage from a compromised application means protecting the keys it uses to reach other services, and the rush to adopt AI is complicating that job. More than one in five organisations analyzed by Datadog uses cloud AI services. To make those services easier to adopt, cloud providers offer long-lived API keys that can remain valid until revoked, which gives an attacker more time to use them if they are stolen.

Datadog found that nearly half of organisations using Google Gemini use long-lived Gemini API keys, while 17% of those using Amazon Bedrock use long-lived Bedrock API keys. Convenience is clearly winning over caution, and the exposure is easy to underestimate because a forgotten key rarely triggers an alert.

“Attackers don’t need to use their own AI model if they can steal the key used to access yours”, said Andrew Krug, Head of Security Advocacy at Datadog. “Teams should use temporary access wherever possible as they build AI applications, rather than leave behind keys that can keep working for years.”

The threat is not hypothetical. Attackers are already testing stolen cloud credentials for AI access. Datadog Security Labs recently uncovered tools designed to test whether stolen AWS credentials can access Amazon Bedrock. Researchers also observed similar probing in 12 organisations’ cloud environments over a 30-day period. For an enterprise, a stolen key can mean fraudulent usage billed to its account, exposure of the data flowing through its models, and a foothold from which to move further.

The software supply chain is another path to your credentials
The report also shows how thin the line is between a routine software update and an incident. Cloud workloads depend on 149 software packages on average, and more than half of those are indirect dependencies brought in through other packages. Few teams have a complete picture of code they never chose to install.

Speed compounds the risk. According to the report, 60% of organisations run cloud applications using a package version released less than 24 hours earlier. Across all cloud applications analyzed, 21% use a version this new. New packages are not inherently unsafe, but the figures show how quickly a compromised version could reach cloud applications.

The Shai-Hulud 2.0 malware shows the potential consequences. The malware searched infected systems for cloud credentials, which makes a poisoned dependency a direct route into the cloud environment behind it.

Progress in limiting the blast radius
The report is not entirely grim. It found signs of progress in limiting what an attacker can reach, even with a valid credential: 55% of organisations using AWS have adopted data perimeters, up from 40% in 2025. That shift suggests more security teams are accepting that credentials will leak and are designing controls that assume it.

“As serious flaws multiply, the question is how far an attacker can get through one compromised application,” said Emilio Escobar, Datadog’s Chief Information Security Officer. “Teams need to fix those flaws and limit the damage if an application is compromised. Temporary credentials and data perimeters can restrict an attacker’s access, while a shared view of applications, identities and infrastructure helps Security and Engineering contain an attack before it spreads. In the AI era, security becomes an observability problem: you can’t stop a system-wide attack without seeing the whole system.”

The message running through the data is that prevention alone no longer holds up. With serious flaws multiplying, long-lived AI keys sitting in production and new package versions reaching applications within hours, the more useful question for leadership is how much a single compromised application could expose. Moving to temporary credentials, enforcing data perimeters, and giving Security and Engineering one shared view of applications, identities and infrastructure are the foundations the report points to. Organisations that put them in place now will be better placed to contain the next breach before it spreads.