Sonrai | Enterprise Cloud Security Platform

Every AI agent deployed in AWS, GCP or Azure becomes a cloud identity the moment it goes live. It gets an IAM role. That role carries permissions, sometimes very privileged ones. And unless there is an automat...

AI agents are cloud identities. They don’t get a badge or a login. They get a service account, an IAM role, or an API key, just like any other non-human identity running in your environment. Mechanically, there’s nothing new.

What’s new is how many of them are being deployed, how fast, and with how much access. Most AI agents are running with far more permissions th...

Building on recent research identifying DNS-based exfiltration risks in Sandbox mode AgentCore Code Interpreters, I identified global S3 access as another Command & Control channel for sandboxed code interpreters. Unlike DNS-based exfiltration, which has since been fully mitigated, S3 access is a useful and fully-documented feature of Agen...

AI agents are cloud identities. They receive IAM roles at deployment, hold credentials, and access cloud resources to execute tasks. But unlike human users, they do this without session-based checkpoints, without manual approval steps, and sometimes with minimal human involvement. Traditional PAM was built around the assumption that a person initiates access.