Microsoft Report: AI-Run Attackers Deleted 100+ Cloud Storage Accounts in 7 Minutes, a Human Still Picked the Target

Microsoft published its 2026 Digital Defense Report on October 1, covering July 2025 through June 2026 and drawing on what the company says is more than 165 trillion security signals processed daily. The headline finding isn't a warning about future risk. It's a documented case of an AI system running a ransomware attack largely on its own.

A Real Attack, Not a Thought Experiment

The Sysdig Threat Research Team disclosed the case in July 2026, naming it JADEPUFFER. An LLM agent got in through CVE-2025-3248, a remote code execution flaw in Langflow, an open-source AI workflow tool. From there, according to Sysdig's reporting as described by Cloud Security Alliance Labs, the agent handled reconnaissance, harvested credentials across multiple cloud and AI providers, pivoted into a production database, and ran the extortion demand, diagnosing and correcting a failed login attempt in 31 seconds without a person directing the tactical steps.

Cloud Security Alliance Labs notes that later reporting cautioned a human still selected the target and configured the campaign infrastructure before the agent took over. So this wasn't a machine that decided on its own who to attack. It was a machine that executed the attack once a person pointed it at a victim. Tech Times' coverage glossed over this distinction when it described the agent as having "autonomously identified targets." The identification part, per Cloud Security Alliance Labs' sourcing, was still human.

Microsoft's own September 25 disclosure, under its threat-actor designation Storm-3168, shows the same group applying the model to enterprise cloud infrastructure. Using two compromised Azure service principals from a single tenant, the actor mapped a victim's environment in a continuous 15-hour-and-30-minute reconnaissance pass, then executed more than 150 destructive and credential-collection operations in roughly 35 minutes, including over 100 storage account deletion attempts packed into a 7-minute window, according to Cloud Security Alliance Labs' review of Microsoft's disclosure.

The way in wasn't a zero-day. An employee posted a service principal's client ID, secret, and tenant ID in a public GitHub issue, then deleted the post. The credentials stayed retrievable through the platform's edit history anyway. Most of the storage deletion attempts succeeded. But accounts protected by Azure resource locks or backup protection locks survived, even under full identity compromise. Basic cloud hardening still works against a machine-speed attacker.

The Speed Gap Microsoft Says Defenders Can't Close

Separate from the JADEPUFFER case, Microsoft ran controlled evaluations pitting frontier models against an emulated enterprise network. Anthropic's Mythos Preview and OpenAI's GPT-5.5 each chained 32 consecutive attack steps to achieve full domain compromise with no human direction at all, according to Tech Times' account of the report.

The bigger structural problem is timing. Microsoft says the median window between a vulnerability being discovered in the wild and active exploitation has fallen to well below 24 hours. Enterprise patching for critical external vulnerabilities still takes 30 to 60 days, a gap Microsoft attributes to the testing and integration work required before production code changes go live, something AI hasn't eliminated.

The vulnerability pipeline is also swelling. Nearly 40,000 CVEs were published in the first half of 2026, putting the year on track for a projected 72,000, roughly double 2025's total, according to both Tech Times and Help Net Security's reporting on the same Microsoft figures. Microsoft expects a multi-year stretch where known but unpatched flaws pile up faster than companies can close them.

Phishing Is Back, and It's AI-Personalized

Microsoft's incident responders found phishing was the entry point in 23% of intrusions investigated between July 2025 and June 2026, up from 7% the year before, per Help Net Security. Exploits against public-facing applications rose from 15% to 24% over the same window. Microsoft says AI now fixes the four things that used to give fraudsters away: a forged ID that looks off, writing that reads like a second language, an accent during a video interview, and no online footprint. In 52.2% of intrusions that began with a valid account, attackers harvested more credentials once inside. Another 18.4% involved active password-spray campaigns.

Nation-state activity follows the same pattern. Microsoft says Chinese state actors are using AI tools to hunt for vulnerabilities, Russian actors are using AI-generated "vibe coding" to speed up tooling, and North Korean groups are using AI for persona development and malware creation, including the March 2026 compromise of the Axios npm package. Microsoft also flagged the s1ngularity malware, spread via trojanized Nx npm packages in August 2025, which searched infected machines for Claude Code, Gemini CLI, or Amazon Q CLI and ran them with permissive overrides, leaking roughly 2,000 secrets and 20,000 files from 225 victims.

Microsoft's prescription is the same one security teams have heard for years: phishing-resistant MFA, passkeys, tiered administration, and strict control over both human and non-human identities including AI agents. The open question is whether companies can actually deploy that at the pace Microsoft says attackers are now operating, especially with 72,000 new CVEs expected to land before the year is out.