Datadog claims cloud high/critical flaws rose fourfold since May
Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependency
- Published
- Exploitation
- No, the report describes vulnerability counts and credential practices, and no specific exploitation of a named flaw is stated in the source.
What happened
Infosecurity Magazine reports that Datadog has claimed the median number of high or critical vulnerabilities in cloud workloads increased fourfold between May and November 2026, and attributes this to the impact of frontier AI Infosecurity Magazine. The figures come from Datadog’s State of Cloud Security 2026, which the outlet says was published on November 10 and is based on the cloud security posture of thousands of customer organizations Infosecurity Magazine.
According to Datadog, as relayed by Infosecurity Magazine, the median rose from four in May, when Anthropic’s Mythos model was released, to 14 in June and 16 in November. The data came from vulnerabilities in third-party libraries used by applications monitored through Datadog Code Security’s Software Composition Analysis feature Infosecurity Magazine.
Other findings Datadog reports, per the same article:
- Nearly half of organizations using Gemini use long-lived Gemini API keys.
- Nearly 30% of AWS IAM and Google Cloud Service Account users have access keys older than three years.
- 60% of organizations analyzed run dependency versions released less than 24 hours earlier, and those versions appear in 21% of cloud applications.
- Cloud app workloads have on average 149 software dependencies, and the average organization has 568.
Not confirmed: the source is a single outlet relaying a vendor’s own report. It does not describe the methodology in detail, and there is no independent verification. The causal link to frontier AI is Datadog’s claim. No specific CVE, product, or affected version is named.
Am I affected?
The source does not identify a specific product or version. Based on what Datadog reports, the areas it highlights are:
- Cloud workloads that rely on third-party libraries, where Datadog says high/critical flaw counts have risen.
- Long-lived credentials, particularly for cloud-hosted AI inference services and CI/CD pipelines Infosecurity Magazine.
- Environments that adopt new dependency versions automatically without vetting.
Whether your own environment matches these medians is not confirmed by the source; check your own inventory.
What to do now
- Inventory long-lived credentials, including access keys, Gemini API keys and Bedrock API keys, and note which are old or over-permissioned. Datadog says such credentials are consistently ranked among the most common causes of cloud breaches Infosecurity Magazine.
- Where supported, access AI inference services through the calling workload’s short-lived identity (IAM role, managed identity or service account) rather than a separate static key, as Datadog recommends Infosecurity Magazine.
- Consider dependency cooldowns before new package versions reach your cloud environments. Datadog’s report says the community usually identifies and contains hijacked libraries within a few hours Infosecurity Magazine.
- Review the vulnerabilities in your own third-party libraries using your software composition analysis tooling. The source gives no further remediation detail.