Datadog Report Reveals Alarming Fourfold Increase in Cloud Vulnerabilities and Widespread Use of Long-Lived AI Access Keys

Datadog's "State of Cloud Security 2026" report, published today, reveals a significant deterioration in cloud security. The median number of high or critical vulnerabilities in cloud services has quadrupled, rising from four in February 2026 to approximately 16 in November 2026. This alarming increase is compounded by the widespread use of long-lived AI access keys, with nearly half of organizations using Google Gemini relying on such keys, and 17% of Amazon Bedrock users doing the same. These persistent credentials present a substantial risk, as they can remain valid indefinitely until explicitly revoked, offering attackers prolonged access post-compromise. This report is critical for DevSecOps professionals because it highlights the expanding attack surface driven by increasingly complex software supply chains and the rapid adoption of AI services. The sheer volume of new vulnerabilities means that traditional, reactive security measures are no longer sufficient. The prevalence of long-lived AI keys creates a significant lateral movement risk; a compromised key can grant attackers deep access into interconnected systems, far beyond the initial point of entry. This directly impacts organizations integrating AI tools into their internal systems and customer-facing applications, as these keys become prime targets for exploitation. This trend aligns with broader industry shifts towards cloud-native development and the pervasive integration of AI. As organizations leverage more managed services and third-party libraries, the software supply chain becomes a critical vector for attacks. The report notes that cloud workloads depend on an average of 149 software packages, with over half being indirect dependencies. This mirrors the growing emphasis on software supply chain security, as seen with initiatives around SBOMs and dependency management. The convenience of deploying AI services with long-lived keys often outweighs the security implications in practice, a trade-off that attackers are clearly exploiting. In practice, DevSecOps teams must prioritize the immediate rotation and lifecycle management of all AI access keys, favoring temporary credentials wherever possible. Implementing robust secrets management solutions and integrating automated credential scanning into CI/CD pipelines is no longer optional. Furthermore, organizations should enhance their software composition analysis (SCA) capabilities to gain deeper visibility into both direct and indirect dependencies, actively monitoring for newly disclosed vulnerabilities. The report implicitly calls for a shift from a perimeter-focused security model to one that emphasizes identity and access management, especially for non-human identities like AI agents. Practitioners should also invest in observability tools that can provide a holistic view of their cloud environment to detect and respond to suspicious activity related to AI service access.