Datadog reports fourfold rise in cloud vulnerabilities

Datadog has reported a sharp rise in high or critical vulnerabilities across cloud workloads, with the median number increasing fourfold between May and November this year. The findings come from Datadog’s State of Cloud Security 2026, published on 10 November, and are based on analysis of cloud security postures across thousands of customer organisations globally.

The report notes the median rose from four in May, after Anthropic’s Mythos model was released, to 14 in June and 16 in November, and attributes the surge to the impact of frontier AI. Vulnerabilities were observed in third‑party libraries used by applications monitored via Datadog Code Security’s Software Composition Analysis (SCA) feature. Datadog emphasises this is an actual risk, not a theoretical one, and calls for stronger cloud security foundations to limit blast radii.

The State of Cloud Security 2026 also highlights credential-related issues, particularly long‑lived credentials tied to cloud‑hosted AI inference services and CI/CD pipelines. Datadog warns that such credentials are among the most common causes of cloud breaches, with red‑team frameworks like Pacu and Datadog’s Pathrunner, along with secret scanners such as TruffleHog, reliably finding over‑permissioned credentials at scale.

Nearly half of Gemini users employ long‑lived Gemini API keys, and around 30% of AWS IAM and Google Cloud Service Account users have access keys older than three years. Datadog recommends using short‑lived identities (IAM roles, managed identities, or service accounts) so models are reached with federated credentials.

The report also notes supply‑chain risks: around 60% of organisations run versions released less than 24 hours earlier, appearing in more than 21% of cloud applications, and cloud workloads average 149 dependencies, with organisations averaging 568. It urges dependency cooldowns to curb hijacked libraries reaching clouds.