Native · Zealot attack chain, replayed

An AI support agent at work in your cloud

Zealot attack chain vs. Native

Where Native’s prevention breaks the chain

NATIVE BLOCKEDNOT PREVENTED

Phase 1 · Reconnaissance

Scan from the internet, find an exposed app + open ports

Phase 2 · Initial access

SSRF to metadata service, steal SA token

Attacker now holds a valid token. Impact depends only on what that token is allowed to do.

Phase 3 · Cloud enumeration

List IAM perms, map the zone’s apps, target customer data

Phase 4 · Escalate + exfiltrate

Create bucket, export table, self-grant admin, exfiltrate, then move to other zones. Every step is a control-plane action.

Modelled on Unit 42’s Zealot research (April 2026), a proof-of-concept AI agent run in a deliberately misconfigured Google Cloud test environment, replayed on an illustrative enterprise cloud: entry from the internet, one multi-app zone taken over, then lateral movement. “With Native” shows how Native’s controls apply to the same chain. Numbers are enforcement mechanisms per policy across AWS, Azure, GCP and OCI (September 2026).