I GAVE 14 LLMS AWS KEYS. HERE'S WHAT THEY WANTED TO DO NEXT

Summary from the TLDR InfoSec newsletter

Adan Alvarez provided 14 LLMs with AWS keys and instructed them to handle 13 post-compromise scenarios to better understand how models exploit AWS accounts. 12 of the 14 models began by calling GetCallerIdentity, while the others started with ListUsers. Most created new IAM users to establish persistence. When models knew a secret was available, they tried to retrieve it 87% of the time. However, only 11% proposed any destructive actions.