Amazon Deploys AI Agents to Generate Offensive Techniques and Suggest Fixes

The difference that AI provides, says Amazon security engineer Michael Moran, is the power to rapidly generate new variations and combinations of offensive techniques and then propose remediations at a scale that is prohibitively time consuming for humans alone. "I get to come in with all the novel techniques and say, 'I wonder if this would work?' And now I have an entire scaffolding and a lot of the base stuff is taken care of for me" in investigating it, says Moran, who was one of the engineers who originally proposed ATA at the 2024 hackathon. "It makes my job way more fun but it also enables everything to run at machine speed." Schmidt notes, too, that ATA has already been extremely effective at looking at particular attack capabilities and generating defenses.

In one example, the system focused on Python "reverse shell" techniques, used by hackers to manipulate target devices into initiating a remote connection to the attacker's computer. Within hours, ATA had discovered new potential reverse shell tactics and proposed detections for Amazon's defense systems that proved to be 100 percent effective. ATA does its work autonomously, but it uses the "human in the loop" methodology that requires input from a real person before actually implementing changes to Amazon's security systems.

And Schmidt readily concedes that ATA is not a replacement for advanced, nuanced human security testing. Instead, he emphasizes that for the massive quantity of mundane, rote tasks involved in daily threat analysis, ATA gives human staff more time to work on complex problems. The next step, he says, is to start using ATA in real-time incident response for faster identification and remediation in actual attacks on Amazon's massive systems.