Google Mandiant Warns of Exposed Serverless Functions as Attack Vector
SC Media, Thursday, July 16th, 2026
Mandiant warns that unauthenticated, publicly exposed serverless functions are becoming a major cloud attack vector amid rapid AI adoption.
Google Mandiant has identified a growing threat from publicly accessible serverless applications that lack proper authentication controls.
The proliferation of AI-driven workflows such as chatbots and image generation tools has accelerated deployment of these vulnerable functions.
Attackers exploit common flaws like file inclusion and command injection for initial access, then escalate by extracting secrets and stealing service account credentials to move laterally through cloud environments.
Mandiant recommends security scanning and code review in CI/CD pipelines, sandboxing AI experimentation, and least-privilege access controls. Public-facing services should be hosted in isolated projects with restricted network traffic as part of a defense-in-depth strategy.