Datadog Security Labs releases pathrunner AWS privilege escalation framework
Original title: Introducing pathrunner: An AWS privilege escalation framework
The modular console automates more than 80 modules that take one AWS identity's credentials and obtain another's.
Datadog Security Labs released pathrunner, a cloud-native framework that automates AWS IAM privilege-escalation paths cataloged on pathfinding.cloud and used in Pathfinding Labs. An operator imports credentials, selects a module and target identity, runs the module, then imports and switches to the captured credentials. The authors say the tool is meant to show which misconfigurations are exploitable so defenders can prioritize them. As of October 2026 it has over 80 exploit modules, with multiple payloads per module for cases where one payload fails and for detection testing.
- pathfinding.cloud was released in December 2025 and Pathfinding Labs in May 2026.
- Documentation is published at pathfinding.cloud/pathrunner/.
- Identity import and identity switch were the first features built.
- A shown flow starts from user bedrock-001 and reaches a Bedrock code-interpreter role.
- Organizations
- Datadog Security Labs
From the original article
6 min read at securitylabs.datadoghq.com
Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.