According to you all shorter because AI is simultaneously garbage propping upa bubble, so my sarcastic answer is it's slower.

That being said I know I could detect and scan, with nessus/snyk/security hub and detect the issue inside of 5 minutes. Probably another half hour to hour for a proper pen tester to send an AWS exploit package at it and own the rest within an hour or two. 

How many people do you think catch exploits in the first day or even week or month of a hack? I've got some news for you, its only the companies who really need their shit together and have a strong opssec team. They ain't going deleting buckets. They sit on it for months and years in most post mortem.

From the report that's the source of this Register article (emphasis added):

The threat actor infiltrated the victim’s environments using valid test credentials stolen from public S3 buckets. These buckets contained Retrieval-Augmented Generation (RAG) data for AI models , and the compromised credentials belonged to an Identity and Access Management (IAM) user that had multiple read and write permissions on AWS Lambda and restricted permissions on AWS Bedrock. This user was likely intentionally created by the victim organization to automate Bedrock tasks with Lambda functions across the environment.

It is also important to note that the affected S3 buckets were named using common AI tool naming conventions, which the attackers actively searched for during reconnaissance.

https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes