FIDO2 cryptography remains unbroken. The 39 implementation gaps around it - in enrollment, recovery, sync, and prompt workflows - are where attackers actually operate. That tension between protocol strength and deployment reality defines today’s identity security landscape, and it runs through every story in this brief: from a privilege-escalation zero-day inside an endpoint security agent, to a supply-chain attack that turned infrastructure-as-code into a credential-harvesting platform, to AI coding agents whose execution identity is trivially hijackable.

In the News

39 Attack Methods Bypass Passkey Implementations Without Breaking FIDO2 Crypto

Researchers at Token published a systematic analysis of 39 distinct attack paths against real-world passkey deployments. The research is significant because it arrives precisely when enterprises are rolling passkeys out at scale - replacing passwords with FIDO2-backed credentials and treating the migration as a security upgrade. It is a security upgrade. But the upgrade only holds when the surrounding workflows are hardened.

The 39 methods cluster into four trust-boundary categories: enrollment-flow manipulation (registering an attacker-controlled credential to a victim’s account), account-recovery abuse (leveraging weaker recovery channels to bypass the passkey entirely), synced-credential exploitation (attacking the credential-sync mechanism between devices to extract or clone keys), and authentication-prompt manipulation (social engineering or UI-redress attacks against the authentication ceremony itself). None of these require breaking the FIDO2 cryptographic protocol. All of them exploit the gap between what FIDO2 guarantees and what a deployment actually enforces.

For defenders, the immediate action is to audit passkey enrollment and recovery flows. Does your enrollment process bind the credential to a verified identity through a channel that is itself phishing-resistant? Does your recovery flow fall back to SMS or email OTP - effectively re-introducing the weakness passkeys were meant to eliminate? If synced credentials are enabled, is attestation enforced to ensure keys are only synced to trusted platforms? These are the questions this research forces.

What defenders should do: Audit enrollment binding (is the initial identity verification itself phishing-resistant?), eliminate weak recovery fallbacks (SMS/email OTP), enforce platform attestation for synced credentials, and deploy identity threat detection to catch anomalous enrollment and recovery events.

CrowdStrike Falcon Zero-Day Grants SYSTEM Privileges - PoC Public, No Patch

A publicly available proof-of-concept exploit dubbed “FalconFlank” targets CrowdStrike Falcon’s Office macro-remediation logic to escalate privileges to SYSTEM on Windows endpoints. The attack requires local access - an attacker already on the box - but can be triggered by any process that invokes the vulnerable remediation path. Post-initial-access toolkits can chain it trivially.

The identity implications are direct. Endpoint security agents run with the highest privileges on the system. When an agent’s own remediation logic becomes an escalation vector, the trust model inverts: the security tool becomes the privilege-granting mechanism. This is the class of attack that identity threat detection and response (ITDR) is built to catch - anomalous SYSTEM-level activity originating from unexpected process chains, regardless of which agent initiated it.

CrowdStrike has not released a patch. Organizations running Falcon should monitor for unusual child-process chains spawned by the Falcon remediation service and correlate SYSTEM-level process creation events against expected remediation baselines.

What defenders should do: Monitor for anomalous SYSTEM-level process creation originating from Falcon remediation services. Deploy ITDR to detect privilege-escalation patterns independent of any single endpoint agent. Watch CrowdStrike advisories for the patch.

Coder’s Terraform Registry Compromised - Malicious Modules Stole Credentials

Attackers compromised Coder’s Cloudflare infrastructure and injected rogue registry servers that served malicious Terraform modules. The modules exfiltrated credentials - cloud provider keys, service-account tokens, and API secrets - from any pipeline that pulled from the poisoned registry.

This attack inverts the typical supply-chain compromise. Instead of poisoning application dependencies (the npm/PyPI pattern), the attackers poisoned infrastructure-as-code tooling - the layer that provisions cloud resources, configures identity providers, and manages secrets-management infrastructure itself. The payload was non-human identities: service-account credentials, API keys, and cloud provider tokens that grant persistent, often over-privileged access to production environments.

The blast radius of a stolen service-account credential depends entirely on what that credential can reach. Organizations that practice least-privilege for non-human identities, rotate credentials automatically, and segment workloads at the network layer contain the damage. Organizations that rely on long-lived, broadly-scoped service-account keys - the industry default - face lateral movement across every resource that key can access.

What defenders should do: Audit all Terraform modules pulled from Coder’s registry during the compromise window. Rotate all credentials accessible to affected pipelines. Implement secrets-management tooling that enforces short-lived, narrowly-scoped credentials for IaC pipelines. Deploy workload segmentation to limit lateral movement from compromised service accounts.

Malicious Git Configs Hijack AI Coding Agents - 4 of 8 Flaws Unpatched

Manifold Security disclosed eight vulnerabilities across seven AI coding agents - Claude, Cursor, Codex, and four others - where a repository’s .git/config can specify arbitrary commands the agent executes as the user. No sandbox. No prompt. No confirmation dialog. The agent runs the attacker’s payload with whatever credentials, tokens, and file-system access the agent’s process holds.

Four of the eight flaws remain unpatched. The attack surface is the AI agent’s execution identity - a non-human identity that typically inherits the developer’s full access context: SSH keys, cloud credentials in ~/.aws/credentials, Git tokens, and often broad file-system read/write. This is the same class of over-privileged service-account problem that plagues CI/CD pipelines, now replicated in every developer workstation running an AI coding assistant.

What defenders should do: Treat AI coding agent execution contexts as privileged non-human identities. Scope their credentials to minimum required access. Isolate agent runtimes from production credential stores. Monitor for anomalous API calls and file-system access originating from agent processes.

Defender Action Items

  • Passkey deployments: Audit enrollment binding, eliminate SMS/email OTP recovery fallbacks, enforce platform attestation for synced credentials, deploy identity threat detection on enrollment and recovery events.
  • CrowdStrike Falcon: Monitor SYSTEM-level process creation from Falcon remediation services, deploy ITDR for agent-independent privilege-escalation detection, watch for patch release.
  • Terraform/IaC pipelines: Rotate all credentials accessible to pipelines that pulled from Coder’s registry during the compromise window. Enforce short-lived, narrowly-scoped NHI credentials for IaC.
  • AI coding agents: Isolate agent runtimes from production credential stores. Scope agent credentials to minimum access. Monitor agent-originated API calls.
  • JFrog Artifactory (CVE-2026-82329): Patch immediately - CVSS 9.8 authentication bypass to admin, actively exploited. Rotate all credentials stored in or accessed through Artifactory.
  • Chrome (CVE-2026-85046): Update immediately - actively exploited V8 type-confusion bug.

Detection Queries

Detect anomalous passkey enrollment events - specifically, multiple WebAuthn credential registrations to a single account within a short window, which may indicate enrollment-flow abuse. This KQL query targets Entra ID audit logs:

SigninLogs
| where AuthenticationDetails has "fido2" or AuthenticationDetails has "passkey"
| where ResultType == 0
| summarize EnrollmentCount = dcount(CorrelationId), 
            DistinctDevices = dcount(DeviceDetail_deviceId),
            FirstSeen = min(TimeGenerated), 
            LastSeen = max(TimeGenerated)
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where EnrollmentCount > 2 or DistinctDevices > 2
| project UserPrincipalName, EnrollmentCount, DistinctDevices, FirstSeen, LastSeen

This surfaces accounts registering multiple FIDO2 credentials within a single hour - a pattern consistent with enrollment-flow manipulation. Expect a low false-positive rate in environments where passkey enrollment is gated by IT workflow; adjust the threshold upward for self-service enrollment environments.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security - NHI, ITDR, and the IAM market.