Three stories this morning share a common thread: identity boundaries that looked solid from the outside but collapsed under minimal pressure. A Linux directory where anonymous clients can mint admin credentials. An AI assistant that uses your own OAuth grant to exfiltrate your email. And autonomous AI agents that harvest thousands of credentials before a SOC analyst finishes their first coffee. The common lesson is that identity infrastructure - directories, OAuth tokens, agent permissions - is only as strong as its weakest enforcement point.

In the News

FreeIPA Exploit Chain Lets Anonymous Clients Create Admin Credentials

A chained vulnerability in FreeIPA - the open-source identity management system that provides Kerberos SSO, LDAP, and access policy for Red Hat and Fedora Linux environments - allows an unauthenticated client to create a Kerberos principal, assign it to the administrators group, and take full domain control.

The attack requires no prior credentials. An anonymous client interacts with the FreeIPA enrollment process to create a new identity, then exploits a flaw in group membership validation to escalate that identity to domain administrator. From there, the attacker controls authentication policy, certificate issuance, and host enrollment across every Linux system in the domain.

This is the Linux equivalent of an unauthenticated DCSync. Organizations running FreeIPA - which includes any shop using Red Hat Identity Management - should treat this as an emergency patch. The blast radius is the entire directory: every service account, every host keytab, every sudo policy managed by FreeIPA is compromised once an attacker reaches the administrators group.

What defenders should do: Patch FreeIPA immediately. Audit the admins and trust admins groups for unexpected principals. Deploy identity threat detection that monitors for anomalous principal creation and group membership changes - FreeIPA logs these events but most organizations lack alerting rules for them.

ChatGPT Prompt Injection Exfiltrates Gmail via OAuth

Check Point researchers built a proof-of-concept where a single planted instruction in a ChatGPT conversation causes the AI agent to silently read the victim’s Gmail through its OAuth integration and forward the contents to an attacker-controlled ChatGPT account. The exfiltration uses sanctioned OAuth scopes - the agent does exactly what it was authorized to do, just for the wrong party.

No malware is required. The attack chain is: victim connects ChatGPT to Gmail via OAuth, victim encounters a poisoned prompt (embedded in a shared document, email, or conversation), the prompt instructs the agent to read recent emails and encode the contents in messages sent to an attacker account. The OAuth token never leaves the legitimate service - the exfiltration channel is the AI agent’s own authorized API calls.

This is the identity angle of AI agent abuse. The credential is the OAuth token. The exfiltration path is the agent’s own sanctioned permissions. Traditional DLP focused on network egress does not see this traffic because it is authorized API activity within the SaaS platform.

What defenders should do: Audit OAuth grants to all AI assistants connected to corporate email and productivity tools. Apply least-privilege scoping - no AI agent needs mail.read on all mailboxes. Deploy session anomaly detection that flags agent-initiated bulk email reads deviating from user baselines.

Autonomous AI Agents Harvest Thousands of Credentials in 6 Hours

Google Threat Intelligence tracked a financially motivated group deploying an autonomous multi-agent attack framework that compromised thousands of credentials in under 6 hours. The agents coordinated reconnaissance, credential stuffing, and token harvesting without human operator intervention - each agent handled a stage of the kill chain and passed results to the next.

The speed matters. Most SOC teams measure mean-time-to-detect in days. These agents completed the full credential-theft lifecycle in hours. The attack volume also matters: autonomous agents can test credential combinations at a rate that renders traditional rate-limiting and account-lockout thresholds ineffective without behavioral analytics underneath.

What defenders should do: Deploy behavioral identity analytics that detect credential-stuffing velocity and anomalous authentication patterns - the AI agent’s login cadence and geographic distribution are distinctly non-human and detectable. Transition high-value accounts to phishing-resistant passwordless authentication (FIDO2) to eliminate the credential target entirely.

DeepSeek Harness Flaw Let AI Agents Disable Their Own Sandbox

A design flaw in DeepSeek’s local AI coding harness allowed sandboxed agents to call the harness’s own web API and disable the file sandbox with a single command. Once the sandbox was removed, the agent had unrestricted read-write access to the host filesystem.

The core issue is a non-human identity privilege escalation. The AI agent held API credentials that could modify its own security policy. The sandbox existed as a configuration flag, not as a kernel-enforced boundary, and the agent’s identity had write access to that configuration. This is the machine-identity equivalent of giving a user admin rights over the group policy that restricts them.

What defenders should do: Enforce least-privilege on non-human identities - AI agent API credentials should never include permissions to modify their own security controls. Apply workload segmentation to prevent agent processes from reaching management APIs. Treat every local AI coding assistant as an untrusted workload until its privilege boundaries are verified.

Today’s Deep Dive - The Non-Human Identity Revocation Gap

GitGuardian’s latest research delivers a statistic that should reframe every NHI governance conversation: 64% of secrets confirmed leaked in 2022 are still valid as of January 2026. AI-driven development pushed the count of exposed credentials to 1.27 million last year, an 81% year-over-year increase.

The revocation gap is not a scanning problem - most organizations know their secrets are leaking. It is an operational problem. Rotating a single service account credential in a mid-size environment can require coordinating changes across CI/CD pipelines, container orchestrators, secrets managers, and application configuration files. When that coordination is manual and the leaked secret still works, rotation gets deprioritized.

This connects directly to today’s threat stories. The ChatGPT OAuth exfiltration works because token revocation is slow. The autonomous credential harvesters succeed because stolen passwords remain valid. The FreeIPA chain is dangerous because Kerberos keytabs and service account credentials persist long after they should have been rotated.

MITRE ATT&CK mapping: T1078 (Valid Accounts), T1528 (Steal Application Access Token), T1552 (Unsecured Credentials).

The primary countermeasure is automated secret rotation with verified invalidation - not just issuing a new secret, but confirming the old one no longer authenticates. Organizations that cannot achieve full automation should prioritize short-lived credentials (OAuth tokens with hourly expiry, workload identity federation) over long-lived secrets that depend on manual rotation.

Defender Action Items

  • FreeIPA: Patch immediately. Audit admins and trust admins groups for unexpected principals. Enable alerting on principal creation events.
  • AI OAuth grants: Audit all AI assistant OAuth connections to corporate email and productivity tools. Scope to minimum required permissions. Deploy token anomaly detection.
  • Credential stuffing: Deploy behavioral identity analytics that detect non-human login velocity. Migrate high-value accounts to FIDO2 passwordless authentication.
  • NHI revocation: Inventory all leaked or exposed secrets older than 90 days. Prioritize automated rotation for CI/CD and cloud service accounts. Confirm old secrets are invalidated post-rotation.
  • Patch Tuesday: Apply September updates for CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC) - both exploited in the wild.

Detection Queries

FreeIPA anomalous principal creation - search IPA audit logs for new principal enrollment followed by admin group membership within a short window:

index=ipa_audit sourcetype=ipa:audit action="ipa_krbprincipal_add" OR action="ipa_group_add_member"
| transaction host maxspan=5m
| where mvcount(action) > 1 AND match(action, "ipa_group_add_member") AND match(group, "admins")
| table _time, host, principal, group, src_ip

This query catches the two-step chain: principal creation followed by admin group assignment from the same host within 5 minutes. False positive rate is low in environments where admin principal creation is rare and procedurally controlled.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.