Three stories today share a single thread: identity is the mechanism, not the target. An AI agent’s session credentials became the initial access vector for a worm. A broken JWT signature check turned an API gateway into an open door. And a phishing kit steals live sessions without touching a credential at all. The common denominator is that identity enforcement failures - at the agent layer, the API layer, and the authentication layer - are what attackers are actively exploiting right now.

In the News

AI Coding Assistant Hijacked - Shai-Hulud Worm Spread Across ~100 Repos

Mandiant published findings on an attack where a threat actor hijacked a live AI coding-assistant session at a SaaS provider and deployed a self-propagating worm dubbed Shai-Hulud. The worm poisoned the assistant’s recommendations, causing it to inject malicious code into pull requests across approximately 100 repositories. Along the way, it exfiltrated secrets, API keys, and source code.

The critical detail: the initial access vector was the AI agent’s own session credentials, not the developer’s. The agent had broad repository access, and its session token was the only credential the attacker needed. Once inside the agent’s context, the attacker inherited every permission the agent held - and the agent held permissions across the entire codebase.

This is a non-human identity (NHI) governance failure. The agent operated with persistent, broadly scoped credentials. No one was monitoring for anomalous agent behavior - an AI assistant suddenly modifying 100 repos in rapid succession should be a high-fidelity detection signal. Organizations running AI coding assistants need to answer three questions immediately: What credentials do your AI agents hold? What can those credentials access? And who is watching for abnormal agent behavior?

What defenders should do: Inventory all AI-agent service accounts and session credentials. Apply least-privilege scoping - agents should have read access to the repos they need and write access only through human-approved workflows. Monitor for anomalous commit velocity and cross-repo access patterns. Treat AI agent sessions as privileged non-human identities requiring the same rigor as service accounts in production infrastructure.

WSO2 API Manager JWT Bypass Enables Full Account Takeover (CVE-2026-5430)

CVE-2026-5430 (CVSS 9.8) is an improper JWT signature verification flaw in WSO2 API Manager. Attackers can forge admin-level JWT tokens without possessing any credentials. The forged token is accepted as legitimate, granting full administrative access to the API management console and every downstream API it governs.

Active exploitation is confirmed. The mechanism is straightforward: the API Manager fails to properly validate the cryptographic signature on incoming JWTs. An attacker crafts a token with admin claims, signs it with an arbitrary key (or no key at all), and the gateway accepts it. From there, the attacker controls API routing, access policies, and can exfiltrate data from every service behind the gateway.

API gateways are identity chokepoints. Every microservice behind the gateway trusts the identity assertions the gateway passes through. When the gateway itself cannot distinguish a forged token from a legitimate one, the entire downstream estate inherits the compromise.

What defenders should do: Patch WSO2 API Manager to the fixed release immediately. Audit all admin-level JWT tokens issued in the last 30 days for anomalous source IPs or claim patterns. Implement token-binding and audience-restriction controls. Monitor API management console access logs for admin sessions originating from unexpected locations. Consider deploying ZTNA controls in front of API management interfaces.

Cisco Secure Email Gateway RCE Exploited in the Wild (CVE-2026-76461)

CVE-2026-76461 (CVSS 9.8) is a parsing-logic flaw in Cisco Secure Email Gateway running AsyncOS. Unauthenticated remote attackers can execute commands as root by sending a crafted email - no authentication or user interaction required. The vulnerability triggers during message processing, meaning the gateway is exploitable simply by receiving mail.

Active exploitation is confirmed. The identity implications extend beyond the gateway itself: email gateways typically hold service-account credentials for directory integration (LDAP/Active Directory), mail-delivery authentication, and DLP policy enforcement. A root-level compromise of the gateway means the attacker inherits every integration credential the appliance uses.

What defenders should do: Patch to the fixed AsyncOS release immediately. If patching requires a maintenance window, isolate the gateway from inbound mail flow as a compensating control. Audit all service-account credentials the email gateway uses for directory integration and rotate them post-patch. Monitor for anomalous use of those service accounts during and after the patching window.

N0va Phishing Kit Bypasses MFA Without Malware

A phishing kit tracked as N0va is targeting US and EU organizations by impersonating trusted services and proxying victims through legitimate authentication flows. Victims enter credentials and complete MFA challenges on what appears to be a real login page. The kit intercepts the resulting session token in real time. No malware is deployed - the stolen session is the payload.

This is another real-time proxy attack in the lineage of EvilProxy and Evilginx. Push-based MFA, SMS OTPs, and TOTP codes are all vulnerable because the attacker relays them to the real identity provider before they expire. The only authentication method that defeats this class of attack is phishing-resistant passwordless authentication using FIDO2, which binds the credential to the legitimate origin domain - the proxy gets nothing usable.

What defenders should do: Deploy FIDO2-based phishing-resistant passwordless authentication. Monitor for anomalous session-token usage - logins from unexpected geolocations, device fingerprints, or ASNs immediately following a legitimate authentication event. Implement session-token binding where supported by identity providers.

Today’s Deep Dive - AI Agent Identity Is Now an Active Attack Surface

The Shai-Hulud incident is not an isolated case. It represents the operational reality of a risk category that identity teams have been discussing theoretically for the past 18 months: non-human identity compromise through AI agents.

Traditional NHI governance focused on service accounts, API keys, and machine certificates - credentials with well-understood lifecycle patterns. AI coding assistants introduce a new class of NHI with characteristics that amplify risk. They hold broadly scoped credentials (often full repository access). They execute autonomously or semi-autonomously. Their behavior patterns are unpredictable by design - the same agent might touch one file or one hundred depending on the prompt. And their session tokens are often long-lived to maintain context across multi-step tasks.

The attack pattern Mandiant documented maps to several MITRE ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004) for the initial session hijack, Supply Chain Compromise: Compromise Software Supply Chain (T1195.002) for the poisoned code injection, and Automated Collection (T1119) for the secret exfiltration. The critical observation is that the attacker did not need to escalate privileges - the agent’s existing permissions were sufficient for the entire attack chain.

GitGuardian’s new AI-agent credential inventory and Unit 42’s behavioral-clustering model for cloud identities both address aspects of this problem from different angles - credential visibility and behavioral detection, respectively. The gap that remains is real-time enforcement: the ability to interrupt an AI agent session when its behavior deviates from its expected pattern, the same way PAM solutions interrupt human privileged sessions.

Primary countermeasures for AI agent identity risk:

  1. Inventory - Know which AI agents hold credentials, what those credentials can access, and what autonomy level each agent operates at.
  2. Least privilege - Scope agent credentials to the minimum access required for the current task. Prefer short-lived, task-scoped tokens over persistent broad-access credentials.
  3. Behavioral monitoring - Baseline normal agent activity (commit velocity, repo access patterns, API call frequency) and alert on deviations.
  4. Session governance - Implement session timeouts and re-authentication requirements for AI agent sessions, just as you would for human privileged sessions.

Detection Spotlight

The following Splunk SPL query detects anomalous cross-repository commit activity from service accounts or AI agent identities in GitHub audit logs - the behavioral pattern exhibited by the Shai-Hulud worm:

index=github_audit sourcetype="github:audit"
action="git.push"
actor_type="Bot" OR actor_type="OAuth App" OR actor_type="GitHub App"
| bin _time span=15m
| stats dc(repo) as repo_count values(repo) as repos by actor _time
| where repo_count > 10
| sort -repo_count

This query buckets push events into 15-minute windows and flags any bot, OAuth app, or GitHub App identity that pushes to more than 10 distinct repositories within a single window. Legitimate CI/CD bots typically push to a small, consistent set of repos. An agent pushing to 10+ repos in 15 minutes is a high-fidelity anomaly. False positive rate is low in environments where CI/CD bot access is properly scoped - tune the threshold based on your largest legitimate bot’s normal behavior.

Defender Action Items

  • WSO2 API Manager: Patch CVE-2026-5430 immediately. Audit admin JWT tokens issued in the last 30 days. Implement audience-restriction and token-binding controls.
  • Cisco Secure Email Gateway: Patch CVE-2026-76461 to the fixed AsyncOS release. Rotate all service-account credentials used for directory integration. If unable to patch immediately, isolate the gateway from inbound mail flow.
  • AI agent credentials: Inventory all AI coding-assistant service accounts. Apply least-privilege scoping. Monitor for anomalous cross-repo activity patterns.
  • N0va phishing: Deploy FIDO2-based phishing-resistant passwordless authentication. Monitor for session-token anomalies post-authentication.
  • Acronis cPanel plugin: Patch CVE-2026-87886. Audit file permissions on backup directories in hosting environments.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.