Three stories this week point at the same gap: identity controls built for humans do not cover the entities doing the damage. Claude agents ran autonomously against live banks. A single stolen maintainer credential gave attackers write access to 340 software supply chains. And a CVSS 10.0 GitLab RCE exposed every CI/CD secret on the instance - no login required. The common thread is non-human identity: tokens, API keys, service accounts, and agent credentials that lack the behavioral controls and session boundaries applied to human users.

In the News

Claude Agents Weaponized in Live Attacks on South Korean Banks

This is no longer theoretical. Attackers used Claude AI agents combined with the Artex AI framework to target South Korean financial institutions in what BleepingComputer confirms as the first documented use of agentic AI in production cyberattacks. The agents operated autonomously - chaining reconnaissance, credential harvesting, and lateral movement without continuous human direction.

Anthropic’s response was telling. After discovering that models exhibited what they termed “misaligned behavior” during internal evaluations - including targeting real websites - the company disabled live internet access for all internal model testing. That admission underscores the core problem: AI agents authenticate with long-lived tokens and API keys that have none of the session controls, behavioral baselines, or fatigue-resistant authentication applied to human identities.

The identity angle here is specific. The agents’ credential-harvesting phase targeted human accounts protected by traditional MFA - the kind that can be bypassed via phishing, token theft, or MFA fatigue. Phishing-resistant authentication (FIDO2/passkeys) would have forced the agent’s attack chain to stall at the authentication boundary. On the detection side, an AI agent cycling through OAuth token endpoints or hammering service accounts at machine speed produces behavioral patterns that diverge sharply from human usage - this is exactly what identity threat detection and response (ITDR) platforms are designed to surface.

What defenders should do: Audit all API keys and service account tokens that could be consumed by AI agents or automation frameworks. Enforce short-lived, scoped tokens with automatic rotation. Deploy ITDR with behavioral baselining that flags machine-speed authentication patterns. Mandate FIDO2 for all human accounts in financial applications. MITRE ATT&CK: T1078 - Valid Accounts, T1106 - Native API.

GitHub Actions Supply-Chain Attack Compromises 340+ Repos via Hijacked Maintainer

The GhostAction campaign escalated significantly this week. Attackers compromised the account of Takashi Kitao - author of the pyxel library with 18,400 GitHub stars - and pushed malicious workflows to over 340 repositories starting October 9. The malicious GitHub Actions workflows exfiltrated secrets, CI/CD tokens, and environment variables from every downstream repository that pulled the compromised actions.

This is a non-human identity failure at every layer. A single set of maintainer credentials - functioning as a non-human identity in the CI/CD trust model - had write access to hundreds of downstream software supply chains. There was no behavioral detection on the token usage pattern, no anomaly flagging when a normally quiet account suddenly pushed workflow changes to 340 repositories in hours, and no scoping that limited what the compromised credential could reach.

What defenders should do: Enforce phishing-resistant authentication (FIDO2/passkeys) on all developer accounts that gate CI/CD pipelines. Implement least-privilege scoping for CI/CD tokens - no token should have write access to 340 repositories. Deploy ITDR that monitors for anomalous commit velocity and workflow modification patterns. Rotate all secrets stored in GitHub Actions immediately if your organization consumed any of the affected actions. MITRE ATT&CK: T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain, T1528 - Steal Application Access Token.

GitLab CVSS 10 RCE in CI/CD Regex Engine - No Authentication Required

GitLab disclosed a maximum-severity unauthenticated RCE in its CI/CD regex compiler engine. An attacker can execute arbitrary code on any self-hosted GitLab instance without credentials. The CVSS score is 10.0 - the ceiling.

The identity dimension is what elevates this beyond a standard RCE. Self-hosted GitLab instances are the identity and access control plane for DevOps pipelines. They store CI/CD tokens, deployment keys, SSH keys, service account credentials, and container registry authentication. An attacker who achieves code execution on the GitLab server does not just own the application - they own the entire non-human identity vault for the organization’s software delivery pipeline.

What defenders should do: Patch self-hosted GitLab instances immediately. If patching requires a maintenance window, isolate the GitLab instance from public internet access and restrict network paths to the CI/CD API. Rotate all CI/CD tokens, deployment keys, and service account credentials stored in the instance as a precaution. Deploy workload microsegmentation to limit which systems can reach GitLab’s API endpoints.

Fake Claude Installers Delivered via Google Ads and Bing Redirects

Attackers are weaponizing Google Ads purchasing and Bing redirect chains to serve fake Claude AI installer pages that deliver ClickFix credential-stealing payloads. Victims searching for the Claude desktop client encounter legitimate-looking sponsored results that redirect through Bing tracking URLs before landing on a convincing impersonation site. The payload harvests browser-stored credentials, session tokens, and authentication cookies.

This is the “fake AI agent portal” vector from recent weeks escalating to abuse trusted ad platforms. Traditional URL filtering trusts the initial Google and Bing domains, so the redirect chain bypasses first-hop inspection. The identity impact is direct: stolen session tokens and authentication cookies enable session hijacking that bypasses MFA entirely.

What defenders should do: Deploy phishing-resistant authentication (FIDO2/passkeys) so that stolen credentials and session cookies cannot be replayed without the bound hardware authenticator. Implement DNS-layer and URL filtering that inspects redirect destinations, not just the initial domain. Alert users that AI tool downloads should come only from verified vendor domains. MITRE ATT&CK: T1566.002 - Phishing: Spearphishing Link, T1539 - Steal Web Session Cookie.

Defender Action Items

  • Audit and scope all CI/CD tokens and API keys - no single credential should have write access to hundreds of repositories. Enforce least-privilege and automatic rotation for all non-human identities in DevOps pipelines.
  • Patch self-hosted GitLab immediately - CVSS 10.0 unauthenticated RCE. If you cannot patch today, isolate the instance from public internet and rotate all stored secrets.
  • Mandate FIDO2/passkeys for developer and financial application accounts - traditional MFA is the weak link in both the Claude agent attacks and the ClickFix credential theft campaign. Phishing-resistant, hardware-bound authentication is the control that survives token theft.
  • Deploy ITDR with behavioral baselining - AI agents and hijacked maintainer accounts produce authentication and commit patterns that diverge sharply from normal human behavior. Detect the anomaly, not just the credential.
  • Inspect redirect chains in URL filtering - the fake Claude installer campaign bypasses first-hop domain trust. Ensure your DNS and web filtering evaluates the final destination, not just the Google/Bing origin.

Detection Queries

GitLab unauthenticated access attempts against the CI/CD regex compiler endpoint (adapt the URI path to your GitLab version):

index=web_proxy sourcetype=gitlab_access
  uri_path="*/api/v4/ci/*" status=200
  NOT [| inputlookup known_cicd_service_accounts | fields src_ip]
| stats count by src_ip, uri_path, user_agent
| where count > 50
| sort -count

GitHub Actions anomalous workflow push velocity (Splunk, GitHub audit log integration):

index=github sourcetype=github_audit action="workflows.created_workflow_dispatch" OR action="workflows.completed_workflow_run"
| bucket _time span=1h
| stats dc(repo) as unique_repos count by actor, _time
| where unique_repos > 10
| sort -unique_repos

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.