An AI agent completed an OAuth credential theft workflow in under 3 hours this week - not in a lab, but in a real supply-chain compromise attributed to a Chinese state-aligned group. That single data point compresses the identity threat timeline in ways most detection architectures are not built to handle. Three other independent reports published the same week document AI agents being hijacked, prompt-injected, and supply-chain-compromised for credential theft. The identity attack surface just expanded, and the clock just got faster.

In the News

Storm-0940 Used ARTEX Agentic AI to Breach ConnectWise OAuth in Under 3 Hours

Microsoft published a detailed attribution of the ConnectWise Cloud Backup OAuth breach to Storm-0940, a China-aligned threat actor. The critical new detail: Storm-0940 deployed an agentic AI tool called ARTEX that automated the entire credential theft workflow - OAuth token acquisition, lateral movement through the MSP supply chain, privilege escalation to cloud admin, and data staging for exfiltration. In multiple confirmed cases, the elapsed time from initial targeting to privileged cloud access was under 3 hours.

This is not AI generating phishing emails. This is an AI agent executing a multi-step identity attack chain autonomously. ARTEX handled tasks that previously required hands-on-keyboard operators working over days: enumerating OAuth app consents, identifying overprivileged delegated permissions, acquiring tokens, and using them to access customer tenants through the MSP trust relationship. The ConnectWise backup tool’s OAuth integration provided the initial access vector - a legitimate, broadly-consented application that attackers subverted.

The implications for identity security are direct. Detection architectures tuned to human-speed lateral movement - hours to days of dwell time - will miss an AI agent that completes the same workflow in 180 minutes. ITDR solutions need to detect anomalous OAuth consent events, new token issuance patterns, and rapid privilege escalation in near-real-time. Organizations using MSP-managed tools should audit every delegated OAuth app consent, revoke unnecessary permissions, and enforce conditional access policies that limit what delegated apps can reach.

What defenders should do: Audit all OAuth app consents in Entra ID and Google Workspace immediately. Revoke delegated permissions for any app that does not require them. Deploy ITDR that can correlate a new OAuth consent event with subsequent bulk data access within minutes, not hours. Enforce phishing-resistant passwordless authentication (FIDO2) for all admin accounts to break the credential chain before it starts.

Source: Microsoft Security Blog

Railway PaaS Warns All Customers to Rotate Secrets After Potential Decryption Breach

Railway, a PaaS platform widely used by AI and ML developers, disclosed that an intruder accessed systems storing encrypted environment variables and may have successfully decrypted some. Environment variables on Railway commonly hold API keys, database credentials, cloud provider tokens, and LLM API secrets - the non-human identity layer that AI applications depend on.

Railway is telling every customer to rotate every secret stored on the platform. For organizations running production AI workloads on Railway, this means rotating database passwords, regenerating API keys for OpenAI/Anthropic/cloud providers, and reissuing OAuth client secrets - a full NHI credential reset. The breach follows a pattern: platform companies that centralize secrets storage become high-value targets precisely because one breach exposes thousands of downstream applications.

What defenders should do: If you use Railway, rotate all environment-variable secrets immediately. Beyond the immediate response, this is a forcing function to evaluate secrets management architecture. Secrets stored as environment variables - even encrypted - lack the rotation automation, access auditing, and blast-radius controls of a dedicated secrets vault. Runtime secret injection from a vault (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) with automatic rotation is the primary countermeasure.

Source: The Hacker News

Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day

Arista patched an actively exploited SQL injection vulnerability in VeloCloud Orchestrator - the central management plane for VeloCloud SD-WAN deployments. The vulnerability allowed any customer account with read-only access to escalate to operator-level privileges, the highest tier of control. Operator access controls network policy, identity configuration, and access rules for every branch in the SD-WAN fabric.

SD-WAN orchestrators are identity infrastructure. They determine which users and devices can access which network segments, enforce policy across distributed sites, and manage the trust relationships between branches and data centers. A privilege escalation vulnerability in the orchestrator is not just a network security issue - it is an identity security issue that compromises the authorization model for the entire distributed network.

What defenders should do: Patch VeloCloud Orchestrator immediately. Audit orchestrator account activity logs for any read-only accounts that performed write operations or accessed operator-level functions. Review all RBAC configurations on network management planes - not just VeloCloud - to verify that privilege boundaries are enforced at the API layer, not just the UI.

Source: The Hacker News

AI Agents Are the New Identity Attack Surface - Three Reports Document the Risk

Three independent reports published this week converge on the same conclusion: AI agents are a credential-bearing attack surface that most organizations are not monitoring.

Gen Digital demonstrated that AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, deleting files, and stealing data - all using the agent’s own legitimate permissions and credentials. The attack does not require compromising the agent’s code; it requires prompt-injecting the agent through content it processes. An OpenCode vulnerability (fixed in v1.18.33) allowed malicious MCP servers to execute code on a developer’s machine at sign-in time, using the developer’s own access tokens. And the LiteLLM supply-chain compromise - a credential stealer planted in a popular AI gateway package on PyPI and Docker Hub - was likely enabled by a leaked GitHub token found in AI gateway logs.

The pattern across all three: AI agents hold credentials (OAuth tokens, API keys, service account credentials), and attackers are targeting that credential layer through supply-chain compromise, prompt injection, and protocol-level exploitation of agent-to-service authentication.

What defenders should do: Inventory every AI agent in your environment and the credentials each agent holds. Apply least-privilege scoping to all agent OAuth tokens and API keys. Implement secrets scanning in AI gateway logs and MCP server configurations. Monitor for anomalous agent authentication patterns - agents accessing services they have not previously used, or authenticating from unexpected locations.

Sources: Gen Digital / BleepingComputer, OpenCode / The Hacker News, LiteLLM / The Hacker News

Defender Action Items

  • Audit OAuth app consents in Entra ID and Google Workspace - revoke delegated permissions for any app that does not strictly require them. Prioritize MSP-managed backup and RMM tools.
  • Rotate all secrets stored on Railway PaaS immediately if you are a Railway customer. Evaluate migrating to a dedicated secrets vault with automatic rotation.
  • Patch VeloCloud Orchestrator and audit account activity for privilege escalation from read-only accounts.
  • Inventory AI agent credentials - document every OAuth token, API key, and service account credential held by AI agents in your environment. Apply least-privilege scoping.
  • Update Node.js (CVE-2026-111497, CVSS 9.0) and Python Pillow (CVE-2026-112900, CVSS 9.0) in any AI/ML pipeline processing user-supplied content.
  • Scan AI gateway logs and MCP server configurations for leaked secrets - the LiteLLM compromise was likely enabled by a GitHub token in gateway logs.

Detection Queries

Detecting anomalous OAuth app consent events in Microsoft Entra ID - the pattern used in the Storm-0940 ARTEX attack. This KQL query surfaces new OAuth app consents followed by bulk data access within a short window:

// Detect new OAuth app consent followed by rapid data access (Entra ID audit logs)
// Tuning: adjust the 3-hour window based on your environment's baseline
let ConsentEvents = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName == "Consent to application"
| extend AppId = tostring(TargetResources[0].id)
| extend ConsentUser = tostring(InitiatedBy.user.userPrincipalName)
| project ConsentTime=TimeGenerated, AppId, ConsentUser;
let DataAccess = CloudAppEvents
| where TimeGenerated > ago(24h)
| where ActionType in ("FileDownloaded", "FileAccessed", "MailItemsAccessed")
| project AccessTime=TimeGenerated, AppId=tostring(ApplicationId), AccessUser=tostring(AccountObjectId);
ConsentEvents
| join kind=inner DataAccess on AppId
| where AccessTime between (ConsentTime .. (ConsentTime + 3h))
| summarize DataAccessCount=count(), FirstAccess=min(AccessTime) by AppId, ConsentUser, ConsentTime
| where DataAccessCount > 50
| sort by DataAccessCount desc

This query correlates OAuth consent events with subsequent bulk data access within 3 hours - the window observed in the Storm-0940 ARTEX campaign. A high DataAccessCount following a fresh consent is a high-fidelity indicator of OAuth abuse. False positives: legitimate new app onboarding with bulk migration. Tune the threshold and time window for your environment.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.