Three AI agent frameworks have now been confirmed in real intrusions in a single week. AntiFox reaches production AWS secrets in 30 minutes. Microsoft proves a coding agent can be silently backdoored by editing 9 neurons. And 4,837 hijacked GitHub accounts are planting secret-stealers across 1,806 repositories. The pattern is clear: AI agents are not a future identity threat - they are an operational one.

In the News

AntiFox AI Agent Reaches Production AWS Secrets in 30 Minutes

AntiFox, a fork of the ARTEX agentic pentesting framework, has been confirmed in real AWS intrusions investigated by Arctic Wolf-linked responders. The agent executes hundreds of API calls in under 30 minutes, moving from initial config-file theft to production secrets extraction without human guidance. This is the second confirmed agentic framework in real breaches within a week - Palo Alto Unit 42 published research on a third framework, Cairn, the same day.

The speed is the story. Traditional credential-theft operations require a human operator to enumerate, test, and pivot. AntiFox automates the entire chain. In a controlled GitGuardian lab test, an ARTEX build with no dedicated secret-scanning module found 8 of 9 planted credentials using only git and grep, starting its search within 13 seconds of deployment. The agent hunted secrets even when only asked to “assess security posture” - it decided on its own that credentials were the highest-value target.

The critical finding: deleting a secret from HEAD does not prevent recovery from git history. Only revocation and rotation close the risk. AI agents make secrets-in-git a live exploit path, not a hygiene issue. Every organization with cloud credentials anywhere in a git repository - committed, deleted, or buried in history - now faces an adversary that can find them faster than most security teams can respond.

What defenders should do: Implement automated secrets rotation with short-lived credentials (OIDC federation for CI/CD, IAM Roles Anywhere for workloads). Run secrets-scanning tools that cover git history, not just HEAD. Monitor CloudTrail for anomalous API call volume per principal - hundreds of calls in 30 minutes from a single identity is a high-fidelity signal.

Microsoft: Editing 9 Neurons Backdoors an AI Coding Agent

Microsoft Research demonstrated that modifying fewer than 10 neurons in a Claude Code agent inserts a persistent backdoor. The agent executes attacker-specified commands using its own permissions when a trigger condition is met. The attack works at inference time only - no retraining required - and the compromised model passes all standard security evaluations.

This is not a credential-theft attack. It is a non-human identity supply-chain attack. The agent’s “brain” is compromised, not its API key. A companion Microsoft Defender Research paper extends the threat model: poisoned fine-tuning datasets and backdoored model checkpoints can teach coding agents to “discover and misuse tools” autonomously - including file modification, RCE, and unauthorized data access. Agent backdoors persist through model transfers and weight merges.

The defensive implication is foundational. If a coding agent has write access to production repositories or infrastructure, and the model weights themselves can be silently compromised, then model provenance verification and agent permission scoping (least-privilege for agent identities) are not optional. Runtime behavioral monitoring of agent actions - what commands the agent executes, what files it modifies, what APIs it calls - becomes the detection layer.

What defenders should do: Inventory which AI agents have write access to production systems. Enforce least-privilege for agent service accounts. Implement runtime behavioral monitoring that flags agent actions deviating from expected patterns. Verify model provenance before deployment - treat model weights with the same supply-chain scrutiny applied to software dependencies.

4,837 Hijacked GitHub Accounts Plant Secret-Stealers in 1,806 Repos

A credential-stuffing campaign compromised 4,837 GitHub accounts and used them to submit pull requests containing CI/CD secret-stealers across 1,806+ repositories. Dubbed wfx-loot, the campaign targets cloud credentials, API keys, and service account tokens stored in GitHub Actions workflows and CI variables. Every merged PR potentially exfiltrates production secrets.

The attack chain is efficient: compromised developer identity becomes the vector for compromising non-human identity at scale. The stolen GitHub credentials likely came from password reuse - the accounts did not have phishing-resistant authentication enabled. Once inside, the attacker’s PRs blend with legitimate contribution activity, especially in active open-source projects with high PR volume.

What defenders should do: Enforce phishing-resistant authentication (FIDO2/passkeys) on all developer platform accounts. Audit GitHub Actions workflows for secret references and rotate any credentials accessible from CI/CD pipelines. Review merged PRs from external contributors for unexpected workflow modifications. Enable GitHub’s secret-scanning alerts and push protection.

United Airlines Bans AI Agents from Customer Accounts

United Airlines announced it will block customers from using AI agents to access their accounts, citing credential-sharing requirements and liability for autonomous purchase actions. The airline is the first major enterprise to publicly draw this line.

The decision surfaces a question every SaaS provider and enterprise application owner will face: when an AI agent authenticates as a user, who is accountable for the session? Existing access controls - session tokens, OAuth scopes, rate limits - were designed for human interaction patterns. Agent sessions behave differently: higher velocity, broader API coverage, automated decision-making. Without session-type classification, organizations cannot enforce distinct policies for agent and human access.

What defenders should do: Evaluate whether OAuth scopes and API policies distinguish between human and agent-delegated access. Implement session-type classification (behavioral analytics on session velocity and API call patterns). Update terms of service and access policies to address agent authentication and accountability.

Defender Action Items

  • Rotate and vault all secrets accessible from git repositories and CI/CD pipelines - prioritize revocation over deletion, as AI agents recover deleted secrets from git history
  • Enforce FIDO2/passkey authentication on developer platform accounts (GitHub, GitLab, Bitbucket) - credential-stuffing is the initial vector in the wfx-loot campaign
  • Inventory AI agent identities with write access to production systems and enforce least-privilege scoping on agent service accounts
  • Monitor CloudTrail (AWS), Azure Activity Log, or GCP Audit Log for anomalous API call volume per principal - hundreds of calls in a 30-minute window is a high-fidelity indicator of agentic exploitation
  • Verify model provenance for any AI coding agents deployed in development workflows - treat model weights as supply-chain artifacts requiring integrity verification

Detection Queries

CloudTrail query to detect anomalous API call volume from a single IAM principal within a 30-minute window - the behavioral signature of agentic credential exploitation:

1-- Splunk SPL: high-velocity API calls per IAM principal in 30-minute bins
2index=aws sourcetype=aws:cloudtrail
3| bin _time span=30m
4| stats count as api_call_count dc(eventName) as unique_actions by userIdentity.arn, _time
5| where api_call_count > 200 AND unique_actions > 15
6| sort -api_call_count
7| table _time, userIdentity.arn, api_call_count, unique_actions

This query flags principals making more than 200 API calls across more than 15 distinct actions in a 30-minute window. Tune the thresholds to your environment - legitimate automation typically calls a narrow set of actions repeatedly, while agentic exploitation tools enumerate broadly. False positives: CI/CD service accounts during deployment windows (exclude known deployment principals).

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.