Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps.
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. The university says the attacker used compromised credentials to log into DTUBasen, its identity and access management (IAM) system, allowing access to more than two decades of user data. In a disclosure on Friday, DTU confirmed that it cannot “determine precisely what information was downloaded or how many people have been affected.” However, the Danish university notes that DTUBasen stores information for nearly 40,000 active users and around 160,000 former users. Potentially exposed information for current users includes Danish civil registration numbers (CPR), full names, home addresses, and profile pictures, as well as work email addresses, job titles, office locations, and other employment-related details.
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued.
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement. According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins. The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials. "Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."
Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates.
Infostealers are exposing corporate AI accounts, sessions and API keys, giving attackers access to sensitive data, compute and connected systems. SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent rather than the result of historical cleanup. Together, these companies account for 5,434 stealer log records linked to 1,500 distinct corporate email addresses. The number that really stands out is the ChatGPT figure. A captured ChatGPT or OpenAI session appeared at 358 of the 482 companies, accounting for roughly 90% of all records in the study. Other platforms, including Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs, were far behind. This doesn’t necessarily point to a security problem with OpenAI. It says more about how employees use AI at work. Many people simply signed up for ChatGPT with a work email and used it on a personal device, often outside company policies and without IT teams even knowing it was happening. Claude and Gemini barely appear in the data, and SOCRadar is explicit about what that means and what it doesn’t. The researchers read the absence as a shadow-AI signal, not evidence that those platforms are safer to steal from. Anthropic demonstrated that in late August when infostealer malware started hijacking Claude sessions to drain paid usage, forcing a company-wide sign-out, payment method removal, and fraud refunds. Users noticed on Reddit when their usage limits “refilled and then drained” overnight. Claude sessions are targeted the moment they exist in enough volume; there are just fewer of them in corporate environments today. A stolen AI login is categorically different from a stolen password, and the report makes a clear case for why the industry needs to treat it that way. “A stolen cookie is a live session. As Okta’s Jeremy Kirk put it, “session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication.”” reads the report published by SOCRadar. “Rotating the password alone leaves the intruder signed in.” That quote comes from Okta researcher Jeremy Kirk, cited in the report after Okta’s team pulled a 7 GB stealer dump off Telegram and found thousands of still-replayable tokens inside, including two dozen valid API keys for major AI providers. Rotating the password after a credential theft doesn’t help if the active session cookie is still valid. The attacker stays logged in regardless. The conversation history inside a compromised AI account creates a different kind of breach. Employees often paste source code, customer data, contracts and unreleased plans into AI prompts without thinking of it as data leaving the company. But once an attacker takes over the session, they can access that entire history without ever breaking into the company’s internal systems. The AI account has effectively become part of the company’s corporate memory, and the stolen session provides access to it. API keys add a financial risk on top of the data exposure. During July, August and September 2026, underground forums were openly offering Claude API keys, ChatGPT cookies from paid and Pro accounts, and Cursor sessions, in some cases with money-back guarantees. This fuels a type of abuse known as LLMjacking: attackers steal keys from notes, configuration files or workspace settings and use them to run AI workloads at the victim’s expense, or resell the access at a discount. The victim gets the bill. The attacker gets the computing power. “Keys copied into a notes app or a workspace settings page get lifted with everything else, then billed to the victim or resold. Underground vendors sell discounted access to Claude, Gemini and Cursor accounts and money-back guarantees.” states the report. Automation platforms make the exposure worse. A stolen Zapier session carries standing authorization into CRM systems, email, and file storage. An attacker with access can build a workflow that exfiltrates data on a schedule, from a trusted vendor IP address, without any further credential theft required. The sector breakdown is worth noting. Technology firms are the largest group at 144 companies and 40% of all records, which matters because those companies hold downstream client data too. But industrials, financial services, healthcare, retail, and energy all appear in force. Agent and automation exposure, the category that carries an employee’s authorization into other systems, concentrates specifically in healthcare, financial services, and technology, which are exactly the sectors least able to absorb that kind of lateral movement. All of this is happening while the AI industry debates frontier safety risks, autonomous agent swarms, and the pace of development. That conversation is real and worth having. This report is about something more immediate and considerably more actionable: You don’t need an autonomous swarm to lose your corporate memory. One employee, one unmanaged laptop, one saved ChatGPT password and a commodity infostealer, widely available in Telegram channels since 2022, can be enough. The controls recommended in the report are straightforward. Put AI platforms behind single sign-on, use short-lived sessions and rotate refresh tokens so stolen cookies expire quickly. Limit and regularly rotate API keys, and flag activity from unusual locations or outside normal working hours. If an employee shows up in a stealer log, treat it as an endpoint security incident, not simply a password reset. And find shadow AI accounts first: you can’t rotate credentials or secure accounts you don’t even know exist. Anthropic’s own response to the August incident is the template the report points to: the company didn’t just advise a password change, it invalidated sessions, removed payment methods attackers were abusing, and notified affected users that their machines were compromised. That last step is the difference between a data feed and an actual fire alarm. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI accounts)
Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. Based on the analysis of table schemas, researchers at cyber risk management company UpGuard believe that a very small set of the exposed information includes credit card data. Supabase is an open-source development platform built around PostgreSQL that provides developers with a range of backend services to build and launch apps and websites faster. The service has become increasingly popular among developers using artificial intelligence tools to build projects, with AI-assisted development accounting for more than 60% of newly created databases. UpGuard researchers analyzed a dataset of around 300,000 domains that showed signs of using Supabase and checked for a 'users' table. While some queries returned a page from the database, others hinted that the 'users' table did not exist, but a table with another name was accessible.
A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. 21-year-old Cameron John Wagenius (also known online as 'kiberphant0m' and 'cyb3rph4nt0m' ) was arrested in Texas in December 2024. He pleaded guilty in February 2025 to hacking AT&T and Verizon after being charged on two counts of unlawfully transferring confidential phone records, and in July 2025 to multiple counts of aggravated identity theft, conspiracy to commit wire fraud, and extortion related to computer fraud. According to court documents, while on active duty with the U.S. Army, Wagenius and his accomplices stole login credentials for the victim's networks using the SSH Brute hacking tool he helped develop. They also used Telegram to transfer stolen credentials and plan their attacks.
Confirm this action.
Leaving now will discard your changes.