#non-human-identity

A spraying campaign that only worked on functional accounts, a service principal secret in a GitHub issue, an email address that commits code, a public database key with no authorization behind it, and a leaver's token kept alive on purpose. None needed a new exploit. All of them were credentials no person was accountable for.

Microsoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.

Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and can start CI jobs, with no expiry and no MFA. GitLab calls it intended behavior.

Wiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which defaults to full admin: every provider API key, every prompt, and MCP access.

Attackers exploited CVE-2026-63077 against a JetBrains-run TeamCity server to breach the Cadence cloud service, taking AWS IAM credentials, source code, and secrets from a 2024 backup. JetBrains says the server should have been patched.

GitGuardian found the latest Shai-Hulud variant scanning 469 paths for secrets across developer machines, CI/CD, cloud config, and AI tool settings. The npm worm spreads using the credentials it finds, with no human operator in the loop.

CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated attacker forge access and mint administrator credentials. Exploited from September 1.

CVE-2026-64849 (CVSS 9.3) abuses MLflow's model-registry webhooks to proxy requests into internal services, including cloud metadata endpoints that hand out credentials. Fixed in 3.15.0; exploitation began the day of assignment.

ASSET Research Group fragmented an exfiltration request across MCP channels so no single piece looked malicious. Models that refused the intact instruction 100 percent of the time complied 100 percent of the time when it arrived in parts.