# This Week in Identity, Issue 8 Source: https://startwithidentity.com/newsletter/2026-08-11-this-week-in-identity-08/ Last updated: 2026-08-29 License: content by Start with Identity. Cite the source URL. --- Issue 8 of This Week in Identity. Black Hat delivered, and the theme was implementations rather than standards. ## In brief - Three passkey attacks landed in one week and none of them broke WebAuthn. They broke implementations, storage, and enrollment. - Two CVSS 10.0 flaws shipped: a Terraform MCP server serving one user's token to another user's request, and a Metabase zero-day giving admin through password reset. - Opening a GitHub issue was enough to reach CI secrets in Claude Code and Gemini CLI, and GhostSplice showed that splitting a malicious instruction takes agent refusal rates to zero. ## The big story **Three passkey attacks in one week, none of them touching the cryptography.** Pass-the-Passkey found WebAuthn implementation bugs. Unit 42 extracted Google's synced passkey keys from Chrome's memory. Malware drove a Windows Hello key for Entra persistence with no PIN prompt. Why it matters: the standard is holding, and that is worth saying clearly before the "passkeys are broken" headlines. What is not holding is everything around it. Key storage in a browser process, enrollment flows that accept an attacker's registration, recovery paths that fall back to a password, and platform authenticators that can be driven by malware already on the device. Our analysis is [three passkey attacks target everything except the cryptography](https://startwithidentity.com/blog/2026-08-10-three-passkey-attacks-target-everything-except-the-cryptography/). The practical read for a rollout: the credential is strong, so attack effort moves to enrollment and recovery, and that is where your controls need to be. ## Patch this week - **Terraform MCP server**, CVSS 10.0: one user's token served another user's request. This is [cross-tenant token confusion](https://startwithidentity.com/techniques/cross-tenant-token-confusion/). [Post](https://startwithidentity.com/blog/2026-08-05-terraform-mcp-server-cross-tenant-token-reuse/). - **Metabase**, CVSS 10.0 zero-day: admin access through the password reset endpoint, the same class as the Keycloak flaw two weeks later. [Post](https://startwithidentity.com/blog/2026-08-08-metabase-zero-day-unauthenticated-admin-access/). - **N-able N-central**: confirmed use against managed customer networks after the incomplete first fix. [Post](https://startwithidentity.com/blog/2026-08-07-n-able-n-central-god-mode-flaw-reached-customer-networks/). ## The pattern Four of this week's stories are about agents and their credentials: the Terraform MCP token mix-up, GitHub issues reaching CI secrets, 4,576 leaked n8n tokens with a third of instances accepting them, and GhostSplice. The common failure is scope. An agent or automation platform holds a credential broad enough to be worth stealing and reachable through an input channel nobody classified as untrusted. [Static API key abuse](https://startwithidentity.com/techniques/static-api-key-abuse/) and [agent instruction injection](https://startwithidentity.com/techniques/agent-instruction-injection/) are the two halves. ## What else happened - **GhostSplice** fragments a malicious instruction across MCP channels so no single piece looks harmful, taking several models from 100 percent refusal to 100 percent compliance. [Post](https://startwithidentity.com/blog/2026-08-11-ghostsplice-split-instructions-make-coding-agents-exfiltrate-secrets/). - **GitGuardian found 4,576 leaked n8n tokens**, and a third of reachable instances accepted them. [Post](https://startwithidentity.com/blog/2026-08-05-leaked-n8n-api-tokens-expose-connected-credentials/). - **Kali365 phishes Microsoft's own device login page** for durable Microsoft 365 tokens. [Post](https://startwithidentity.com/blog/2026-08-05-kali365-device-code-phishing-microsoft-365/). - **Over 1,000 AI-named npm typosquats** delivered a cross-platform dropper. [Post](https://startwithidentity.com/blog/2026-08-07-flooding-dropper-npm-typosquat-campaign/). - **The Snowflake attacker pleaded guilty**, two years after stale credentials did the work. Our teardown: [Snowflake 2024](https://startwithidentity.com/breaches/snowflake-2024-credential-attacks/). [Post](https://startwithidentity.com/blog/2026-08-06-snowflake-hacker-connor-moucka-pleads-guilty/). ## New from Start with Identity - **Black Hat USA 2026 identity coverage**, pulling the week's research into one thread. - **26 curated news posts** verified against primary sources, clearing the queue backlog. - **Three vendor profiles and a four-piece B2B SaaS content set.** ## From the community Corrections are welcome and credited. The [contact form](https://startwithidentity.com/contact/) reaches an editor. That's Issue 8. [Subscribe](https://startwithidentity.com/subscribe/) for the next one.