Agents on borrowed credentials

What an October it has been. In just the last 48 hours there have been:

• an unauthenticated RCE in core PHP
• a CVSS 10 in GitLab going back to 2014
• a password stealer inside LiteLLM 1.107.0
• a certificate authority with eight signing keys all below 256
• Quest Diagnostics exposing patient data

The PHP timeline is worth digging into:

• Aug 1: AI model found the first bug.
• Aug 1: PHP was told privately.
• Oct 17: Amazon's traps cought someone already trying the exploit
• Oct 21, morning: Europe started pulling government websites offline
• Oct 21, afternoon: The fix was shipped.
• Oct 21, evening: Amazon says it’s being broadly exploited.

Defense did find it first, by about two months. But that margin is rapidly shrinking.

Then Axios reported that US banks are finding third-party agents inside customer accounts, some doing more than the customer asked. These are agents the customer authorized and the bank never did. The bank’s identity layer can’t tell a customer from a customer’s agent from an attacker holding a customer’s session.

And Microsoft linked the ConnectWise compromise to Storm-0940 using an open agentic penetration-testing framework with roughly 2,900 sign-in attempts per minute across more than 2,250 Microsoft 365 tenants, authenticating as a trusted application rather than as a person. In some cases, privileged access followed in under three hours.

The underlying problem is the same in both cases. Agents operating on borrowed credentials, at machine speed, with no reliable way for the receiving system to establish who’s actually acting, who delegated the authority, and what that authority permits.

The breach isn’t that agents got into bank accounts. It’s that nobody could tell they were agents.

This is where, I think, the conversation needs to move and the gap needs to be closed.