Developer Endpoints as NHI Stores: LastPass and CircleCI

The laptops of developers, DevOps engineers and support staff hold some of the most powerful machine credentials an organisation has, and attackers know it. Cloud access keys in a credentials file, a session that can mint production tokens, a service account password saved in a browser profile: each turns one compromised endpoint into a non-human identity breach. The LastPass and CircleCI incidents are the clearest examples, and the Okta support breach shows the same pattern in a support role. This guide treats developer and engineer endpoints as an NHI store in their own right, explains what the breaches teach, and sets out the controls, detections and rollout steps that take machine credentials off the endpoint. It is for identity, platform and endpoint teams; IDE and extension hardening is covered separately in the Developer Workstation and IDE Security Guide.

Key takeaways

An engineer's endpoint is an NHI vault whether you designed it as one or not. Keys, tokens, kubeconfigs, SSH keys and live SSO sessions all sit on it.
MFA at login does not protect what happens after login. CircleCI's attacker stole a 2FA-backed SSO session; LastPass's attacker captured a master password after MFA and reused a trusted device cookie.
Human vaults are the wrong place for workload keys. LastPass kept AWS access keys and backup decryption keys in a corporate password vault; the report's lesson is to move them out and give workloads short-lived credentials.
Personal devices and profiles are part of the attack surface. LastPass's second incident started on a home computer, Okta's on a personal Google profile on a managed laptop.
The fix is fewer standing credentials, not only better endpoint tools. Short-lived federated access, step-up for production, and a small group with production rights shrink what any one laptop can leak.

Why developer endpoints count as NHI stores

NHI inventories usually cover cloud accounts, CI/CD and secrets managers. The endpoint is missing, yet it is where many machine credentials are created, copied and used. Typical contents of an engineer's laptop include:

Cloud credentials: long-term keys in ~/.aws/credentials, gcloud credential files, Azure CLI token caches.
Cluster and host access: kubeconfig files with embedded tokens or client certificates, SSH private keys and agent sockets.
Source control and registry tokens: Git credential helpers, personal access tokens, npm and PyPI tokens in dotfiles.
Environment files: .env files copied from staging or production for local debugging.
Browser state: SSO session cookies for admin consoles, saved passwords for shared and service accounts, password manager sessions.
Token-minting rights: an engineer who can generate production access tokens turns their session into a source of new NHIs.

NHI Mgmt Group, The State of NHI & AI Agent Breach Report 2026 (October 2026) found cloud credentials abused in 60 breaches, source control tokens in 45 and session tokens in 15, and that stolen credentials were the route in for 47 breaches. Many of those credentials lived on, or passed through, a person's device.

What LastPass, CircleCI and Okta teach

Breach	Endpoint	What the endpoint held or reached	How the control failed	The cross-breach lesson
LastPass 2022, incident 1	An employee's corporate laptop	The development environment: 14 of 200 repositories, internal scripts containing secrets and certificates	Secrets kept in scripts in a development environment reachable from one laptop	Development environments and repositories are NHI stores; scan and empty them
LastPass 2022, incident 2	A senior engineer's home computer, reached through a known vulnerability in third-party media software	The engineer's corporate vault holding an AWS access key and backup decryption keys	Keylogger captured the master password after MFA; a trusted device cookie bypassed MFA; personal and business vaults shared one master password	Keep workload and backup keys out of human vaults; personal devices must not reach tier-zero secrets
CircleCI 2023	An engineer's laptop with malware not detected by antivirus	A valid 2FA-backed SSO session, and the right to generate production access tokens	Session cookie theft; the stolen session was used from a remote location to reach production and copy customer environment variables, tokens and keys	Bind sessions to devices, require step-up for token minting, and limit who can mint at all
Okta support 2023	An Okta-managed laptop with a personal Google profile signed in	Saved credentials for a support service account that could read customer HAR files	Service account password synced into a personal browser profile, then exposed with the personal account or device	Service account passwords never belong in browsers; block personal profiles on managed devices

The outcomes were severe. The ICO fined LastPass UK Ltd £1.2 million, affecting up to 1.6 million UK users. CircleCI told every customer to rotate every secret stored on the platform. The Okta support breach led to session hijacks at five customers, and one of its downstream victims, Cloudflare, later found four credentials from that breach that had not been rotated. See the Cloudflare breach page.

The report's lesson for LastPass reads: move backup and data access keys out of human vaults, and give workloads short-lived credentials. That is the core of this guide.

Take machine credentials off the endpoint

Endpoint protection matters, but CircleCI's malware was not caught by antivirus and LastPass's entry was a personal machine. Assume an endpoint will be compromised and make sure it holds little that lasts.

Credential on the endpoint	Replace with	Effect if the laptop is compromised
AWS long-term access keys in `~/.aws/credentials`	IAM Identity Center profiles using `aws sso login` and an `sso-session` block; the CLI obtains temporary role credentials	Attacker gets temporary credentials and a cached session that expires, not a permanent key
Static kubeconfig tokens or long-lived client certificates	OIDC-based cluster sign-in through the identity provider	Access tied to the human's IdP session and its conditional access
Personal access tokens with broad scopes	Fine-grained, short-expiry tokens scoped to named repositories, or SSO-based Git credential helpers	Smaller blast radius and a natural expiry
Production `.env` files	Runtime secret retrieval from a secrets manager with per-developer, non-production scopes	No production values on disk
Service account passwords in a browser or human vault	Workload identity for the service; humans use their own account with just-in-time elevation	Nothing reusable to steal
Backup and data decryption keys in a human vault	A KMS or HSM with key use by named workloads only, and break-glass access under dual control	A stolen human vault does not unlock backups
Long-lived SSH keys	Short-lived SSH certificates issued after IdP sign-in	Certificates expire within hours

For the platform side, see the Workload Identity Federation Guide, SSH Key Management Guide and GitHub Personal Access Tokens Security Guide.

Protect the sessions that remain

Some powerful sessions will always live on a laptop. The CircleCI case shows that a valid session is as good as the credentials behind it.

Bind sessions to the device: use device-bound session credentials where the browser and service support them, and token protection features of your identity provider. See the Device-Bound Session Credentials (DBSC) Guide.
Step-up for production and token minting: require fresh phishing-resistant authentication for any action that creates a production token, a cloud key or a CI/CD secret. CircleCI added step-up authentication for employees who keep production access after its incident.
Shrink the group: CircleCI restricted production access to a very small number of employees. Count who can mint production credentials and cut it.
Short session lifetimes for admin consoles: shorter for cloud and CI/CD admin than for email.
Infostealer exposure checks: session theft is the infostealer business model. See the Infostealer Logs and Session Token Abuse Guide.

Personal devices, profiles and home networks

No tier-zero secrets reachable from unmanaged devices: conditional access that requires a compliant, managed device for vaults, cloud admin and CI/CD admin. The LastPass second incident began on a personal machine.
Block personal browser profiles on managed devices: Okta did this after its support breach. Use your browser management policies to restrict sign-in to corporate accounts.
Separate personal and work password vaults: different accounts and master passwords; the shared master password was a direct link in the LastPass case.
Do not trust "remembered device" cookies for privileged vaults: require MFA every time for vaults holding shared or privileged secrets.

Implementation: a phased rollout

Discover (weeks 1 to 3): run an endpoint credential scan on a pilot group of engineers: look for cloud credential files, kubeconfigs, .env files, SSH keys and token files, and report counts by type, not values. Pair it with a review of who can mint production tokens.
Remove the worst (weeks 2 to 6): revoke and remove long-term cloud keys from laptops, move service account passwords out of browsers and human vaults, and move backup and decryption keys into KMS or HSM with workload-only use.
Federate (weeks 4 to 12): roll out IdP-based CLI sign-in for cloud and Kubernetes, SSO-based Git credentials, and short-lived SSH certificates, one platform at a time.
Harden sessions (weeks 6 to 12): step-up for production actions, managed-device conditional access for tier-zero systems, shorter admin sessions.
Test: use a pilot ring of volunteer teams, keep the old path available for two weeks, and measure blocked workflows. Run a tabletop where one engineer's laptop is assumed stolen and list everything it could reach.
Roll back: if federation breaks a critical workflow, issue a time-limited, scoped exception credential with an owner and an expiry, never a new permanent key.

Decision guidance

Small teams: start with two changes: no long-term cloud keys on laptops (use the cloud's SSO CLI sign-in) and no service account or decryption keys in anyone's password manager. Both are low-cost.
Large organisations: treat the "who can mint production credentials" list as a tier-zero group with its own reviews, managed-device-only access and step-up. Fund session binding next.
Contractors and support staff: they hold NHI access too, as the Okta and Uber 2022 cases show. Apply the same managed-device and MFA rules, or give them access through a brokered environment.

Detection and measurement

Same identity, two places: an engineer's session or token used from a network or device that does not match their managed endpoint, which was the CircleCI pattern.
Token minting outside normal hours or volume: alert on creation of production access tokens, cloud access keys and CI/CD secrets, by person and count.
Endpoint signals: processes reading browser cookie stores or credential files that are not the owning application; new keylogging or input-capture tools.
Vault events: access to privileged vault items from new devices; exports of many items.
Backup store access: reads from backup buckets by identities that do not normally read them. LastPass's attacker reached cloud storage with stolen keys.

Metrics:

Long-term cloud keys found on endpoints per scan (target: zero).
Number of people who can mint production credentials.
Share of cloud, Kubernetes and Git access from endpoints using federated, short-lived credentials.
Service account or decryption secrets found in human vaults or browsers (target: zero).
Share of tier-zero access requiring a managed, compliant device.

Common failure patterns

Trusting MFA as the end of the story: stolen sessions and post-MFA keylogging bypassed it at CircleCI and LastPass.
Keeping workload keys in a human vault: the vault becomes the link between a personal device and the backups.
Letting service account passwords sync to browsers: the Okta support account was exposed this way.
Assuming antivirus will catch it: CircleCI's malware was not detected.
Leaving development environments full of secrets: LastPass's first incident gave the attacker scripts with secrets and information used to target the second.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	PR.AA-01, PR.AA-05	Manage credentials for users and services; least privilege for token minting.
NIST SP 800-53 Rev 5	IA-5, AC-6, AC-2, SC-12	Authenticator management, least privilege, account management, key management for backup keys.
MITRE ATT&CK v20	T1539, T1552.001, T1552.004, T1555.005, T1078.004	Session cookie theft, credentials in files, private keys, password managers, cloud accounts.

Practitioner checklist

Add engineer and support endpoints to the NHI inventory as a store type.
Scan a pilot group of laptops for cloud credential files, kubeconfigs, SSH keys and .env files.
Remove long-term cloud keys from laptops and move to SSO-based CLI sign-in.
Move backup and decryption keys out of human vaults into KMS or HSM with workload-only use.
Remove service account passwords from browsers and password managers; block personal browser profiles on managed devices.
Cut the list of people who can mint production credentials, and require step-up for each mint.
Require a managed, compliant device for vaults, cloud admin and CI/CD admin.
Alert on session or token use from a device or network that does not match the owner's endpoint.

Developer endpoints as NHI stores: lessons from LastPass and CircleCI