Agentic attacks compress identity gaps, not new techniques

At a glance

What this is: Vectra AI analyses five 2026 attack cases and argues that AI compressed familiar intrusion steps rather than inventing new ones, with identity, federation and API exposure doing the real work.

Why it matters: Identity and access teams need to look past single alerts and focus on how unauthenticated APIs, token validation, SSO bridges and delegated access combine into one exploitable path.

Context

The article is about attack chains that exploit identity and access assumptions, not about a new exploit class. The recurring problem is that security teams still treat exposed endpoints, federation trust and token validation as separate issues even when attackers chain them together across the same environment.

For IAM practitioners, the relevant question is how AI-accelerated operators change the pace of known intrusion steps. The article's examples point to NHI and identity-provider exposure, plus the growing problem of machine-assisted reconnaissance against systems that were never designed to be safe when fully parsed and correlated.

The central governance gap is visibility across the whole identity path, from published application bundles to SSO and internal systems. Once an attacker can map those relationships quickly, the blast radius is determined less by a single control failure than by how many trust links remain connected.

Key questions

Q: What breaks when identity exposure is available before login?

A: When an application exposes API routes, federation settings or other authentication clues before login, attackers can map the environment without triggering traditional access controls. That breaks the assumption that reconnaissance starts after intrusion. Practitioners need to treat pre-authenticated disclosure as part of the identity attack surface, because it can guide token abuse, SSO pivots and targeted spraying.

Q: Why do weak token checks and SSO bridges increase compromise risk?

A: Weak token validation lets an attacker present forged or untrusted identity claims, and SSO bridges can then carry that bad trust into multiple connected systems. The danger is not only initial access but inherited access. If one hop is misvalidated, the federation chain can turn a local failure into enterprise-wide reach.

Q: How can teams tell whether an API is acting like an identity oracle?

A: An API is acting like an identity oracle when it reveals usernames, session material, client configuration or similar trust clues without requiring authentication. That does not just leak data, it helps attackers build target lists and understand how federation is wired. The practical test is whether the endpoint helps map access paths even when it appears read-only.

Q: What should security teams do when a low-value portal can reach high-value systems?

A: They should assume the portal is part of the blast-radius problem, not an isolated edge system. Map every downstream application that trusts its login event, then review whether those inherited permissions are still justified. When low-value access can reach personnel data or administration paths, the trust boundary is too wide.

Technical breakdown

Why exposed bundles become identity intelligence

Modern web applications often ship enough client-side metadata to reveal API routes, identity-provider settings and federation relationships. When attackers parse those bundles automatically, the exposure is not the JavaScript itself but the hidden control plane information embedded in what was meant for every visitor. That gives an operator a fast map of where authentication lives, how systems connect, and which trust links are likely to matter next. In identity terms, published configuration becomes reconnaissance material. Practical implication: treat front-end delivery as part of the identity attack surface, not just application code.

Practical implication: Inventory what your front end discloses about authentication, federation and connected systems.

How token validation and unauthenticated APIs fail together

Unauthenticated APIs and weak JWT validation are different failures, but they reinforce one another. An endpoint that returns identifiers or session material without credentials becomes a username and relationship oracle, while accepting a token signed with none turns authentication into a formality. The attacker does not need to break cryptography if the application has already accepted a shortcut around it. Once those two gaps appear together, the identity layer is being asked to trust information that was never authenticated. Practical implication: validate token handling and endpoint exposure as a single control path, not as separate review items.

Practical implication: Test API authentication and JWT validation together, because either gap can make the other exploitable.

Why SSO bridges expand blast radius

Federation is designed to move identity across systems, so a successful sign-in on a low-value portal can become access to internal dashboards, personnel records or administrative functions. That is why the article's 84-of-85 pivot matters. The security event is not the first authentication success, but the way a valid session is honoured by downstream trust relationships. In NHI and IAM terms, federation controls can preserve the attacker's legitimacy even as the original foothold was weak. Practical implication: map which connected systems inherit trust from one authentication event and which ones should not.

Practical implication: Trace how one successful login propagates through federation before you assume the initial system is the real problem.

Threat narrative

Attacker objective: The attacker aims to turn publicly exposed identity and federation metadata into authenticated access across multiple connected systems without needing novel exploitation.

1. Entry began when the actor parsed publicly served JavaScript bundles to extract API endpoints, identity-provider configuration and signing keys.
2. Credential access followed through unauthenticated APIs, weak token validation and account spraying that yielded valid sessions and SSO pivots.
3. Escalation and lateral movement came from moving through federation into connected internal systems, where legitimate sign-ins expanded reach.
4. Impact was achieved when the attacker chain turned authentication success into broad internal access across many linked systems, including personnel data and administration paths.

Breaches seen in the wild

• Microsoft Storm-0558 key breach 2023: China-based Storm-0558 used a stolen, never-retired Microsoft signing key to forge tokens and read email at 22 organisations in 2023.
• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity exposure now includes everything a browser can see: If a portal publishes API routes, federation metadata and signing material, the attacker does not need a breach to begin mapping the environment. That assumption fails because modern recon can convert intended client-side delivery into identity intelligence in minutes. The implication is that identity governance must extend to what the application reveals before any login occurs.

Federation trust is the real blast-radius multiplier: A successful sign-in on a low-value portal can still become a high-impact incident when SSO trust is extended too broadly. This is not a logging problem, it is a trust-propagation problem. Practitioners need to think in terms of inherited access paths, because the first authenticated hop is rarely the last one that matters.

Unauthenticated APIs create identity oracles: When an API returns staff identifiers, session artefacts or configuration without credentials, it is feeding attackers the material they need to target the rest of the control plane. That is a governance failure, not just an exposed endpoint. The lesson is to classify these interfaces as identity-bearing assets and review them accordingly.

JWT acceptance without signature verification is a broken premise, not a misconfiguration: A token signed with none is not being validated in any meaningful sense. The assurance model assumes the issuer and the verifier share cryptographic trust, and that premise collapses when the verifier agrees to skip the check. Practitioners should treat that as a structural auth failure, not a low-severity defect.

Named concept, identity blast radius: The article describes a chain where one weak identity control expands through federation, API exposure and valid sessions into many systems at once. That blast radius is not measured by the first control that failed, but by every downstream system willing to trust the result. Teams should manage identity paths as compounded exposure, not isolated events.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).

What this signals

Identity blast radius: Attackers now use published configuration, weak tokens and federation inheritance as one chain, so the programme risk is no longer a single bad login but the speed at which trust propagates. Identity teams should watch for controls that validate each hop in isolation while missing the combined path from exposure to internal access.

The practical shift is from perimeter thinking to trust-path thinking. If a low-value portal can disclose enough identity metadata to help an attacker and then pass that trust into SSO-connected systems, the control problem is architectural, not merely operational.

For practitioners

• Audit what your front end reveals Catalogue API endpoints, identity-provider settings, OAuth client IDs and other authentication clues that are served to any visitor, then remove or harden anything that helps attackers map the environment.
• Validate JWT handling end to end Test whether any service accepts tokens with weak or missing signature checks, and confirm that token verification fails closed across every route that participates in authentication.
• Map SSO inheritance paths Document which downstream applications trust a single upstream login event, then identify where that trust is broader than the business need and where a low-value entry point can reach high-value data.
• Treat unauthenticated APIs as identity assets Review endpoints that disclose usernames, sessions, configuration or keys without a credential, because they can become attacker discovery tools even when they appear read-only.
• Inventory AI tooling as attack surface Track AI provider keys, session hooks and model endpoints alongside other credentials, because attackers can abuse them as infrastructure once they are reachable in the environment.

Key takeaways

• AI-assisted intrusion chains still depend on familiar identity failures such as exposed configuration, weak token validation and overextended federation trust.
• The significant risk is not that attackers invented new techniques, but that they compressed reconnaissance, authentication abuse and lateral movement into a shorter window.
• Identity teams should focus on how information exposed before login feeds downstream trust propagation, because that is where blast radius grows.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Federation Inheritance: The way one successful authentication event is trusted by downstream applications and services. It becomes a security problem when a weak or low-value login is allowed to carry legitimacy into systems with much higher privilege or sensitivity.
• Identity Oracle: An unauthenticated or weakly protected interface that reveals information useful for mapping users, sessions, configurations or trust relationships. In identity work, that disclosure often accelerates targeting even when the endpoint does not directly grant access.
• Token Validation: Token validation is the process of checking that a credential was issued by the right authority, has not expired, and is meant for the current request. For NHIs, validation must include issuer, audience, signature, scope, and context, otherwise a valid token can still be over-privileged.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.