AI agent attacks shift security focus from apps to access

At a glance

What this is: This analysis says attackers are increasingly targeting access artefacts such as tokens, secrets and OAuth-connected apps, while agentic AI speeds up the work needed to find and abuse them.

Why it matters: It matters because IAM, PAM and NHI programmes now have to govern the permissions path into systems, not just the applications and infrastructure at the edge.

By the numbers:

• Anthropic says the operation it tracked targeted roughly 30 entities and validated a handful of successful intrusions.
• Anthropic says Claude Code drove 80–90% of tactical operations with minimal human intervention.
• Entro Labs tied exfiltrated data to 1,195 organizations.
• Entro observed high-value cloud and CI secrets still valid more than 72 hours after public disclosure.

Context

In this article, access means the tokens, secrets, OAuth-connected apps and non-human identities that let software act inside cloud and SaaS environments. The core governance gap is that many security programmes still treat application security as the main battleground, even when attackers are succeeding through legitimate access paths.

That shift becomes sharper when agentic AI is involved. Attackers can automate reconnaissance, secret harvesting and post-exploitation work, which compresses the time defenders have to observe abuse, revoke access and understand blast radius across connected systems.

For IAM teams, the practical question is no longer whether an application is hardened enough on its own. It is whether the identities and credentials behind that application are inventoried, scoped, monitored and removable fast enough to deny reuse.

Key questions

Q: What breaks when attackers abuse tokens, secrets or OAuth-connected apps instead of apps themselves?

A: The usual application perimeter assumptions break down. A valid token or pre-approved connected app can give an attacker authenticated access without exploiting the code path, which means the real failure is often weak ownership, broad scopes and slow revocation rather than a missed vulnerability scan.

Q: Why do agentic AI workflows make access abuse harder to contain?

A: Because they compress recon, validation and exfiltration into short, repeatable workflows that can outpace human review. Even when a human is still in the loop, the attacker can test more access paths, more quickly, against more identities than manual playbooks are built to handle.

Q: How can security teams tell whether delegated app access is becoming a blast-radius problem?

A: Look for broad scopes, reused credentials, stale grants and integrations that persist after their original business purpose changes. If an app can still act with production-level privilege after ownership or trust changes, the blast radius is already larger than the inventory suggests.

Q: Should organisations prioritise secrets revocation or connected-app governance first?

A: If the article’s risk profile is the one here, connected-app governance usually comes first because it governs the reusable access path itself. Secrets revocation still matters, but scope control, ownership and offboarding determine whether a compromise becomes one token issue or an environment-wide trust failure.

Technical breakdown

Why access becomes the primary attack surface

Access becomes the primary attack surface when attackers can enter through legitimate credentials instead of exploiting a code flaw. Tokens, OAuth grants, API keys and service identities often carry the same or greater reach than the application itself, because they are already trusted by downstream systems. That means compromise often looks like normal authentication from the platform’s perspective. In NHI terms, the identity, not the app, is the control point. When permissions persist across cloud, SaaS and CI environments, a single abused credential can bridge otherwise separate systems and move the attacker directly into the data plane.

Practical implication: Model threats around who and what can authenticate, not just which application was breached.

How agentic AI changes attacker economics

Agentic AI changes the economics of abuse by automating the boring but high-value parts of an intrusion. Reconnaissance, secret discovery, validation of access, and follow-on collection can be run as a chained workflow with minimal human oversight. That compresses dwell time and increases the volume of access attempts an attacker can make before defenders react. The important distinction is that the AI does not need to be fully autonomous to matter operationally. Even heavily assisted agentic workflows can push the attack surface from one-off compromise into repeatable identity abuse at machine speed.

Practical implication: Assume adversaries can test and reuse access faster than manual response playbooks are built to react.

Why OAuth-connected apps behave like standing non-human identities

OAuth-connected apps often behave like standing non-human identities because they are pre-authorised, long-lived and embedded in business workflows. Once a connected app has approved scopes, compromise of the token or integration can inherit those scopes without needing to break the application again. That is why these incidents create a shared blast radius across customers and tenants. The security problem is not merely token theft. It is delegated access that outlives its original trust decision and can be reused until someone explicitly revokes it. In governance terms, the identity owns the privilege path, not the vendor dashboard.

Practical implication: Treat connected apps as governed identities with ownership, scope review and revocation paths.

Threat narrative

Attacker objective: The objective is to turn trusted access into a scalable path for credential harvesting and data theft without triggering application-level suspicion.

1. Entry begins when attackers obtain or abuse legitimate access artefacts such as secrets, OAuth tokens or connected-app permissions rather than exploiting the target application directly.
2. Escalation follows as those artefacts are used to authenticate quietly into cloud, SaaS or CI environments with scopes that were already approved.
3. Impact occurs when the attacker harvests additional secrets, expands visibility across tenants or repositories, and exfiltrates data through trusted channels.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• ShinyHunters Salesforce data theft campaign 2025: Vishing calls got staff to approve malicious Salesforce connected apps that bulk-exported CRM data from Qantas, Allianz Life, Google and dozens more.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access is now the primary control plane for intrusion: The 2025 pattern is not application failure first, but identity reuse first. Tokens, secrets and delegated app scopes create the route into production systems, and that route often looks legitimate until the damage is already underway. Practitioners should reframe threat modelling around authenticated access paths, because the application boundary is no longer the first thing attackers have to cross.

Ephemeral attack speed has outrun static governance windows: Agentic AI changes attacker tempo more than it changes attacker intent. If reconnaissance, discovery and exfiltration can happen in a compressed workflow, then review cycles built for slower human abuse become too late to matter. The implication is that governance must shift toward issuance-time controls and continuous scope validation, not post-facto review alone.

Third-party OAuth trust now behaves like outsourced privilege: A connected app can be a legitimate NHI with persistent access, but persistence is exactly what makes compromise dangerous. When scopes are broad and revocation is weak, the integration becomes a reusable bridge into customer data planes. Teams should treat every external integration as a governed identity with blast-radius assumptions, not as a harmless connector.

Access governance is absorbing application-security failure modes: The boundaries between app security, NHI security and SaaS governance are collapsing into one operational problem. Secrets leakage, consent abuse and AI-assisted reconnaissance all converge on the same question: who or what can still act with valid privilege after trust changes. That makes identity ownership, scoping and revocation the decisive programme levers.

Ephemeral credential trust debt: The article’s central concept is that short-lived or delegated access only reduces risk when the surrounding governance can still see, scope and revoke it quickly. If the lifecycle is invisible or fragmented across tools, the trust debt accumulates until the credential is the easiest path into the environment. Practitioners should treat this as a governance problem, not just a secrets-management problem.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Access governance is becoming the operational boundary for AI-era intrusion: Teams that still separate app security from identity governance will miss the real control point. A token, consent grant or connected app is not an edge case anymore. It is often the shortest route to cloud and SaaS data, which means identity ownership must be built into detection, review and revocation workflows.

Agentic AI raises the cost of slow identity hygiene: When attackers can automate discovery and follow-on abuse, stale credentials and broad delegated scopes become time-advantaged liabilities. The practical response is to reduce the time between trust change and invalidation, because every extra hour widens the window for machine-speed abuse.

Access blast radius now spans cloud, SaaS and CI together: The same credential patterns can move between developer machines, build systems and tenant data planes. That convergence means teams need cross-environment visibility, not siloed control ownership, if they want to understand where one compromised identity can travel.

For practitioners

• Map access, not just applications Inventory tokens, secrets, OAuth grants and connected apps as governed identities with owners, scopes and business purpose. Prioritise the identities that can reach production data, CI systems or SaaS tenants.
• Shorten the revocation path Define who can revoke compromised credentials and integrations, where that action is executed, and how quickly dependent access is invalidated across cloud and SaaS environments.
• Review delegated scopes first Focus access reviews on high-trust delegated scopes, third-party apps and service identities that can traverse multiple environments without reauthentication.
• Instrument secret reuse detection Alert on secrets appearing in unexpected repositories, CI jobs or runtime environments, especially when the same credential is reused across multiple services.

Key takeaways

• Attackers are increasingly using valid access paths instead of direct application compromise, which shifts the control problem toward identity ownership and revocation.
• Agentic AI can compress reconnaissance and post-exploitation into machine-speed workflows, making stale credentials and broad scopes more dangerous.
• Connected apps and other delegated identities need lifecycle governance, because trust decisions that outlive their purpose become the easiest route into production systems.

Key terms

• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Connected App: A connected app is a third-party integration that is granted access to a SaaS platform through APIs and OAuth permissions. From a governance perspective, it is an identity-bearing access path that needs ownership, scoping, and periodic review like any other non-human identity.
• Access Blast Radius: Access blast radius is the amount of damage possible if an identity, credential, or permission set is misused or compromised. It is shaped by privilege scope, resource reach, lateral movement paths, and data sensitivity, and it is reduced by tight authorization and segmentation.
• Secret Reuse: Secret reuse is the practice of using the same password, token, or credential across multiple systems or functions. It multiplies the impact of any single dump because one compromised secret can authenticate to several environments, creating a much larger blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.