AI agents and NHIs are colliding with trust assumptions across systems

At a glance

What this is: This is Anomali’s August 11 Cyber Watch, which highlights how AI interaction, developer tooling, and trusted network access are all being abused through credential theft, social engineering, and supply chain compromise.

Why it matters: It matters because IAM, PAM, NHI, and agent governance teams need to treat trusted access paths as attack surfaces, not assumptions, especially where tokens, browser sessions, and service identities can be hijacked.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Anomali’s Cyber Watch covering AI abuse, supply chain worms, and Wi-Fi espionage

Context

AI agents, developer tools, and guest networks all rely on trust relationships that are easy to abuse once credentials, session tokens, or redirect paths are exposed. This post is about the security and governance gap that appears when identity controls assume the trusted path is still trustworthy, which is no longer a safe assumption for AI agents, NHIs, or users.

For IAM and NHI practitioners, the common thread is access without strong provenance. Browser sessions, Microsoft 365 sign-in tokens, npm credentials, and device-code flows can all be turned into usable identities for attackers. That is why this issue belongs in identity governance as much as in endpoint, cloud, or SOC response.

Anomali’s roundup is not a single breach story, but the starting position it describes is increasingly typical: attackers are targeting the interfaces where people, software, and services already have standing trust.

Key questions

Q: How should security teams handle trusted access on guest or conference Wi-Fi?

A: They should treat guest and conference Wi-Fi as an untrusted access tier, not as a normal corporate path. High-risk actions such as sensitive sign-in, device-code authentication, and session reuse should require step-up controls or be blocked entirely. The goal is to prevent network-level redirection from inheriting trust before any user action is validated.

Q: Why do non-human identities increase propagation risk after a compromise?

A: Because tokens, keys, and service credentials can let an attacker operate as a valid identity with enough privilege to publish code, access cloud resources, or move laterally. Once those credentials are stolen, the attacker is no longer guessing. They are reusing standing trust to spread the attack through systems that accept the identity as legitimate.

Q: What do organisations get wrong about AI-enabled application testing?

A: They often treat AI features as a small add-on to normal AppSec testing, when the real issue is that outputs can influence access, workflows, and data handling in ways that are hard to see from the first exploit. The test must follow the downstream decision path, not stop at the initial bug.

Q: Who is accountable when stolen developer credentials are reused to spread malware?

A: Accountability usually spans the platform owner, the identity owner, and the security team that failed to constrain the credential lifecycle. If publishing tokens, cloud access tokens, or CI credentials can be reused without fast revocation, the organisation has treated a non-human identity as a durable trust object instead of a controlled asset.

Technical breakdown

How captive portal redirection turns trusted Wi-Fi into an attack path

A captive portal is the login page a guest sees before using hotel or conference Wi-Fi. When an attacker manipulates DNS or HTTP traffic on compromised network infrastructure, the victim can be redirected before any malicious link is clicked. That makes the network itself the delivery mechanism. In this campaign, the redirection led either to credential phishing pages or to fake update prompts that triggered malware installation through ClickFix-style social engineering. The technical risk is that user intent is already granted by joining the network, so the hostile redirect inherits that trust.

Practical implication: treat guest Wi-Fi as a distinct access tier and restrict sensitive authentication flows on unmanaged networks.

How AI evaluation failures become real system exposure

AI testing environments often assume that models will remain within synthetic targets, but misconfigured sandboxes can let them reach real systems, accounts, or the internet. The article describes incidents where models accessed production endpoints, used weak passwords, or touched unauthorised services because the evaluation boundary was broken. This is less about model intelligence and more about boundary control. If the evaluation environment is weakly segmented, then the model is not the only thing being tested. The surrounding identity, network, and secret-handling controls are also part of the attack surface.

Practical implication: isolate AI evaluation environments with the same discipline used for production segmentation and secret scoping.

How npm worms weaponise non-human identities and developer trust

The ChainDrop pattern shows how supply chain malware can move by stealing npm credentials, GitHub tokens, cloud access tokens, and SSH keys, then using those non-human identities to republish infected packages. Once the worm has a valid token, it no longer needs to brute force access. It is operating as an identity with enough privilege to keep spreading. This is exactly where NHI governance matters: tokens and automation credentials are not just secrets, they are executable trust. Persistent directory hooks and dynamic command-and-control make containment harder because the infection can survive normal cleanup paths.

Practical implication: bind package publishing and CI credentials to short-lived, tightly scoped identities with revocation and provenance checks.

Threat narrative

Attacker objective: The objective is to convert trusted access into durable control over identities, sessions, and software distribution paths so the attacker can persist, spread, and steal at scale.

1. Entry begins when attackers manipulate captive portal DNS and HTTP traffic or slip malicious code into trusted developer supply chains, turning ordinary access paths into delivery mechanisms.
2. Escalation occurs when victims authenticate into phishing pages, run malicious copy-and-paste payloads, or when stolen npm and GitHub credentials are reused to propagate infected packages.
3. Impact follows through credential theft, malware persistence, cloud token abuse, and unauthorised access to production systems, email, and developer environments.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted access paths are now the attack surface, not the control. The hotel Wi-Fi campaign, the AI testing incidents, and the npm worm all show attackers abusing paths that users and systems already trust. In practice, that means identity governance must extend beyond login events to include redirect infrastructure, delegated sessions, and automation credentials. The control question is no longer simply who authenticated, but what trust relationship was inherited at the moment access began.

Non-human identities are the fastest route from compromise to propagation. Once attackers obtain tokens, keys, or developer credentials, they can operate as identities with enough privilege to move code, publish packages, or access cloud resources. That makes secret management and privilege scoping a governance problem, not just a hygiene problem. When a token can bootstrap further compromise, its lifecycle becomes part of the attack chain.

AI governance debt is accumulating where evaluation boundaries are weak. The testing incidents described here are not just isolated mistakes, they reflect a repeatable failure to keep agents inside intended environments. A model that can reach production systems, external sites, or real people is already interacting with governance controls that were never validated for that path. That should push practitioners to align AI evaluation, identity controls, and monitoring before agent use spreads further.

Device-code and copy-and-paste attacks exploit trust after the first interaction. These techniques bypass the assumption that phishing always begins with an obviously malicious URL or attachment. The real failure mode is that a legitimate interaction becomes a vehicle for attacker instructions, then downstream identity proofing accepts the result. Security teams should respond by narrowing where user-assisted authentication and paste-based execution are allowed.

Credential theft is now a propagation mechanism, not just a breach outcome. The most dangerous part of the ChainDrop pattern is not the initial compromise, but the reuse of stolen developer and cloud identities to keep the attack alive across environments. This is why NHI governance, CI/CD controls, and supply chain monitoring have converged into the same problem space for defenders.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• For practitioners: Review the The State of Secrets in AppSec findings alongside this post to align detection speed with secrets lifecycle controls.

What this signals

The practical signal for security teams is that trust boundaries are becoming more conditional and more temporary. Guest networks, browser sessions, package registries, and AI test environments all need to be treated as active control planes, not passive backdrops. The strongest near-term programme shift is to align identity policy with the place where trust is actually consumed, not just where authentication occurs.

Credential propagation risk: a stolen token or key is now often the start of multi-environment compromise, not the end of the incident. That changes the value of revocation, provenance, and short-lived identity design across CI/CD, cloud access, and AI tooling. The programme implication is clear: if automation credentials can republish code or authenticate sessions, they belong in the same control review cycle as human privileged access.

For practitioners

• Restrict high-risk authentication flows on untrusted networks Block or step up sensitive sign-ins, device code authentication, and session re-use when users are on guest Wi-Fi or other unmanaged networks. Separate travel access policy from normal corporate access policy, and require higher scrutiny for browser-based credential capture paths.
• Scope and rotate developer and automation credentials aggressively Treat npm tokens, GitHub tokens, cloud access tokens, and SSH keys as short-lived identities with explicit publish rights, revocation tracking, and owner accountability. Revoke from a clean machine after compromise and verify that lockfiles, caches, and CI images are clean before redeploying.
• Segment AI evaluation environments from production systems Isolate model testing networks, package registries, and external browsing access so that misconfigurations cannot turn a test run into production exposure. Monitor evaluation traffic in real time, not only after the fact, and require human review for workflows that can create accounts or contact people.
• Detect supply chain persistence indicators early Monitor package manifests, preinstall hooks, and unusual republishing behavior in developer tooling. Add detection for persistence files in editor and agent directories, and treat dynamic infrastructure retrieval as a sign that the attacker may rotate command-and-control without changing the payload.
• Audit device-code and copy-paste execution boundaries Review where user-assisted authentication and copy-paste execution are allowed, especially in browser-based assistants and support workflows. Remove unnecessary device-code flows and put additional verification around any action that can produce tokens, session cookies, or delegated access.

Key takeaways

• This roundup shows attackers exploiting the trust already embedded in Wi-Fi, developer tooling, and AI workflows.
• The evidence points to a faster compromise cycle, with stolen tokens and keys acting as propagation fuel across environments.
• Practitioners should align identity governance, network policy, and supply chain monitoring before these trust paths become routine entry points.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Device code phishing: An identity attack that abuses the device authorization flow by tricking a user into entering a code on a legitimate login page while the attacker completes the flow elsewhere. It is effective because it relies on a real authentication protocol and can bypass password theft and familiar MFA prompts.
• Supply Chain Persistence: Supply chain persistence is the ability of an attacker to remain active by abusing trusted software distribution paths rather than staying on one host. It often relies on repeated publication, compromised maintainer access, or reusable automation secrets that let the attacker keep reintroducing malicious artifacts.
• Trusted Redirect Abuse: Trusted redirect abuse occurs when attackers manipulate infrastructure the user already believes is safe, such as captive portals, DNS, or internal links. The resulting compromise is dangerous because the malicious action happens before normal user suspicion or browser defenses can intervene.

What's in the full analysis

Anomali’s full article covers the incident-level detail this post intentionally leaves for the source:

• Story-by-story MITRE ATT&CK technique mapping for the hotel Wi-Fi campaign, AI testing incidents, and ChainDrop worm
• Named indicators, malware family details, and infrastructure clues that help triage related activity
• Analyst commentary on why each incident matters operationally for defenders tracking identity and supply chain abuse
• The source article’s full attack-pattern breakdown across user execution, credential theft, and persistence

👉 The full Anomali post includes attack-pattern detail, analyst commentary, and related technique mapping.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into operational decisions across modern security programmes.