AI-integrated identity controls are failing under real-time phishing

At a glance

What this is: This weekly intelligence report from FireCompass says real-time phishing, patch-bypass activity, and AI-assisted abuse are overwhelming controls that still assume slower decision and response cycles.

Why it matters: For IAM and security teams, the message is that MFA, patching, and application controls must be designed for adversaries that move faster than manual review and human confirmation.

Context

FireCompass’s report is a snapshot of how quickly identity and access assumptions are being stress-tested by active exploitation. The article ties together five incidents from 13 to 19 January 2026, with particular emphasis on real-time phishing, prompt injection, and authentication bypass.

The core governance problem is not just attack volume, but timing. Controls built around user pauses, patch windows, and delayed review cycles are struggling when attackers can exploit a flaw, mirror an authentication flow, or trigger AI-driven action before normal oversight catches up.

Key questions

Q: What breaks when MFA is present but the login can still be relayed in real time?

A: MFA stops simple credential replay, but it does not stop an attacker who can proxy the live login flow and inherit the resulting session. The broken assumption is that successful authentication proves the right person is in control. In real-time phishing, the identity provider sees a valid user, while the attacker owns the workflow that produced it.

Q: Why do exposed management interfaces need immediate attention after a bypass is discovered?

A: Because a bypass on an internet-facing management plane often gives attackers the shortest path from request to privilege. Once unauthenticated access is possible, defenders are no longer managing a theoretical weakness. They are racing active exploitation against a control surface that can expose credentials, admin functions, or code execution.

Q: How should security teams govern sensitive data used by AI systems?

A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.

Q: Should organisations prioritise phishing-resistant MFA over other identity projects?

A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.

Technical breakdown

Real-time phishing defeats human-paced MFA assumptions

The Okta scenario shows why number matching and one-time codes are not sufficient when an attacker can relay prompts and codes in real time. A vishing kit can mirror the legitimate login sequence, capture the victim’s response, and use that response immediately against the real authentication flow. This is not credential stuffing or simple phishing. It is an active interception model that exploits the gap between user perception and session establishment. Practical implication: treat authentication methods that can be relayed live as exposed to session hijack, not just credential theft.

Practical implication: Move high-risk access paths to phishing-resistant MFA and assume live interception unless the factor itself resists relay.

Patch-bypass exploitation compresses the remediation window

The SmarterMail incident shows how a fix can be reverse-engineered and operationalised within 48 hours. Once a public-facing endpoint accepts unauthenticated requests or trusts a malformed flag, the attacker can move straight from remote request to administrative control and then to code execution. That collapses the old assumption that patch release creates a safe buffer. In practice, the control problem is not only whether a patch exists, but whether the exposure window is short enough to survive active hostile analysis. Practical implication: evaluate internet-facing exposure as a live race condition, not a maintenance task.

Practical implication: Prioritise externally reachable management and authentication surfaces for immediate validation, not next-cycle remediation.

AI-integrated workflows need authorization before action, not after prompt entry

The Gemini case illustrates a broader mechanism in AI-integrated identity controls: the system may faithfully execute instructions embedded in user-facing content unless explicit authorization gates are in place. A malicious calendar invite can become a hidden prompt, and a normal user query can trigger unintended disclosure into a new event or other accessible object. The security failure is not generic AI risk. It is a missing boundary between user intent, model interpretation, and data mutation. Practical implication: govern AI-connected identity actions at the point of execution, not only at the point of model access.

Practical implication: Require explicit authorization for AI-driven writes or disclosures, especially where the model can touch calendars, mail, tickets, or other sensitive data.

Threat narrative

Attacker objective: The attacker aims to convert a momentary interaction into durable authenticated access, privileged control, or sensitive data exposure before defenders can intervene.

1. Initial access begins when attackers use a live vishing or phishing flow to place themselves between the victim and the authentication process, or when they probe a public-facing application with malformed requests to reach an exposed management interface.
2. Credential or session abuse follows when the attacker relays MFA output in real time, resets administrative access through an unauthenticated endpoint, or leverages injected instructions to trigger an unintended model action.
3. Impact occurs when the attacker gains authenticated access, administrative control, or unauthorized disclosure, then uses that foothold to intercept communications, modify data, or establish persistence through backdoor or follow-on access.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Real-time phishing is a failure of authentication timing, not just factor strength: The Okta incident shows that MFA designed for human confirmation can still be defeated when the attacker can coordinate the prompt, the user response, and the login session in parallel. The issue is not whether MFA exists, but whether the control can survive a live relay path. Practitioners should treat factor choice as a time-and-channel problem, not only an identity proofing problem.

Patch release no longer equals risk reduction when exploitation can be operationalised within hours: The SmarterMail case demonstrates that internet-facing identity surfaces now sit inside a compressed exploitation cycle. Security teams that still plan remediation around weekly maintenance rhythms are assuming an exposure window that attackers no longer grant. The implication is a tighter model for exposed authentication and management paths, with faster validation and containment expectations.

AI-integrated identity controls need a new trust boundary between intent and execution: The Gemini incident shows that a model can be the broker for identity-adjacent action without the user intending the resulting data disclosure. That means the governance assumption that user input equals approved action is no longer safe in AI-connected workflows. Practitioners need to rethink where authorization lives when a model can mutate calendar entries, summaries, or other user-visible records.

Session interception, prompt injection, and patch bypass now form one operational category of identity abuse: These incidents are different in mechanism but similar in outcome. Each converts a legitimate interaction into attacker-controlled action faster than conventional review cycles can react. The field should stop treating MFA abuse, AI abuse, and patch bypass as separate hygiene issues and instead recognise them as shared evidence that identity controls must operate at machine speed.

What this signals

Real-time relay attacks collapse the review window: If the attacker can capture and reuse authentication data during the same interaction, there is no safe pause for human verification to catch up. That means the control must resist live interception rather than merely detect stolen credentials after the fact.

AI-connected systems need execution controls, not just model controls: Once an assistant can read from or write to business systems, the security boundary shifts from prompt handling to action approval. Practitioners should assume prompt injection is a governance issue whenever the model can change records or move data.

Exposure management now needs speed as a design requirement: Public-facing identity and administration surfaces should be treated as live attack paths the moment a bypass or RCE disclosure appears. The practical question is no longer whether a patch exists, but whether the organisation can validate and contain exposure before exploitation scales.

For practitioners

• Require phishing-resistant MFA for sensitive access paths Replace relayable factors on administrator, finance, and remote access workflows with hardware-backed authentication that cannot be approved through a live proxy. Reserve push or TOTP methods for lower-risk use cases and remove them where session hijacking would be high impact.
• Shorten validation cycles for internet-facing management interfaces Treat public-facing authentication and administration endpoints as emergency exposure surfaces once a bypass or RCE path appears. Confirm patch status, remove unnecessary exposure, and verify whether compensating controls actually restrict access to the affected interface.
• Add explicit authorization gates to AI-connected writes Prevent AI assistants from creating, modifying, or disclosing records unless the user has approved the specific action in context. Apply this to calendars, mail, ticketing, and other systems where a hidden prompt could turn a query into unauthorized data movement.
• Review identity telemetry for live relay indicators Watch for unusual login geography, unexpected second-factor prompts, repeated authentication retries, and sessions that complete immediately after a voice or chat interaction. Correlate those signals with help-desk contact and user-reported phishing attempts.

Key takeaways

• The report shows that identity controls fail when attackers can interact at the same speed as the user or faster than the patch cycle.
• The incidents span authentication abuse, patch bypass, AI prompt injection, and malware adoption, which makes the pattern broader than a single product or protocol.
• Security teams need controls that verify live sessions, gate AI-triggered actions, and shrink the window between disclosure and exposure validation.

Key terms

• Real-Time MFA Relay: A live attack pattern where an attacker intercepts a user’s authentication response and reuses it immediately against the legitimate service. The factor is not stolen for later use, but relayed during the same interaction, which defeats controls that assume a delay between approval and attacker action.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Patch-bypass Window: The short period after a vulnerability is fixed in which attackers reverse-engineer the change and weaponise it before defenders have fully validated exposure. For exposed identity or administration services, this window can be measured in hours, not days, and should be treated as active risk.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.