Vibe hunting compresses threat hunting from queries to narratives

At a glance

What this is: This is a practitioner analysis of how agentic AI changes threat hunting workflows, using the Axios npm supply chain compromise as the working example.

Why it matters: It matters because faster hunting is now an operational control issue for security teams managing identity, package, and telemetry data across SIEM, endpoint, cloud, and CI/CD environments.

By the numbers:

• Axios is a core library for making web requests, downloaded up to 100 million times per week with an average of 80 million, and embedded in web apps, mobile apps, and backend services across industries.

👉 Read Exaforce's analysis of vibe hunting and the Axios npm supply chain attack

Context

Threat hunting depends on the ability to move from suspicion to evidence quickly, but most teams still lose time to query building, data stitching, and manual pivots between tools. In a supply chain event, that delay matters because package exposure, identity context, and endpoint evidence can all age out before analysts have finished reconstructing the story.

The identity angle is real here because the compromise began with maintainer publishing credentials and then reached cloud keys, API tokens, database passwords, and CI/CD systems. That makes the problem less about search speed alone and more about whether teams can connect non-human identity exposure to downstream operational impact.

The Axios case is typical of the broader problem: modern incidents cross package ecosystems, identity systems, and detection tooling faster than many organisations can correlate them.

Key questions

Q: How should security teams use agentic AI in threat hunting without losing control?

A: Use agentic AI to accelerate correlation, enrichment, and evidence gathering, but keep human approval at the points where findings become decisions. The safest model is delegated investigation with tightly scoped access, logged actions, and a clear evidence standard. If the agent cannot explain what data it used and why it reached a conclusion, it should not drive response.

Q: Why do supply chain incidents demand identity-aware hunting?

A: Supply chain incidents often begin with compromised publishing credentials, then move into package distribution, CI/CD execution, and downstream runtime compromise. That means the hunt must connect identity events to code and infrastructure signals. Without identity-aware correlation, teams can see the malicious package but miss how the attacker gained the trust needed to publish it.

Q: What breaks when threat hunting stays tied to SIEM queries alone?

A: Hunting slows down because analysts have to manually translate events across identity, endpoint, cloud, and code systems before they can prove a narrative. SIEM is useful for storage and correlation, but it is not enough when the evidence is spread across package registries, CI/CD, and runtime telemetry. The result is stale findings and weaker containment decisions.

Q: How do you know if AI-assisted hunting is actually improving security?

A: Look for shorter time to validated evidence, more repeatable hunt logic, and detections that are promoted from successful investigations. If the platform only creates faster reports, it is improving workflow, not security. Real improvement shows up when the team can confirm suspicious activity, preserve the chain of evidence, and rerun the same logic later.

Technical breakdown

How agentic AI changes the hunting workflow

Traditional threat hunting is a sequence of manual tasks. Analysts build queries, normalise telemetry, enrich indicators, pivot across tools, and then reconstruct a timeline. Agentic AI changes the workflow by converting an intent statement into a chain of actions, but the key technical point is that the model still depends on a semantic layer and governed access to data. Without that layer, the agent can generate plausible but ungrounded leads. With it, the system can correlate identity, endpoint, network, and code-context signals into a single investigative narrative.

Practical implication: hunting automation only works when the platform can safely query and correlate the data sources that matter most.

Why supply chain attacks are hard to hunt in SIEM alone

Supply chain attacks create scattered evidence across package registries, source control, CI/CD, runtime logs, and identity records. A SIEM can store many of those events, but it does not automatically connect package version changes to publisher credentials, downstream installs, and suspicious follow-on behaviour. In practice, that means the hunter spends time translating one schema into another instead of validating attacker behaviour. The article’s Axios example shows why code context and identity context must sit alongside security telemetry.

Practical implication: teams need cross-domain data models, not just more alerts, if they want to hunt software supply chain compromise effectively.

What turns a hunt into a repeatable detection

A hunt becomes operationally useful when it produces a durable detection or automated follow-up. That requires the system to preserve the hunt logic, the indicators tested, and the evidence that justified the conclusion. Agentic workflows can help by creating a case, re-running the hunt on a schedule, and converting validated leads into a search rule. The architectural shift is from one-off investigation to reusable threat logic, which is where hunting starts to influence detection engineering.

Practical implication: convert validated hunt hypotheses into scheduled checks and detections before the next package compromise lands.

Threat narrative

Attacker objective: The attacker’s objective was to steal sensitive credentials and establish persistent access through a trusted software supply chain path.

1. Entry occurred when attackers gained access to the Axios maintainer’s publishing credentials and used that access to release poisoned npm versions.
2. Credential access and payload execution followed when the malicious package included a hidden dependency that stole cloud keys, API tokens, and database passwords while installing persistent malware.
3. Impact extended into developer pipelines and production systems because any environment that installed the package during the exposure window could inherit the compromise.

NHI Mgmt Group analysis

Threat hunting is becoming a governance problem, not just an analyst workflow problem. Once an organisation relies on agentic AI to compress correlation and enrichment, it has to govern what data the system can see, what actions it can take, and how results are validated. This intersects directly with identity because hunting agents need controlled access to logs, cloud telemetry, code context, and cases. The control question shifts from query skill to delegated investigative privilege, which makes access design part of operational resilience.

Software supply chain compromise now exposes the weakness of fragmented identity context. The Axios example shows how maintainer credentials, package metadata, and downstream execution all sit in different systems until an attack forces them together. That is a familiar governance failure in modern environments: identity data exists, but it is not operationally stitched into detection and investigation. For practitioners, the lesson is that non-human identity exposure should be visible in the same investigative fabric as endpoint and CI/CD signals.

Detection latency is the concept security teams should track more aggressively. The value of vibe hunting is not the AI label, it is the reduction in time between hypothesis and validated evidence. If teams cannot measure how long it takes to move from suspicion to correlated conclusion, they cannot know whether their hunting capability is scaling with the threat. For identity and security leaders, that makes latency a programme metric, not a convenience metric.

Agentic hunting will amplify the value of high-quality identity telemetry. When models can query faster, weak telemetry quality becomes more visible, not less. Poorly linked accounts, incomplete package provenance, and stale case data will create false confidence at machine speed. This is where NHI governance matters: if maintainer credentials, service accounts, and automation tokens are not lifecycle-managed, the hunting layer inherits the same blind spots the attacker exploits.

The practical boundary is still human accountability. Even when AI agents generate queries, create cases, and schedule follow-up hunts, the organisation remains responsible for the evidence standard that determines whether a finding is real. That is the same accountability pattern seen in IAM and PAM: automation can accelerate decisions, but it cannot own the risk decision. Practitioners should treat agentic hunting as a force multiplier, not a substitute for governance.

What this signals

If agentic AI becomes part of the hunting workflow, the governing question is no longer whether analysts can write better queries. It is whether the organisation can safely delegate investigative reach across identity, telemetry, and case systems without turning the hunting tool into a high-privilege observer.

Detection latency: the measure that matters is the interval between a credible hypothesis and a validated conclusion. The shorter that interval, the more likely a team can contain package-driven compromise before identity, CI/CD, and runtime evidence fragment across systems.

For identity-led security programmes, the lesson is to treat maintainer accounts, automation tokens, and pipeline identities as part of the threat hunting surface. A strong investigative layer cannot compensate for weak non-human identity lifecycle control or incomplete provenance data.

For practitioners

• Map hunt automation to delegated investigative access Limit agent permissions to the minimum data sources required for hunt execution, including telemetry, case management, and approved enrichment systems. Review those permissions as you would any privileged non-human identity, because the hunting agent can expose more than it detects if it inherits broad read access.
• Connect package telemetry to identity context Join package registry events, maintainer credentials, CI/CD identity, and runtime execution logs so supply chain investigations do not depend on manual cross-tool correlation. This is especially important when malicious versions are live for only a short window.
• Promote validated hunt logic into repeatable detections Save the indicators, query logic, and decision criteria from each successful hunt, then convert them into scheduled searches or custom detections that can re-run automatically. Preserve the evidence trail so the next analyst can see why the finding was accepted.
• Measure hunting latency as a control metric Track the time from initial hypothesis to validated conclusion, not just mean time to detect. If the organisation cannot reduce that interval, it is still relying on manual search friction rather than a governed detection workflow.

Key takeaways

• Vibe hunting shifts threat hunting from manual query building to governed, AI-assisted correlation across identity and security telemetry.
• Supply chain attacks like Axios show why hunting speed, identity context, and code context now determine whether evidence is still usable.
• Teams should convert validated hunts into repeatable detections and measure how quickly they can reach a trusted conclusion.

Key terms

• Threat Hunting: Threat hunting is the proactive search for signs of compromise that bypassed normal detection controls. It combines logs, telemetry, and investigator judgement to find hidden attacker behaviour before it becomes a larger incident or disrupts recovery.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Software Supply Chain Compromise: A software supply chain compromise is an attack that inserts malicious code into trusted build, package, or deployment paths. The goal is often not immediate application failure, but secret theft, persistence, or unauthorized changes that travel downstream through automated systems.
• Detection Latency: Detection latency is the time between a security event occurring and the team recognising it as actionable. Lower latency improves containment and reduces exposure, while long delays usually indicate missing automation, weak enrichment, or slow escalation paths.

What's in the full article

Exaforce's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step walkthrough of the Axios hunt prompt and how it was refined after the first pass
• Examples of the data pivots used across endpoint, network, CI/CD, and GitHub package context
• How the hunt was converted into a repeatable detection rule and scheduled automation
• Screens and workflow details showing how cases were created and looped back into monitoring

👉 The full Exaforce post shows the hunt workflow, the Axios evidence trail, and the automation loop in detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives identity and security practitioners a structured way to connect delegated access, lifecycle control, and operational governance.