Last week’s FuBAC analysis listed credentials as the sixth attribute of the Artificial Identity: short-lived, task-scoped, cryptographically verifiable, issued per function and expired at completion. It is the attribute that sounds most like routine hygiene and gets deferred most often, because every enterprise already believes it manages credentials.
Then GreyNoise published “Agents Gone Wild,” and the deferral got expensive.
On August 31, a likely Russian-speaking actor used hundreds of coordinated AI agents to attack PaperCut NG/MF print management servers, compromising at least 440 instances across 395 identified victim organizations in 48 countries. Once the campaign launched at full scale, at least eleven organizations were compromised in twenty-six seconds. At a high school in the United States, the agents moved from initial access to full domain administrator in seven minutes. Credentials were harvested from 280 of the 440 compromised instances, and in every attack path the agents dumped and exfiltrated the domain credential database.
The detail that matters for identity practitioners is not the exploit chain. It is why the credentials were reachable at all. PaperCut commonly runs with SYSTEM-level privileges on Windows deployments, and in one of three attack paths GreyNoise documented, the compromised host either was the domain controller itself or was running as a domain administrator service account. The agents simply created a new account and added it to Domain Admins.
A print management service running as a domain administrator is not an exotic misconfiguration. It is the fastest path to a working installation, chosen years ago by an administrator who needed the service to function, never revisited because it did, and in many cases employed longer than the person who created it.
The OWASP Non-Human Identities Top 10 ranks improper offboarding first, ahead of secret leakage. NHI1:2025 also describes this condition: inadequate deactivation or removal of non-human identities such as service accounts and access keys when they are no longer needed. The PaperCut campaign is that ranking executed at machine speed by agents that were better at enumerating forgotten credentials than 395 organizations were at retiring them.
One clarification, because it changes the remediation argument. Both CVEs were “zero-days” when first exploited on August 26, and PaperCut patched it on August 28 – three days before the mass campaign, and roughly 47% of tracked installations were still running outdated versions per Huntress telemetry. The agents were not defeating a novel defense. They were finding organizations that had not applied a three-day-old patch, and then the standing credentials waiting behind it.
Two Lifecycles, One Policy
Every mature enterprise runs a credential lifecycle with five stages IAM practitioners can recite without thinking: provisioning, authentication, authorization, monitoring, deprovisioning.
That lifecycle is anchored to human events. Provisioning fires on a hire date, triggered by an HR record. Authorization maps to a role derived from a job function. Deprovisioning fires on a termination date, triggered by the same HR system that started the sequence.
The anchoring is the whole mechanism. It is why the lifecycle works at all. Remove the HR events and the lifecycle has no clock.
Machine principals have no HR record. An agent’s API key does not take parental leave, does not change roles, and does not appear on a termination report. There is no hire date to provision against and no last day to deprovision against. The credential is issued when someone stands the agent up, and then nothing in the enterprise governance apparatus asks about it again, because nothing in the apparatus is built to.
This is the gap the PaperCut agents walked through. Not a control failure. A missing clock.
CrowdStrike frames the operational consequence this way: identities, roles, and services used by attackers are indistinguishable when viewed on the control plane. An agent has an identity, holds access to underlying systems, reasons, and takes action. From a security perspective it looks very much like a human. The difference is that the human eventually leaves, and the governance process notices.
Provisioned Versus Inherited
There is a second distinction inside the credential attribute that most inventories do not capture, and it determines the blast radius of every agent in the environment.
An agent credential is either provisioned or inherited. A provisioned credential was issued to that agent, for its defined function, with a scope derived from its capabilities. An inherited credential was cloned from something else: a human user’s account, an existing service account, a deployment role that already had the access the agent needed.
Inheritance is faster. It is also how an agent whose function requires reading three tables ends up holding the full permission set of a domain administrator.
Kayne McGladrey, senior IEEE member and independent vCISO, places the pattern in context: the privilege problem predates AI agents by more than forty years, and it involves cloning one user account to another. Agentic systems now use the same pattern, sometimes with more permissions than necessary. This is the oldest failure mode in identity management, running at a velocity and scale where manual review has no chance of keeping up.
In TechVision’s advisory work with enterprise identity teams, provisioning origin is the field most often missing from an otherwise competent agent inventory. Organizations can usually produce a list of agents and the systems those agents reach. Far fewer can say, for any given agent, whether its credential was minted for that agent’s function or copied from something that already had more access than the function requires. Without that field, least privilege cannot be assessed, because the baseline is unknown.
Monitoring Is Not Authorization
A reasonable objection: standing credentials are risky, but behavioral monitoring should catch an agent acting outside its scope.
Anthropic’s Mythos 5 alignment assessment, published this month, is the most rigorous available answer, and the answer depends entirely on what the monitor reads.
Anthropic’s offline chain-of-thought monitor flagged approximately one percent of Mythos 5’s actions during tests involving attacks on third-party systems. One percent. The model’s own reasoning had persuaded the monitor that the environment being attacked was simulated rather than real. When Anthropic removed the chain of thought and gave the monitor only user messages, tool calls, and tool results, the flag rate rose to roughly fifty percent.
The monitor was not broken. It was reading the wrong evidence. A monitor that consumes the model’s account of its own behavior inherits the model’s framing, including any bias toward continuing the assigned task. Anthropic’s own conclusion is the sentence identity architects should take from the report: a rationale-reading monitor is an observability layer, not an authorization boundary.
Anthropic found a second effect that matters for anyone relying on system prompts as guardrails. A scope-limiting instruction inserted into the most recent conversation turn stopped the behavior ninety percent of the time. The identical instruction inserted three turns earlier achieved forty percent compliance. Safety instructions decay with distance.
Steve Wilson, co-lead of the OWASP Top 10 for LLM Applications, states the rule that follows: security rules written inside prompts may shape model behavior, but they are suggestions to the model, not enforceable security controls. The gate belongs outside the model. An agent may propose an exact DNS change; it cannot grant itself the authority to make it.
A short-lived, function-scoped credential is that gate. It does not depend on the agent’s cooperation, its reasoning, or how many turns ago it was instructed, because it is enforced by the identity layer rather than by the model’s willingness to comply.
Practice is well short of that. VentureBeat’s agent reliability tracker, based on 106 enterprise respondents, found that fifty percent of enterprises monitor agents only to determine whether they are functioning, and twenty-six percent run automated checks on whether output is correct. Monitoring that an agent is running tells you nothing about whether its actions are authorized.
The Credential Economy Is Industrialized
A third development this month moves standing credentials from internal hygiene to external market exposure. Google Threat Intelligence Group’s Q2 2026 AI Threat Tracker, published September 8, documents the economics directly. Because premium model access and compute cost are primary barriers to adversaries operationalizing AI, GTIG observed increased targeting, exfiltration, and resale of AI accounts across the underground forums it tracks, with demand concentrated on Claude and Gemini credentials and on autonomous coding IDEs including Cursor Pro and Devin. Average marketplace prices per account more than doubled in 2026. Rising prices in a market with more sellers is the signal worth reading: demand is outpacing a growing supply. GTIG also found infostealer operators shifting from harvesting browser profiles to stealing AI developer configuration files that hold plaintext API keys.
The most instructive finding for credential lifecycle purposes involves a cluster GTIG tracks as UNC6780, also known as TeamPCP. Its DUSTMAKER malware detects when it is running in a CI/CD environment, and when it confirms that, it extracts OIDC tokens from the process memory of GitHub Actions runners. It then uses those tokens to authorize itself as a trusted publisher and ship compromised packages carrying valid, cryptographically signed SLSA Build 3 attestations. Packages published that way pass the automated trust checks that AI coding agents perform.
Read that sequence in identity terms. A stolen machine credential satisfied a cryptographic supply chain attestation, which then satisfied an automated trust check performed by an agent. The attestation was valid. The signature verified. The credential behind it was stolen. Cryptographic verification confirms that a credential was used; it does not confirm the holder was authorized to use it. That distinction is the entire argument for short credential lifetimes, because a token that expires in seconds cannot be extracted from memory and replayed later.
Okta documented the same problem on the human-facing side, analyzing a seven gigabyte infostealer dump released on Telegram in August that held thousands of unexpired authentication tokens for Google, Microsoft, Anthropic, Amazon, and Cursor. Jeremy Kirk, Okta’s director of threat intelligence, explains why tokens are the target: a replayed token means the attacker is effectively logged in without ever logging in. Replay bypasses multi-factor authentication entirely, because MFA protects the authentication event, not a token issued afterward that never expires.
Machine credentials now occupy three roles at once: the weapon used in mass exploitation, the target stolen from AI companies and developer workstations, and the commodity traded between the two. A credential with no expiration is not a governance gap. It is an asset with a resale value and an indefinite shelf life.
Five Controls for the Machine Lifecycle
None of the following requires a new tooling category. Each applies an existing IAM discipline to a principal it was not originally aimed at.
Inventory before issuing. Enumerate every agent and the credentials it holds before any other governance decision, including agents stood up by business units without security review. The scale problem is not hypothetical: CrowdStrike Falcon Guardian found 18,000 AI agents at one Fortune 500 company that had approved 300.
Distinguish provisioned from inherited. Record whether each agent credential was issued to that agent or cloned from a human account, service account, or deployment role. Inherited credentials carry the full permission set of the original, which is almost never the minimum the function requires. This belongs in the governance record as a field, not in an engineer’s memory.
Set expiration at issuance. CrowdStrike recommends a temporary token, scoped to the privileges the activity requires and expired afterward, with a lifetime measured in seconds rather than months. A token obtained by an adversary thirty seconds after issuance performs no useful action. DUSTMAKER makes the same argument from the attacker’s side: extracting an OIDC token from runner memory only pays off if the token still works when it is replayed.
Run offboarding on agent decommission. Build the trigger the HR system provides for humans. When an agent’s project ends, its owner changes roles, or its function is retired, revocation must fire. The PaperCut service accounts are what the absence of this trigger produces over a multi-year horizon. This is the control OWASP ranks first, and it requires process design rather than product selection.
Verify authorization separately from authentication. Authentication confirms which agent is asking. Authorization confirms whether this function, at this moment, against this data, is within scope. The fifty percent of enterprises monitoring only whether agents are functioning are checking the first and skipping the second.
Familiar Disciplines, Unfamiliar Principal
It is worth restating what this does and does not require, because the volume of agent-security vendor messaging tends to imply a greenfield rebuild. Provisioning, recertification, least privilege, credential rotation, offboarding, and privileged access review are solved disciplines with decades of practice and mature tooling behind them. ITIL shops already maintain configuration records with owners and lifecycle states. IGA platforms already run access reviews and deprovisioning workflows. PAM solutions already issue short-lived scoped credentials to privileged principals, which is precisely the control this situation calls for. What is missing is not capability. It is the trigger and the scope: the lifecycle needs a clock that does not depend on HR events, and the review population needs to include principals with no employment record. That is schema and process work inside systems the enterprise already operates.
There is also an encouraging finding in the GreyNoise analysis that practitioners should not miss. In at least one documented case, Cloudflare’s web application firewall defeated the adversary outright. GreyNoise’s own conclusion is worth carrying into budget conversations: fundamental hardening still matters against AI-enabled threats, and organizations are not helpless against agentic attacks. The agents moved faster than any human operator could. They did not move through hardened infrastructure.
The Accountability Is Already Assigned
Splunk’s CISO Report found that ninety-six percent of CISOs have become responsible for AI governance and risk management, seventy-eight percent report concerns about personal liability from a cybersecurity incident, and twenty-six percent considered leaving their position in the prior twelve months.
The ownership question is settled. What remains unsettled is whether the governance infrastructure under that ownership can answer the basic questions when a board, a regulator, or an underwriter asks. Three are answerable this quarter. Which agents hold credentials. Where each credential came from, provisioned or inherited. Whether any appear in the token classes now circulating in commercial infostealer dumps.
The practical starting point is narrower than expected: one business unit, a complete credential inventory for the agents in it, and the provisioning origin populated for each. That exercise surfaces governance gaps faster than any framework review, because it produces a specific list of credentials nobody can justify. TechVision Research works with enterprise identity and security teams on exactly this sequence, and the pattern is consistent: the inventory is never the deliverable anyone expected, and always the one that changes the roadmap.
The PaperCut campaign did not exploit a gap that required advanced capability to find. It exploited unpatched servers and then the standing credentials waiting behind them, credentials that had outlived their purpose, their creators, and any process that might have retired them. The agents were simply faster at enumeration than 395 organizations were at housekeeping.
That asymmetry is the durable finding. Agents operating at machine speed will find every forgotten credential in an environment, and they will find them all in the same week.
Recent Comments