Audit agent credential and pipeline paths in a 10-hour breach

If your agents can read a repo, trigger a build, or call a model endpoint, an attacker can use the same paths. On September 2, 2026, AI agents spent ten hours breaching an enterprise's cloud, identity, CI/CD, and SaaS defenses. The operation used more than 50 MITRE ATT&CK techniques, a taxonomy for tracking adversary behavior. Its impact matched what multiple red teams might normally accomplish in about two weeks. The breach is an hour-by-hour map of the paths to audit: repo tokens, CI/CD service-account scope, secrets-manager paths, AI endpoint cloud keys, and human merge gates.

Repo tokens opened the secrets store

Child agents combed code repositories for embedded tokens and service passwords, and the exposed credentials gave the attackers administrative and root-level access in the secrets management system. Make that the audit target. Repo read access lets an agent find the token. A secrets-store token gives the agent a path to higher access.

Name the repositories your agents can search, clone, or read. Map the tokens, service passwords, and environment files that sit in branches, comments, examples, or test fixtures. Trace the secrets-manager paths those tokens can reach. A production result is an exposed path.

Treat every repository as a credential store until proven otherwise. Scan for tokens in deleted branches, forks, and cached artifacts. Look for service passwords in notebooks, scripts, and generated files. Searchable tokens are agent-reachable tokens.

Pipelines and AI endpoints hid stolen keys

The attackers launched unauthorized CI/CD builds and ran custom workflows to pull cloud access keys. The pipeline became a credential bridge. A token that only needed to start a build became a way to extract keys the build could see. Scope service accounts accordingly.

Review every pipeline service account your agents can trigger. List the builds they can start, the variables they can read, and the cloud credentials those builds can export. Builds that print keys hand keys to agents. Limit the workflow to the minimum environment it needs. Make key retrieval require a separate approval that the agent cannot request.

Scan for keys in build logs, job artifacts, and temporary files. Map variables that carry more access than the build needs. Require a human to approve any workflow that reads a key. Unapproved workflow runs expose the key to the agent.

The attackers used stolen cloud keys to take over the victim's AI endpoints and routed orchestration traffic through the victim's compute, masking it as normal model calls. Agent-reachable model endpoints give the attacker a place to hide control traffic.

Inventory the cloud keys that can reach AI endpoints. Mark the keys that can create, read, or invoke model resources. Trace the logs that distinguish internal orchestration from customer model calls. Normal-looking inference traffic exposes the endpoint. Separate agent traffic from customer traffic. Alert on orchestration patterns that do not match normal model usage.

Look for endpoints that accept keys from multiple environments. Identify model resources that agent service accounts can invoke. Require a human to approve any change that widens endpoint access. Agent-added endpoint keys make the endpoint part of the attack path.

Human merge gates stopped the backdoor

The effort to insert a backdoor into Terraform was halted when branch protections required changes to pass review by multiple parties before they could be merged. Put that on the final audit list. A human merge gate can stop an agent from completing a change it cannot safely finish.

Find every path where an agent can open a pull request, edit infrastructure code, or trigger a merge. Catalog the changes that require human review. Identify the changes that can merge automatically. Automatic infrastructure merges leave the gate missing. Put a human on the path for changes that alter access, secrets, or deployment.

Keep the audit current. The audit is only useful if it names the owner, the rotation date, and the approver for each path.

• Record the owner of every token your agents can read.
• Record the last rotation date for each service password.
• Record the build variables each workflow can read.
• Record the model endpoints each cloud key can invoke.
• Record the human approver for each merge path.

Blank fields need an owner before the next agent run. Run the audit after every repo, pipeline, or endpoint change. The attackers had an agent produce an 80-page technical audit documenting dozens of exploited findings. Keep the audit repeatable and tied to the five fields above.