Between 8 and 18 August 2025, an attacker exported data from the customer records of more than 700 companies.

No employee was phished. No password was guessed. No multi-factor prompt was defeated, because none was ever shown.

The attacker had a token belonging to an AI chat integration called Drift. A token is the credential software presents when it acts on your behalf, the thing that gets issued once when you connect two systems and then quietly works forever. Google Threat Intelligence and Mandiant, who tracked the group as UNC6395, described what happened next in a sentence worth reading slowly. The actor systematically exported large volumes of data from numerous corporate Salesforce instances.

Then they went looking through it. Not for customer names. For more credentials. Amazon access keys, passwords, Snowflake tokens, and the login pages for company VPNs.

The chatbot's credential was not the prize. It was the door.

Notice what the target was. Not a database, not a server, not a network. A sales tool, connected to a customer system, by somebody in a revenue team who wanted the chat transcripts and the account records in one place. That integration is a good idea. Most organizations have dozens like it and could not name half of them.

The victim list is the argument

The organizations named in reporting on the campaign include Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, Tanium and Zscaler.

Read that list again. Those are security companies. Several of them sell the products you would buy to prevent this. I spent years at two of them and I would have told you, sincerely, that their identity hygiene was better than their customers'.

It probably was. It did not matter, because nobody was attacking their identity hygiene. The attacker used a legitimate credential belonging to a third-party application that had been granted access on purpose, by someone doing their job, through an approved integration.

There is no misconfiguration to point at here. The system worked as designed.

That is what makes it hard to discuss internally. Every incident review wants a mistake, because a mistake can be corrected and the meeting can end. This one offers a decision instead. Somebody connected a useful tool to a system of record, which was the right call at the time, and the connection outlived everyone's memory of having made it.

One hundred and nine to one

The reason this is about to get worse is arithmetic.

A report published this month puts machine identities at 109 for every human in the enterprise, up from 82 the year before. Machine identities are the accounts that are not people. Service accounts, API keys, tokens, bots and now agents.

Treat the exact number carefully, because other credible estimates for the same period range from 45 to 1 up to 144 to 1. That spread is not sloppiness. It is the finding. Estimates of a population differ threefold when nobody has counted it, and nobody has counted it because these things get created by developers and integrations rather than by an onboarding process.

The same report says 99 percent of organizations have adopted AI agents, and 40 percent have already given those agents access to organizational data.

Note the order of those two numbers. Adoption is effectively universal. Granting data access is at 40 percent and climbing. The gap between them is the window you still have.

The number that should end the meeting

Two findings from that report do more work than the ratio.

Only 37 percent of organizations say they can revoke an AI agent's credentials.

Only 30 percent have audit logging of what those agents do that cannot be altered afterward.

Set those beside an older finding from the Cloud Security Alliance, whose 2024 survey of 818 practitioners found that just 20 percent had a formal process for offboarding and revoking API keys, and only 15 percent felt highly confident about preventing attacks on non-human identities.

So the population is growing at something like 30 percent a year, a large share of it holds access to real data, and roughly two thirds of organizations cannot switch an individual one off.

Imagine running human access that way. You hire continuously, you never keep a roster, and when somebody leaves you have a two in three chance of being unable to close their account. No board would accept that for employees. It is the current state for the population that outnumbers them a hundred to one.

An identity you cannot revoke is not an identity

Strip identity management back to what it is for. Four capabilities, in order.

  • Issue a credential to a known thing.

  • Scope it to the least it needs.

  • Watch what it does.

  • Take it away.

Human identity does all four, imperfectly but genuinely. Somebody resigns and access ends the same day, because the process exists and somebody owns it.

Machine identity, at most organizations, does the first one. The rest is aspiration. What you have is not an identity system, it is an issuing desk.

That gap was tolerable when the non-human population was service accounts running batch jobs on a schedule. An agent is different in a way that matters. It reads content from outside your control, it decides what to do next, and it holds credentials while doing it. The previous generation of machine identity did one predictable thing forever. This generation improvises.

And it improvises using whatever it read. An agent that ingests a supplier's document and holds a credential to your finance system is one convincing paragraph away from doing something on that supplier's behalf. The credential does not know it was talked into it.

What an agent credential should look like

None of the fixes are exotic. They are unglamorous, which is why they lose to a demo.

Give every agent its own identity rather than letting it borrow a human's or share one with three other services. When something goes wrong you need to know which agent, and a shared credential guarantees you cannot tell.

Make the credential short-lived, so expiry is the default and revocation is the exception rather than a project.

Scope it to the specific records and actions the task requires, not to the role of the person who happened to authorize the integration. The Drift token had access worth exporting because it had been granted access worth exporting.

Log every action to somewhere the agent itself cannot write. If the log lives where the agent can reach it, you have a diary, not an audit trail.

And keep an inventory. You cannot revoke what you have not enumerated, which is the real reason the 37 percent figure looks the way it does.

None of this requires a new category of product. It requires deciding that a credential issued to software is an account, with an owner, an expiry and a record. That is a governance choice rather than a technical one, and it is cheap to make now and expensive to retrofit at 109 to 1.

The test to run this week

Pick one AI integration in your environment. Any one, ideally one somebody enabled without a review.

Ask four questions, and time how long each answer takes.

Which credential does it hold. What can that credential reach. Who approved the scope. And if I needed it off in the next ten minutes, who does that, and would anything else break.

If the fourth question takes longer than an hour to answer, you have found the same condition that made 700 companies part of somebody else's afternoon.

Then ask the version nobody wants. How many other integrations are there, and did anyone ever write them down?

Sources