. 13 stories, about 4 minutes.
Editor's take
Google Threat Intelligence and Mandiant report attackers using stolen IAM credentials, service account keys, GitHub tokens and exposed API keys to run up enterprise LLM bills, in some cases to $1 million. The credentials are the familiar non-human kind; what’s new is how fast they turn into money, with fraudulent charges topping $100,000 in a single day. If spend alerts on your AI accounts go to finance rather than security, this is a good week to change that.
Agent and non-human identity
Google reports LLMjacking attacks using stolen cloud credentials run up charges near $1 million
Google Threat Intelligence and Mandiant found attackers hijacking enterprise LLM access via stolen IAM credentials, service account keys, GitHub tokens and exposed API keys, with some organizations billed up to $1 million. Practitioners should treat these non-human credentials as primary targets, since fraudulent charges can exceed $100,000 in one day.
The Hacker News
Delinea blog: AI agent queries are logged under developer credentials, not the agent
Delinea says audit trails attribute actions by AI agents to the human whose credentials the agent used, so the log cannot show who actually ran a query. It cites its 2026 report quoting Gal Diskin on this limitation.
Delinea Blog
Glow Labs: AI coding agents install deprecated, unpatched MCP servers on developer machines
Glow Labs found coding agents (Claude Code, Cursor, Codex CLI) installing archived MCP servers from training data, including ones with four unpatched high-severity flaws. Teams should inventory MCP configs for deprecated @modelcontextprotocol servers and approve one server per service.
Help Net Security
Aembit explains AI agent registries as an inventory layer for enterprise identity security
Aembit's guide describes agent registries as catalogs of agents, owners and identity provider details, populated through CI/CD or platform self-registration using A2A Agent Cards. IAM teams can use the registry metadata as input for access policies on non-human identities.
Aembit Blog
CyberScoop op-ed: CISA 2030 strategy exposes persistent machine credentials and unchecked AI agent permissions
An op-ed by OmniTrust CEO David Sequino argues that CISA's new strategy runs into stale device, contractor and machine-identity approvals, and AI agents holding excessive permissions. It urges reassessing access when suppliers or roles change, enforcing limits on agent actions, and testing that credentials can be revoked safely.
CyberScoop
Opal hosts free agent.ID virtual event on governing AI agents, November 5
Opal is running a free virtual event on November 5, 10am–12pm PT, where security and identity leaders discuss treating AI agents as governed identities. Sessions cover agent ownership, access reviews, standing versus just-in-time access, and emerging agent identity standards.
Help Net Security
Breaches and incidents
Start with Identity report: MFA bypassed or inapplicable in most 2025-2026 identity breaches
Start with Identity's Identity Breach Report 2026 classified 115 breaches; 20 of 43 in 2025-2026 abused paths with no login for MFA, and machine identities reached 32.6% of recent cases. Its control ranking puts non-human identity inventory with short-lived credentials second, behind phishing-resistant MFA.
Start With Identity
Harvard alumni and donor data from ShinyHunters extortion breach added to Have I Been Pwned
A November 2025 breach at Harvard, tied to a ShinyHunters pay-or-leak extortion attempt, exposed 850,537 email addresses plus donor, alumni and some staff profile data. Affected individuals now face greater phishing and social-engineering exposure; no authentication system compromise is reported.
HIBP Breaches
Vendor moves
CrowdStrike to acquire Fiddler and Dreadnode, adding AI agent observability and testing
CrowdStrike signed deals to buy Fiddler AI (agent observability) and Dreadnode (pre-deployment AI attack testing), and announced an AI Kill Switch that lets humans stop agents at runtime. Agents can hold valid credentials yet misbehave, so agent decision records and stop controls now sit alongside credential governance.
CyberScoop
Microsoft Entra Global Secure Access now sold as combined Private and Internet Access offering
Microsoft will sell Entra Private Access and Entra Internet Access together as one Global Secure Access offering from November 2, 2026, while both stay available separately. The announcement also lists recent previews and GA features, including Cloud Firewall, TLS inspection, and Universal CAE signals.
Microsoft Entra Blog
Standards and regulation
NIST SP 800-63B-4 drops security questions as an account recovery method
NIST SP 800-63B-4 no longer recognizes knowledge-based security questions as an authenticator and recognizes four recovery methods instead: saved codes, issued codes, recovery contacts and repeated identity proofing. Recovery flows relying on security questions must migrate to one of these or document a risk analysis.
WorkOS Blog
Worth your time
WorkOS explains password spraying and why per-account lockouts miss it
WorkOS published a guide on password spraying, which tries a few common passwords across many accounts so no single account trips a lockout. It advises detecting many accounts failing on one password fingerprint and blocking common or breached passwords.
WorkOS Blog
SWI report: identity vendors made 18 of 33 deals but paid under $1B
SWI's Identity Consolidation Report 2026 counts 33 identity acquisitions in 2025-2026, with non-identity buyers paying almost all of the $62.96 billion priced value. Five AI-agent identity vendors were acquired in 87 days; check current ownership of non-human identity tooling.
Start With Identity
Get the week by email
One email on Fridays with the week's top stories. No sponsors.