#non-human-identity

SWI's Identity Funding Report 2026 records 101 identity-security funding rounds from January 2025 to October 2026. 49 of 99 equity rounds targeted AI agents or non-human identities, yet agent-focused seeds and Series A rounds are the same size as everyone else's. What the dataset is and how to use it.

AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It says the exploit is blocked and affected owners were emailed, but has not said how it happened or how many customers were hit.

Kantara Initiative's Digital Identity Risk group found that agentic AI needs a separate risk framework from its human-focused taxonomy, naming orphaned agent identities, dormant credentials, identity drift and agents posing as humans as the risks to plan for.

SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and in 2025-2026, 20 of 43 breaches abused a path with no login for MFA to protect at all.

Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organizations including MSP clients, searching mail and downloading files. No Microsoft vulnerability is involved.

SWI's Identity Consolidation Report 2026 reads 63 identity acquisitions against the ownership of 297 tracked vendors. Identity companies make most of the deals; security, IT and data platforms pay almost all of the money. Five AI-agent identity vendors were bought in 87 days, and 67% of the market is still independent.

Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at some organizations. The usual way in was a stolen service account key, access key, GitHub token or session token.

After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.

A researcher scanned 7.25 million public repositories on Gitee, China's largest Git platform, and found 26,400 unique credentials that still worked, led by Alibaba Cloud access keys. One was an active organization-admin credential for a major enterprise AI platform.

Public TLS certificates are already capped at 200 days. On March 15, 2027 the cap falls to 100 days, and Chrome's root program stops accepting new public certificates that also carry client authentication, which quietly breaks mTLS setups built on public CAs. Why that date, not 2029, is the one to plan around, and the order to automate in.

At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.

Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in secrets, certificate and privileged access management and in Agent Vault, which brokers AI agent access without exposing credentials.

Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research shows what that costs. The fix is an identity per agent, scoped to its task, with the human carried in the token through RFC 8693 delegation.

LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it returned a GitHub org owner's unscoped CLI OAuth token, which led to stolen maintainer tokens and the 1.107.0 release.

Railway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunted for AI provider keys. At most 1.85% of workspaces, about 100,000, may be affected; all Railway API tokens were revoked.

LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.

Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.

Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.

A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, and two coding agents talked into handing over credentials. In October 2026 the credentials that mattered were publishing tokens, CI secrets and agent roles, not user passwords.

Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens in 162 tenants by October 16 and using a Cloud Management app to grant itself Global Administrator. ConnectWise has disabled seven app identities.

Quantum computing company IonQ agreed to buy Elisity in an all-stock deal worth up to $1.3 billion, including a $150 million earnout. Elisity enforces least-privilege network policy per identity, covering users, devices, workloads and AI agents. Close is expected in Q4 2026.

A spraying campaign that only worked on functional accounts, a service principal secret in a GitHub issue, an email address that commits code, a public database key with no authorization behind it, and a leaver's token kept alive on purpose. None needed a new exploit. All of them were credentials no person was accountable for.

Microsoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.

Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and can start CI jobs, with no expiry and no MFA. GitLab calls it intended behavior.

Wiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which defaults to full admin: every provider API key, every prompt, and MCP access.

Attackers exploited CVE-2026-63077 against a JetBrains-run TeamCity server to breach the Cadence cloud service, taking AWS IAM credentials, source code, and secrets from a 2024 backup. JetBrains says the server should have been patched.

GitGuardian found the latest Shai-Hulud variant scanning 469 paths for secrets across developer machines, CI/CD, cloud config, and AI tool settings. The npm worm spreads using the credentials it finds, with no human operator in the loop.

CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated attacker forge access and mint administrator credentials. Exploited from September 1.

CVE-2026-64849 (CVSS 9.3) abuses MLflow's model-registry webhooks to proxy requests into internal services, including cloud metadata endpoints that hand out credentials. Fixed in 3.15.0; exploitation began the day of assignment.

ASSET Research Group fragmented an exfiltration request across MCP channels so no single piece looked malicious. Models that refused the intact instruction 100 percent of the time complied 100 percent of the time when it arrived in parts.