CYFIRMA’s prior research treated three threat surfaces as distinct problems. AI-Accelerated Industrial Espionage named a category of espionage tradecraft built on autonomous agents, model distillation, and synthetic pretext. MCP in Agentic AI Deployments mapped how the Model Context Protocol turns AI agents into an exploitable surface. Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns named Trusted Infrastructure Phishing: attacks conducted entirely inside sanctioned cloud platforms and OAuth flows.
Identity, trusted SaaS integrations, agentic systems, and data-access objectives are increasingly composable attack surfaces, connected by non-human identities, credentials, and delegations acting as the principal control-plane seam. An attack can enter this graph at a stolen token, a compromised SaaS vendor, a manipulated prompt, or a poisoned tool definition, and reach a comparable downstream objective by different paths, rather than following one fixed identity-then-agent-then-exfiltration sequence.
Four cases anchor this report, each classified explicitly against two tiers: a Confirmed Trust Cascade Intrusion (Confirmed TCI), meaning documented compromise traversing at least two trust or control domains, with the transition enabled by delegated authorization, non-human credentials, or trusted third-party infrastructure, and evidence tying the stages to one intrusion; or a TCI-relevant mechanism, which demonstrates part of the model without proving a full cascade in that specific incident. These four cases are illustrative rather than a statistically representative sample, and the trust-graph model should be read accordingly, as a synthesis of what documented cases show is possible rather than a statistically validated claim about prevalence. The Denominator Problem section below addresses this sampling constraint directly, since it is the single largest limit on how far this report’s conclusions generalize.
Every factual claim below carries its own confidence tag: [C] confirmed by the affected organization, a named investigating vendor, or a government body, and independently corroborated; [R] reported as a specific outlet’s or actor’s claim, not independently confirmed; or [A] CYFIRMA’s own analytical assessment. Tags are applied at the level of individual propositions, not sections or paragraphs, so that no single sentence blends a confirmed technical fact with an unconfirmed attribution claim under one tag.
Alongside the four case studies, this report includes a mapping of the Policy/Authorization Control Plane against the standards efforts currently building it (IETF’s AIMS draft, NIST’s NCCoE work, and Okta’s Cross App Access protocol); a crosswalk to OWASP’s Agentic Security Initiative Top 10 and CSA’s MAESTRO framework, so practitioners can translate these findings into taxonomies they already use; a counterfactual control matrix scoring every recommended control against every case; and an attacker-economics comparison ranking the four cases by effort invested relative to blast radius achieved.
We also revisit the forward-looking assessments in AI-Accelerated Industrial Espionage. Microsoft’s AI Red Team, writing on the Microsoft Security Blog, named “Inter-Agent Trust Escalation” as a category in its June 2026 update to the Taxonomy of Failure Modes in Agentic AI Systems (v2.0), establishing that the threat class has moved from theoretical to named in a major vendor’s taxonomy, grounded in twelve months of red-team engagements against deployed systems [C]. It does not establish a confirmed real-world campaign using the technique, and this report does not conflate the two.
Non-human identity governance is one of the highest-leverage cross-domain control points in this dataset, but as the counterfactual matrix shows in detail, it is not a universal fix. It would plausibly have interrupted the Vercel and Salesloft cases at the delegation layer. It would not, alone, have stopped EchoLeak, and it addresses only part of the Taiwan case.
This report synthesizes documented, multi-source-corroborated incidents from August 2025 through August 2026 against the attack-surface model below. It presents no new proprietary intrusion data.
Confidence discipline. Tags are applied at the level of the individual proposition rather than the section, case, or paragraph. Every material proposition carries its own tag:
Where a single sentence would otherwise combine a confirmed technical fact with an unconfirmed attribution or characterization, the sentence is split so that each proposition carries the tag it has independently earned.
The four case studies are illustrative rather than statistically representative, for the reasons set out in the Denominator Problem section below.
Scope is limited to incidents where at least two of the following three elements are independently documented in the same incident: identity or delegated-authorization compromise; agentic AI or SaaS-automation infrastructure; and a data-theft or espionage-grade objective. EchoLeak is a deliberate exception, included as a boundary case to demonstrate that the model does not require all three.
| Layer | What it is | Examples |
| Principal | The entity an action is performed on behalf of | Human user, workload, AI agent, service |
| Credential | The material that proves the principal’s identity | Password, API key, access token, refresh token, certificate, session cookie |
| Delegation | The grant of authority from one principal to another | OAuth consent grant, role assumption, delegated admin, tool authorization |
| Execution substrate | Where delegated authority is exercised | SaaS integration, MCP server, agent runtime, workflow engine |
| Authorization scope | What the delegation actually permits | Specific systems, APIs, objects, or actions |
| Objective | What the attacker is ultimately after | Collection, exfiltration, persistence, espionage |
A credential or a delegation grant is not itself an identity; it is the material that represents or authorizes one. We maintain this distinction throughout. Where later sections reference “non-human identity,” they mean the principal. Where they reference tokens or grants, they mean the credential or delegation layer specifically. This taxonomy is CYFIRMA’s own organizing structure; it is cross-mapped against two external, independently maintained frameworks, the OWASP Agentic Security Initiative (ASI) Top 10 and the Cloud Security Alliance (CSA) MAESTRO framework, later in this report, so it should be read as complementary to those frameworks rather than as a proposed replacement for either. The trust graph figure below expands this taxonomy into the flow an attacker traverses: the credential layer appears twice, once as the material that authenticates the principal and once as the downstream secrets a successful traversal yields, and the taxonomy’s authorization-scope layer corresponds to the figure’s Policy/Authorization Control Plane.
We classify each case by mechanism type:
Two of these mechanism types, agent runtime compromise and fully autonomous execution, are not represented in this report’s four cases; they are included because the taxonomy is intended to outlast this dataset.
CYFIRMA models the attack surface as a graph an attacker can enter at multiple points, and, critically, as the same graph defenders must instrument for control, not only for attack-path analysis. The model includes the Policy/Authorization Control Plane explicitly, because that is the node where most viable defenses actually live.
The Policy/Authorization Control Plane sits between delegation and execution. It comprises scope, task-binding, time limits, approval requirements, purpose constraints, action-level restrictions, and inter-agent authentication. Its absence or weakness is what allows a delegation grant to become an unbounded standing capability rather than a narrow, task-scoped one. This node is where nearly all of this report’s recommendations live; without it explicitly in the model, the graph describes only the attack surface, not the corresponding control surface. The Standards Landscape section below maps this node specifically against the live standardization efforts trying to build it, since that work is further along and further behind than most defenders assume.
Documented and plausible entry points include a stolen access or refresh token, a compromised SaaS vendor whose own delegation grants are abused downstream, a prompt injection manipulating an agent’s reasoning without credential theft, a poisoned tool definition or memory store, an endpoint infostealer infection, or a compromised workload identity.
This model is presented as a conceptual flow diagram to organize case analysis and control ownership, not as a formal graph-theoretic analysis. It does not include centrality measures, transition probabilities, or edge weighting, and should not be read as more quantitatively rigorous than that. Its value is in making the control-plane gap visible, not in predicting which path an attacker is statistically most likely to take.
Classification: Confirmed TCI. Mechanism type: identity compromise, then delegation abuse.
A Context.ai employee’s endpoint was infected with Lumma Stealer, a commodity infostealer-as-a-service family, in February 2026, yielding Google Workspace credentials [C]. Threat-intelligence firm Hudson Rock additionally reported that the same infection harvested keys and logins for Supabase, Datadog, and AuthKit; this specific service list traces to Hudson Rock’s analysis rather than to Vercel’s or Context.ai’s own disclosures, which describe the harvested material more generally as corporate credentials, session tokens, and OAuth tokens [R]. Independently, a Vercel employee, distinct from the compromised Context.ai employee, had connected a Vercel enterprise Google Workspace account to Context.ai with a broad OAuth grant [C]. Using that inherited access, the attacker reached a Vercel environment and enumerated environment variables that had not been separately encrypted as sensitive [C]. Vercel’s architecture distinguishes “sensitive” (encrypted) variables from ordinary ones, and the exposure was limited to the latter category [C]. Vercel disclosed the incident on April 19, 2026 [C]. Trend Micro subsequently issued a correction to its own initial analysis, clarifying that the confirmed impact was scoped to teams whose access had been directly compromised, not a blanket, platform-wide exposure of all customer secrets [C].
A listing purporting to offer Vercel-derived data for USD 2 million appeared on BreachForums, posted under the name “ShinyHunters” [R]. Reporting on the incident indicates that the poster was likely someone invoking that name rather than the established ShinyHunters group itself, and the actual group’s involvement in this specific listing was not confirmed [R]. No outlet has independently verified that the full data set claimed in the listing was actually exfiltrated as described [R]. We report the listing’s existence as fact; its contents and attribution remain unverified claims.
Key finding: The confirmed portion alone is sufficient evidence: a third-party AI tool’s OAuth grant functioned as a lateral-movement path into an unrelated company’s environment, and the security boundary that failed was a manual tagging convention rather than default encryption [A].
Detection implication: The OAuth grant was never flagged as anomalous because, from the identity layer’s perspective, it was an ordinary third-party app consent: a delegation-abuse case, not an agent-reasoning-manipulation case [A].
Classification: Confirmed TCI. Mechanism type: identity compromise at the vendor, then delegation abuse at scale across more than 700 downstream customers. This is a SaaS supply-chain / delegated-authorization attack in which the compromised component happened to be an AI product; the agent’s reasoning was never targeted.
Between approximately March and June 2025, an actor gained access to Salesloft’s GitHub account and used it to conduct reconnaissance, downloading repository content and establishing unauthorized workflows [C]. From that developer/CI-credential compromise, the actor pivoted into Drift’s AWS environment, where OAuth and refresh tokens for Drift customer integrations were stored, and obtained those tokens [C]. Between August 8 and 18, 2025, the actor, tracked by Google’s Threat Intelligence Group (GTIG) as UNC6395, used the stolen Drift OAuth and refresh tokens to authenticate directly against more than 700 organizations’ Salesforce environments, bypassing MFA because the tokens themselves carried trusted access [C].
GTIG has stated that it had not determined the actor’s origins or motivations beyond the actions it observed [C]. A “Chinese state-linked” characterization of the actor traces to AppOmni, which described UNC6395 in its own published research as “an assessed Chinese threat actor” and, elsewhere, “a suspected Chinese nation-state threat actor” [R].
This attribution is not officially corroborated by Google or any government body, and we treat AppOmni’s characterization as a confident vendor assessment rather than an established or government-confirmed fact [R]. A threat-actor collective operating under the ShinyHunters name, part of a broader grouping that has also invoked Scattered Spider and Lapsus$ branding, has publicly and repeatedly claimed credit for data obtained through the Drift campaign [R]. That collective subsequently stood up a broader extortion site listing dozens of organizations tied to the Drift campaign alongside victims of separate, unrelated incidents, rather than a listing dedicated to the Drift campaign specifically [R].
Independent analysis has treated the technical intrusion Google catalogs as UNC6395 and these extortion-phase claims as related but not formally merged, noting that no conclusive link between the two has been established; Google’s own published research on UNC6395 does not itself address the ShinyHunters overlap [R].
The actor used Salesforce’s Bulk API to systematically query Accounts, Contacts, Cases, and Opportunities records, hunting for embedded secrets [C]. Cloudflare’s independent forensic reconstruction confirmed that the attacker launched a Salesforce Bulk API 2.0 job on August 17 that exfiltrated a database in roughly three minutes, then attempted to delete the job to cover its tracks, an attempt defeated by residual logs that allowed Cloudflare to fully reconstruct the attack [C]. The FBI issued an advisory on the campaign; Salesloft and Salesforce revoked all active Drift tokens on August 20, 2025 [C].
Post-disclosure developments. Internal Salesforce communications reported by Bloomberg indicated the company would not pay ransom demands tied to the stolen data, a position a company spokesperson subsequently confirmed publicly [R]. Additional downstream victims continued to be confirmed for months after the original disclosure, including Zscaler, Toast, Avalara, and Agility PR, each with individually disclosed, limited exposure of contact records or support-case content [R, per public breach-tracking aggregation of each company’s own disclosures]. In at least one later-disclosed incident, a threat actor operating under the ShinyHunters name used data reportedly originating in part from the Drift campaign, combined with data from a separate, unrelated incident, to extort a company directly, threatening to publish the combined data set unless paid [R]. This indicates the secrets harvested in Case B did not stay contained to the original disclosure window; they continued to surface in unrelated extortion activity well after the underlying vulnerability was closed, which bears on how long a defender’s response to a Trust Cascade Intrusion needs to remain active after initial containment.
Key Finding: The clearest evidence in this report for authorization concentration: a single AI SaaS product’s non-human credentials became a chokepoint whose compromise yielded MFA-bypassing access across more than 700 unrelated organizations. The AI agent was the target of compromise, not the instrument of it. The attacker’s identity and motivation remain formally undetermined by Google itself, which this report treats as a meaningful gap rather than a rounding error [A].
Detection implication: Victim telemetry showed “Drift” accessing Salesforce exactly as it always did. The anomaly was visible only in cross-customer aggregate analysis, above what any single victim’s SOC can see alone [A].
Classification: TCI-relevant / convergent, not a Confirmed TCI. Evidence supports AI-assisted execution and identity-infrastructure targeting, not that an initial identity-layer compromise was a required precursor step. Mechanism type: agent-enabled conventional intrusion, with autonomous or semi-autonomous execution of intermediate steps.
Dream, an Israeli cybersecurity firm, published research on August 12, 2026, first reported by the Financial Times, describing an operation using two open-source agent frameworks, Hermes and OpenClaw, against Taiwanese government systems over 12 documented waves across four days, from July 1 to July 4, 2026, deploying as many as eight sub-agents in a single wave [R, per Dream / Financial Times]. Dream reported that the framework mapped 21 government systems and, from a single portal, extracted embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects [R]. Dream reported that the framework compromised at least 85 accounts, exploited a signature-validation flaw in a personal authentication service, and extracted more than 2,500 personnel records, later expanding to a nuclear safety agency and energy-sector suppliers [R].
Taiwan’s Ministry of Digital Affairs confirmed that the intrusion combined conventional operations with AI-agent assistance [C]. In CyberScoop’s coverage of Dream’s findings, Dream’s own researchers cautioned that the operation still required human involvement: a person still had to select the target, set the objective, and issue direction, even as the system executed and adapted individual reconnaissance and exploitation subtasks on its own [R]. That framing suggests strategic autonomy remained human-directed while tactical autonomy was substantially agent-driven.
Other coverage of the same research places more emphasis on the system’s operational independence once launched, so this report treats the degree of ongoing human direction as a live point of emphasis that varies across outlets rather than a settled description [R]. Dream’s own published research does not attribute the operation to the Chinese government or a specific named hacking group; it characterizes the operational documentation as pointing to a Chinese-language operator [R].
Taiwan’s Ministry of Digital Affairs did not itself name China in its public statement; “suspected China-linked” in this report reflects that narrower researcher characterization rather than an official government attribution [R].
Key finding: CYFIRMA assesses this as the most operationally advanced example in the reviewed dataset [A]. If Dream’s account is accurate, it would show AI agents treating identity infrastructure as a reconnaissance target within a single human-directed operation. It should not be read as evidence of fully autonomous, human-independent espionage; that stronger claim is not supported by the sourcing, and the underlying technical detail rests on a single research firm’s account.
Detection implication: Existing playbooks were not purpose-built for tactical autonomy operating faster than a human-paced detection cycle, even where strategic direction remained human [A].
Classification: TCI-relevant mechanism only; explicitly not a Confirmed TCI. Mechanism type: agent manipulation (prompt injection), with no identity-layer node in the graph exploited at all.
CVE-2025-32711 (“EchoLeak”), disclosed by Aim Security in June 2025 and patched by Microsoft, is a zero-click prompt-injection vulnerability in Microsoft 365 Copilot [C]. A crafted email containing hidden instructions was retrieved during a routine, unrelated user query. The instructions caused Copilot to gather sensitive content from other emails and documents and exfiltrate it via an auto-fetched image request proxied through a trusted Microsoft Teams endpoint, evading Microsoft’s cross-prompt injection attack (XPIA) classifier, external link redaction, and Content Security Policy controls [C]. Microsoft stated no in-the-wild exploitation was identified prior to patching [C].
Key finding: Included specifically because it does not fit a linear identity-first model: it enters the trust graph directly at the Agent/Service node via manipulated reasoning, bypassing the delegation and policy nodes entirely. This is the strongest argument in this report’s own evidence base for the graph model over a fixed sequence [A].
Detection implication: The exploit does not inherently require an anomalous identity event to occur [C, restated per Microsoft’s technical writeup of the mechanism]. Detection depends on content-layer inspection of what an agent retrieves and acts on, a control surface distinct from anything OAuth or NHI governance addresses.
| Case | Entry node | Mechanism type | AI’s role | Delegation/NHI role | Objective | TCI classification | Confidence |
| Vercel / Context.ai | Endpoint infostealer at vendor | Identity compromise, then delegation abuse | Third-party AI SaaS integration as lateral-movement path | High: OAuth grant was the pivot | Data/secrets exposure | Confirmed TCI | High for core compromise and Trend Micro’s corrected scope; unverified for sale-listing contents and poster identity |
| Salesloft / Drift | Vendor OAuth infrastructure compromise | Identity compromise, then delegation abuse at scale | AI sales agent platform as concentration point | Very high: token theft was the attack | Bulk theft plus credential harvesting for follow-on ops | Confirmed TCI | High for mechanics, dates, and MFA-bypass timeline; unconfirmed for nation-state attribution, which Google itself has not made |
| Taiwan | Human-directed intrusion | Agent-enabled conventional intrusion plus tactical autonomy | Core execution engine for reconnaissance/exploitation | Identity infrastructure was a target, not a confirmed precursor compromise | Espionage/data theft | TCI-relevant / convergent | High for AI assistance and identity-infrastructure targeting; lower for autonomy framing; attribution explicitly not made by Dream or Taiwan’s government |
| EchoLeak | Manipulated agent reasoning | Agent manipulation (prompt injection) | Core exploit target | Not required | Cross-domain data exfiltration | TCI-relevant mechanism only | High as mechanism and most consistently sourced case in this report; no wild exploitation confirmed |
CYFIRMA’s taxonomy above is one way to organize this territory; it is not the only one, and practitioners already working from other frameworks should not need to adopt a fifth vocabulary to use this report. OWASP’s Agentic Security Initiative published a Top 10 for Agentic Applications in December 2025, cataloging ten risk categories under identifiers ASI01 through ASI10 [C]. CSA’s MAESTRO framework (Multi-Agent Environment, Security, Threat, Risk, and Outcome), introduced in February 2025, organizes agentic AI risk across seven architectural layers: Foundation Models, Data Operations, Agent Frameworks, Deployment and Infrastructure, Evaluation and Observability, Security and Compliance, and Agent Ecosystem, with Security and Compliance drawn as a cross-cutting layer running through the other six rather than a discrete tier [C].
| Case | OWASP ASI category | MAESTRO layer(s) | Rationale |
| Vercel / Context.ai | ASI03, Identity and Privilege Abuse | Layer 4 (Deployment and Infrastructure), Layer 7 (Ecosystem) | An inherited OAuth grant, not a manipulated agent, was the vector; the credential crossed an organizational boundary at the infrastructure/ecosystem seam |
| Salesloft / Drift | ASI03, Identity and Privilege Abuse; ASI04, Agentic Supply Chain Vulnerabilities | Layer 4 (Deployment and Infrastructure), Layer 7 (Ecosystem) | Vendor-side OAuth infrastructure compromise realized downstream through hundreds of independent ecosystem relationships |
| Taiwan | ASI02, Tool Misuse and Exploitation; ASI07, Insecure Inter-Agent Communication | Layer 3 (Agent Frameworks), Layer 6 (Security and Compliance) | Multiple sub-agents coordinating tool use and reconnaissance sits at the agent-framework layer; the identity-infrastructure targeting specifically also implicates Layer 6, MAESTRO’s cross-cutting security and compliance layer |
| EchoLeak | ASI01, Agent Goal Hijack; ASI06, Memory and Context Poisoning | Layer 1 (Foundation Models), Layer 3 (Agent Frameworks) | A manipulated retrieval context altering agent behavior is a reasoning-layer event requiring no ecosystem or infrastructure component |
Notes to Table 3: The OWASP ASI category names above are drawn from secondary technical analyses of the published list rather than from OWASP’s primary document, and should be checked against OWASP’s own published Top 10 before being cited externally as an official OWASP mapping [R].
An industry paper published on the Cloud Security Alliance’s Lab Space community-research venue cited figures showing that non-human identities outnumber human users by an average of 45:1, rising to 144:1 in cloud-native environments [R]. CSA’s Lab Space venue generally hosts community-contributed and AI-assisted research distinct from CSA’s formally adopted publications; this characterization should be confirmed before external citation [R]. The 144:1 figure traces to underlying research from Entro Security, a commercial non-human-identity security vendor [R].
Other outlets report the same underlying phenomenon at somewhat different ratios depending on source and methodology, so the exact figure should be treated as soft and vendor-dependent, even though the directional finding that non-human identities substantially and increasingly outnumber human ones is consistent across every source reviewed [R]. A separate CSA/OASIS governance survey, distinct from the Lab Space ratio paper above, found that 78% of organizations lacked a documented, formally adopted policy for creating or removing AI identities specifically [R, industry survey, self-reported].
Okta’s 2026 research, based on a survey of 306 CISOs and senior security executives across six markets, found that 47% of respondents were confident they could identify all agents in their environment, 46% that they could centrally control what agents access, and 45% that they could authorize what individual agents are permitted to do [R, industry survey, self-reported]. SANS’s 2026 identity survey identifies a directionally consistent gap between non-human identity deployment and organizational resilience to it [R].
Non-human identities, credentials, and delegations, not any single one of those categories alone, are the connective tissue across the cases in this report. NHI governance is one of the highest-leverage cross-domain control points identified in this dataset: it plausibly would have interrupted Vercel and Salesloft at the delegation layer. It would not have stopped EchoLeak, which requires no identity compromise, and it addresses only part of the Taiwan case, where agent-runtime and guardrail design were at least as central. It is a high-leverage control point, not a universal one, and the precise scale of the underlying identity-ratio problem should be read as directionally real but numerically uncertain given how vendor-dependent the published figures are.
The counterfactual matrix below makes this judgment explicit and extends it to every control category in this report’s recommendations, not NHI governance alone.
This report’s trust graph model names a Policy/Authorization Control Plane as the node most of its recommendations depend on. That node is not merely aspirational: a live standardization effort is underway to build it, and mapping it against the graph shows both genuine progress and a specific, current gap.
On March 2, 2026, engineers from Defakto Security, AWS, Zscaler, Ping Identity, and OpenAI published an IETF Internet-Draft, draft-klrc-aiagent-auth, defining an Agent Identity Management System (AIMS) that composes SPIFFE (Secure Production Identity Framework for Everyone), WIMSE (Workload Identity in Multi-System Environments), and OAuth 2.0 into a framework for how AI agents prove their identity [C]. The draft has since progressed to revision -03, dated July 6, 2026, which adds Okta to the author list [C].
AIMS operates at the Principal and Delegation nodes of this report’s graph: it gives agents stable, verifiable workload identifiers and a path to authenticate using existing, mature standards rather than ad hoc API keys.
In the initial draft, independent analysis found that the Security Considerations section was a placeholder, while the Authorization section was actually drafted out but described as coarse-grained, stopping at the boundary of what a token permits rather than evaluating individual actions [R]. It is not established whether later revisions, through -03, close that gap. AIMS, as initially drafted, addresses “who is this agent” more thoroughly than “what is this agent allowed to do right now,” which is precisely the distinction this report’s graph model treats as the decisive control point.
NIST’s National Cybersecurity Center of Excellence reportedly published a companion concept paper on AI agent identity and authorization on February 5, 2026, opened for public comment through April 2, 2026, alongside broader, related NIST work on AI agent security controls, identity, and testing sometimes referred to collectively as an AI Agent Standards Initiative, though that is not confirmed as a single formally branded NIST program [R]. Both NIST efforts reportedly include policy-based access control explicitly in scope — the element that current IETF drafting has not yet specified [R].
Separately, and further along in production deployment, Okta introduced Cross App Access (XAA) in June 2025, an OAuth extension that has since been formally incorporated as an official MCP authorization extension [C]. XAA moves authorization decisions from individual application consent screens to a central identity provider, replacing long-lived static API keys and broad, standing OAuth grants (the exact failure mode in the Vercel and Salesloft cases) with short-lived, centrally governed, purpose-scoped tokens [C].
The gap between this standards work and actual deployment is wide. One analysis of more than 5,200 open-source MCP server implementations found that 53% rely on static API keys for authentication and that only 8.5% use OAuth at all [R]. Adoption in enterprise deployments has not been measured comparably, but on the open-source evidence available, much of the MCP ecosystem these standards are meant to secure has not yet adopted even the OAuth-based foundation AIMS and XAA build on, let alone the policy layer above it [A].
| Graph node | Standards effort targeting it | Status |
| Principal / Delegation | AIMS (IETF draft-klrc-aiagent-auth); XAA (Okta, MCP-recognized) | Live draft and shipped protocol respectively; XAA has production adoption |
| Policy / Authorization Control Plane | NIST NCCoE concept paper; NIST AI Agent Standards Initiative | Reportedly concept-stage, public comment window closed April 2026; not yet a deployed standard |
| Agent or Service / Tool-API | No dedicated identity standard identified; covered indirectly by MCP’s own evolving authorization extensions, including XAA | Partial, vendor-led |
| Data Plane / Secrets / Downstream Identities | No dedicated standards effort identified | Open gap |
No public reporting on the four cases in this report’s dataset indicates that any occurred in an environment that had deployed XAA-style centralized authorization; all four are consistent with the older model this generation of standards is explicitly built to replace [A]. Whether that replacement happens before the next comparable incident is, at this point, an open question rather than a settled trend.
The governance-gap section above makes this judgment for one control category, in prose. Table 5 below extends it across every control category in this report’s recommendations, evaluated against each case. Every cell is CYFIRMA’s own assessment [A], based on the case facts established above, not an external finding; it is offered as a prioritization aid, not a certified control-effectiveness rating, and should be read with the same caution as any vendor-independent judgment call.
| Control category | Vercel / Context.ai | Salesloft / Drift | Taiwan | EchoLeak |
| Task-scoped, time-boxed authorization (Policy/Authorization Control Plane) | Yes: a narrowly scoped grant would likely not have carried lateral access into Vercel’s environment | Yes: a time-boxed, narrowly scoped Drift token would likely have limited the Bulk API’s reach | Partial: would likely have slowed but not stopped agent-driven reconnaissance once inside | No: does not touch the reasoning-layer manipulation EchoLeak relies on |
| Centralized, standards-based agent identity (XAA/AIMS-class) | Yes: replaces the broad standing OAuth grant that was the actual vector | Yes: replaces the long-lived Drift token model directly | No: this case’s entry point was not delegation abuse | No |
| Agent runtime controls (tool allowlisting, egress control, context isolation) | Partial: would likely not prevent the initial token theft but could limit downstream tool reach | No: the compromise never touched agent reasoning or tool use | Partial: could constrain what a compromised sub-agent reaches next | Yes: this is the control class that directly addresses EchoLeak’s mechanism |
| SaaS-to-SaaS trust graph visibility | Yes: would likely have surfaced the Context.ai OAuth grant as a monitored edge | Yes: would likely have surfaced Drift’s aggregate reach across more than 700 tenants sooner | Partial: useful for the identity-infrastructure reconnaissance stage specifically | No |
| Detection, identity/delegation correlation branch | Yes | Yes | Partial | No |
| Detection, agent-content-manipulation branch | No | No | Partial | Yes |
Reading Table 5 by column is as informative as reading it by row: no single case is fully addressed by any one control, and no single control fully addresses every case. The controls with the broadest coverage across cases — task-scoped authorization, SaaS-to-SaaS trust graph visibility, and the identity/delegation detection branch, each assessed Yes or Partial in three of the four cases — are also the ones this report’s recommendations emphasize most heavily; the matrix functions here as a check on that emphasis rather than a discovery that changes it.
The four cases in this report differ sharply in the effort an attacker invested relative to what that effort returned. This is CYFIRMA’s own comparative assessment [A], built from the case facts established above rather than a new external measurement of attacker cost, time, or resourcing, none of which is available in public reporting.
| Case | Attacker investment | Realized blast radius | Leverage assessment |
| Salesloft / Drift | One vendor-side OAuth infrastructure compromise; no malware, no bespoke tooling | 700+ downstream organizations authenticated against directly | Highest leverage in this dataset: a single compromise produced a three-digit multiplier |
| Vercel / Context.ai | A commodity, off-the-shelf infostealer and an opportunistic OAuth topology; no custom tooling | One company’s internal environment, with unverified downstream resale | Moderate leverage, largely a function of what the compromised employee’s account happened to connect to, not attacker sophistication |
| Taiwan | Purpose-assembled multi-agent framework (Hermes plus OpenClaw), sustained over 12 waves | 21 mapped systems, at least 85 compromised accounts, one government and its extended supply chain | Lower blast-radius multiplier per unit of effort than Salesloft, but higher per-target depth and strategic specificity |
| EchoLeak | A single crafted email; no infrastructure or persistent access required | Theoretically any Copilot-connected mailbox reachable by the vulnerability class; practically zero, since no in-the-wild exploitation was confirmed | Highest theoretical leverage in the dataset, and the only case where realized impact was reportedly zero, illustrating that mechanism severity and observed harm are different axes |
The Salesloft / Drift case is the strongest evidence in this dataset for CYFIRMA’s forward assessment that AI-agent OAuth grants are becoming an attractive initial-access target class: a single vendor-side compromise, requiring no malware and no bespoke tooling, yielded direct authenticated access to more than 700 downstream organizations. On the basis of blast radius per compromise alone, this compares to the way compromised VPN appliances and edge devices function as initial-access targets today, though the underlying attacker cost has not been measured for either [A].
Microsoft’s AI Red Team, writing on the Microsoft Security Blog, added “Inter-Agent Trust Escalation” as a named category in its June 2026 update to the Taxonomy of Failure Modes in Agentic AI Systems (v2.0), describing compromised sub-agents falsely asserting identity or privileges to an orchestrator [C]. This confirms that the threat class named as speculative in CYFIRMA’s AI-Accelerated Industrial Espionage research has moved from theoretical to a named, defended-against category in a major vendor’s taxonomy. It does not establish a confirmed real-world campaign using this exact technique [A, absence of evidence, not evidence of absence].
CYFIRMA assesses that the Salesloft / Drift campaign’s blast radius of more than 700 organizations from a single vendor compromise demonstrates that a compromised AI-agent OAuth grant is now an attractive, high-leverage initial-access target class, plausibly including for state-linked actors if the unconfirmed Chinese-linked assessment of UNC6395 holds, comparable in strategic value to how VPN appliances and edge devices function as initial-access targets today [A]. This is CYFIRMA’s own extension of the evidence, not an observed pattern of repeated targeting, and it does not depend on that attribution being correct: the blast-radius dynamic holds regardless of who UNC6395 turns out to be.
RAG and agent-memory poisoning remain an open vector requiring no identity-layer compromise. EchoLeak demonstrates that the mechanism is viable, and CYFIRMA has not identified a confirmed real-world exploitation of this specific vector to date [A].
The techniques below are drawn from the four cases above. Cases A (Vercel / Context.ai) and B (Salesloft / Drift) contribute the credential-theft, token-abuse, collection and exfiltration entries; Case C (Taiwan) contributes the cloud-account and discovery entries; and Case D (EchoLeak) contributes the ATLAS prompt-injection and plugin-compromise entries. The final row is a CYFIRMA extension and has no assigned ATLAS identifier.
| Tactic | Technique ID | Technique / Sub-technique |
| Initial Access | T1199 | Trusted Relationship |
| Credential Access | T1555.003 | Credentials from Password Stores: Credentials from Web Browsers |
| Credential Access | T1539 | Steal Web Session Cookie |
| Credential Access | T1528 | Steal Application Access Token |
| Defense Evasion, Lateral Movement | T1550.001 | Use Alternate Authentication Material: Application Access Token |
| Initial Access | T1078.004 | Valid Accounts: Cloud Accounts |
| Collection | T1213 | Data from Information Repositories |
| Collection | T1560 | Archive Collected Data |
| Exfiltration | T1567 | Exfiltration Over Web Service |
| Defense Evasion | T1070 | Indicator Removal |
| Initial Access (ATLAS) | AML.T0051 | LLM Prompt Injection |
| Execution, Privilege Escalation (ATLAS) | AML.T0053 | LLM Plugin Compromise (AI Agent Tool Invocation) |
| Privilege Escalation (ATLAS) | AML.T0054 | LLM Jailbreak |
| Discovery (ATLAS, CYFIRMA extension) | Not assigned | Identity-Infrastructure Reconnaissance via Agent |
This report’s four cases became visible because each was disclosed, investigated, and covered by multiple outlets. That visibility is not evidence about prevalence. This report cannot and does not estimate what fraction of organizations running comparable AI-SaaS OAuth integrations, comparable MCP deployments, or comparable AI agent access have been breached through this pattern; no dataset available to CYFIRMA supports that estimate, and readers should not infer one from the case count here.
What can be said with more confidence: the Salesloft / Drift campaign’s confirmed reach of more than 700 organizations [C] establishes a documented floor, not a ceiling, on how many downstream victims a single AI-agent OAuth compromise can produce. Public breach-tracking of the campaign’s aftermath had identified at least 31 organizations with confirmed, individually disclosed follow-on impact as of recent reporting for this report [R], a number that continued to grow after the initial disclosure and should be treated as an undercount rather than a final figure.
Separately, a February 2026 industry survey found that 88% of organizations reported suspected or confirmed AI agent security incidents, while only 22% treated AI agents as independent, identity-bearing entities in their security architecture [R, vendor survey, self-reported]. That figure should be read cautiously: it is self-reported, the definition of a “suspected” incident is not standardized across respondents, and the survey has a commercial sponsor with an interest in the finding. It is nonetheless the closest available proxy for a base rate, and even substantially discounted, it does not suggest that this report’s four cases are outliers against a large population of otherwise unaffected organizations. CYFIRMA treats the true base rate as an open and currently unanswerable question and flags it as the most important limitation on every prevalence-adjacent claim in this report [A].
Each of the individual mechanisms described here is independently well documented. This report’s contribution is the case matrix showing they connect through a common graph of principals, credentials, delegations, and, critically, the policy/authorization control plane between them, and that real incidents traverse that graph differently rather than following one fixed sequence. That contribution is organizational and synthetic: it draws an explicit connection across four already-public incidents and their existing detailed write-ups, rather than presenting newly discovered technical facts about any one of them. The counterfactual matrix and attacker-economics comparison extend that synthesis into a form a defender can act on directly, without pretending either tool is more quantitatively rigorous than the judgment calls underlying it.
CYFIRMA assesses that the operational barrier to chaining trusted identities, SaaS integrations, and agentic capabilities is falling faster than many organizations are adapting detection and response models built around siloed ownership rather than the graph shape of the problem [A]. This is stated as an assessment, since attack cost, dwell time, and success rate have not been quantified across a representative sample, and since this report’s four cases are illustrative rather than a representative sample in the first place, a limitation addressed directly in the denominator section above.
Organizations best positioned against this pattern will instrument the transitions between graph nodes, not just each node in isolation, and assign explicit ownership, particularly of the policy/authorization control plane, rather than leaving it as unclaimed space between teams. That control plane is not merely aspirational: standards work to build it is underway but unfinished, and no public reporting on this report’s four cases indicates that any occurred in an environment that had already adopted it.
The following recommendations are based on the intelligence available at the time of writing. They are not exhaustive, and each should be assessed against the organization’s existing identity, monitoring, and vendor-management controls before being prioritized.
