# Attackers now run AI agents. Their target is your keys.

In October three hosting platforms said attackers may have reached the keys their customers stored with them, many of them keys to AI services. The incident reports, threat research and agency guidance agree on what to do first.

Tyler Gibbs. 22 October 2026. 7 minute read.

On 21 October, Railway, a hosting platform, [asked every customer to rotate every secret stored with it](https://blog.railway.com/p/security-disclosure-wednesday-october-21st). An unauthorized party may have reached the encrypted settings Railway keeps for customers, and decrypted some of them. Four days earlier, OpenCode said keys that [1.4% of its console users](https://thehackernews.com/2026/10/opencode-console-breach-may-have.html) had saved in its hosted service may have been exposed. On 19 October, Zeabur, another hosting platform, [published how an attacker had read 3,218,965 stored settings records](https://zeabur.com/blogs/october-2026-security-incident) on 14 and 15 October.

Railway believes its breach is part of a series aimed at AI service providers. Zeabur judges from the attacker’s commands that it was mainly after keys it could use at once, especially keys to AI services. None of the companies has tied its incident to the others, and as of 22 October Railway and OpenCode had not published a cause. Each published what it knew within days.

## Attackers hand the work over.

In November 2025, Anthropic [described a campaign](https://www.anthropic.com/news/disrupting-AI-espionage) it attributed with high confidence to a Chinese state-sponsored group. The group pointed Anthropic’s coding agent at about thirty organizations and got in at a handful. Anthropic estimates the AI did 80 to 90% of the tactical work, with people stepping in at perhaps four to six decisions per campaign. It also notes the AI often overstated what it had found.

[Its September 2026 report](https://www.anthropic.com/threat-intelligence-report-september-2026) says most of the operations it disrupted between December 2025 and August 2026 were run by AI, with people choosing the targets and reviewing what was taken. In one case, operators Anthropic suspects are affiliates of the ShinyHunters group used a breached software provider to reach about 200 of its customers. They dumped more than 2,100 sets of sign-in tokens across more than 40 companies in about 34 hours, and AI agents did nearly all of the work. Anthropic’s conclusion is that “sophistication has stopped being a reliable signal of who is behind an operation.” [Google reported a similar case](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai): an attacker planned, built and ran a campaign that harvested thousands of credentials in under six hours.

The same researchers set limits on that picture. Verizon found that most AI-assisted malware repeats techniques already well known, and [fewer than 2.5% of what it observed was unusual](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf). Mandiant does not consider 2025 the year breaches became the direct result of AI. Google has not yet seen attackers run fully automatic exploitation against real targets. AI has made attacks faster and wider while the techniques stay mostly old ones.

## The clock got shorter.

[Mandiant’s M-Trends 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026), drawn from its own investigations, estimates the average time to exploit a flaw at minus seven days: attacks routinely start before a patch exists. The time between one group getting in and handing access to the next fell from more than eight hours in 2022 to 22 seconds in 2025. VulnCheck found that [nearly 29% of the 884 flaws](https://www.vulncheck.com/blog/state-of-exploitation-2026) first exploited in 2025 were exploited on or before the day they were published. Microsoft reports that [exposed cloud systems were attacked after 5.3 hours on average](https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/).

Organizations are fixing flaws more slowly. Verizon’s 2026 report found that they fully fixed only 26% of the flaws on the government’s known-exploited list, down from 38%, and the median time to fix rose from 32 days to 43.

## Keys are what they take.

Zeabur’s report gives the cause plainly: long-lived admin credentials “were stored in plaintext and could be used from the public internet.” Its admin tokens had not been changed since January 2024, and more than 16 hours of attack activity raised no alert.[Vercel’s April breach](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident) began further away, with an AI tool one employee used. The tool’s connection to Google Workspace was compromised, and the attacker went from it to the employee’s accounts and on to some customers’ stored settings.

Build systems are the same story. In 2025 one build token with too much access let an attacker put code into [an official release of an AWS coding extension](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/). In [the Nx attack](https://nx.dev/blog/s1ngularity-postmortem) the same year, a poisoned package told the developer’s own AI tools to search the machine for secrets with their safety checks switched off. [Wiz found the AI part worked in under a quarter of cases](https://www.wiz.io/blog/s1ngularitys-aftermath), while the ordinary part took tokens directly, and almost 90% of the leaked GitHub tokens still worked a day later. Anthropic’s advice is to treat AI keys and agent connections “as seriously as production credentials.”

## Your own agents are a way in.

An agent acts on what it reads, so anyone who can put words in front of it can give it instructions. [EchoLeak](https://www.cve.org/CVERecord?id=CVE-2025-32711), a flaw Microsoft fixed in 2025, let one email the victim never opened pull internal data out of Microsoft 365 Copilot when they later asked it an ordinary question. Invariant Labs showed [an instruction planted in a public GitHub issue](https://invariantlabs.ai/blog/mcp-github-vulnerability)making an agent copy private code into a public pull request. In January, [an advisory showed](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh) that earlier versions of OpenCode’s coding agent ran a local server any website could use to run commands on the developer’s machine.

OWASP says [it is unclear whether prompt injection can be prevented](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) in a fool-proof way, and NIST warns it can let attackers [hijack agents to run code or take data](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf). Simon Willison [names the combination to avoid](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/): an agent with private data, untrusted content and a way to send messages out can be tricked into sending the data to an attacker. The earlier post on [what an agent may do alone](https://www.grayhavenindustries.com/blog/what-an-agent-may-do) gives the test for which of its steps need a person.

## What to do, in order.

**Find every place a key lives.** Your own vault is one place. Hosting platforms, build systems, AI coding tools and connected AI apps hold keys too. When one leaks, revoke it where it was issued. Railway warns that a GitHub token it removed “[still works on GitHub until you revoke](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset)” it there.

**Make keys short-lived and narrow.** The cybersecurity agencies of the United States, the United Kingdom, Canada, Australia and New Zealand [advise giving each agent its own identity and keys](https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services), never sharing them, and never letting an agent change its own access. Static, shared keys are the ones they warn attackers steal.

**Fix the known-exploited list first.** CISA’s catalog of exploited flaws is the queue. With exploitation starting at or before disclosure, a monthly patch cycle is already behind. We list [the last 30 days of it](https://www.grayhavenindustries.com/watch).

**Use sign-in that phishing cannot capture.** CISA calls FIDO/WebAuthn “[the only widely available phishing-resistant authentication.](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)” In [Google’s year-long study](https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html), no user who relied only on security keys fell to targeted phishing. Ask the same of vendors: Verizon found a third party involved in 48% of breaches.

**Treat every connected AI tool as a vendor.** Granting an AI app access to your email or files gives it that account’s reach, which is how Vercel’s breach began.

**Never give one agent all three.** Keep private data, untrusted content and a way out apart. The joint guidance asks for a list of approved tools and versions, and a person’s approval for high-stakes actions. [Supabase’s advice](https://supabase.com/blog/defense-in-depth-mcp) for its own agent tools is never to connect them directly to production data.

**Slow down what your builds install.** After the 2025 worm,[PostHog turned off install scripts](https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem), set a waiting period before taking new releases, and stopped publishing with stored tokens. CISA [told developers to rotate every credential](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem) and pin to releases from before the attack.

**Make a stolen key’s use visible.** Fixed outbound addresses turn a request from anywhere else into a clear signal. Without them, Railway notes, an unfamiliar address is “[a lead rather than proof.](https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-grok-usage)” Then alert on use: no alarm fired in Zeabur’s 16 hours.

## The rules have not caught up.

**In healthcare,** the proposed update to the HIPAA Security Rule is not in force. Davis Wright Tremaine [reads the federal agenda](https://www.dwt.com/blogs/privacy--security-law-blog/2026/07/hhs-updates-hipaa-rulemaking-timeframes) as moving the target for a final rule to July 2027.

**In banking,** the model risk guidance the Federal Reserve, the FDIC and the OCC issued in April [says generative and agentic AI are outside its scope](https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf), and still expects each bank to govern them. New York’s financial regulator has required multi-factor sign-in for all users since November 2025, and [recommends physical security keys](https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks)over text or voice codes.

**For utilities,** a NERC drafting team wrote in December 2025 that the current CIP model “[has proved unworkable in a cloud environment](https://www.nerc.com/globalassets/standards/projects/2023-09/white-paper/project-2023-09-risk-management-for-third-party-cloud-services-white-paper_121825.pdf)” and proposed new, optional standards. NERC has not endorsed the paper.

The joint agency guidance on agents is voluntary, and it says agents belong on low-risk, non-sensitive tasks for now. [NIST’s profile for AI and cybersecurity](https://csrc.nist.gov/pubs/ir/8596/iprd) is still a preliminary draft. This post explains published guidance and is not legal advice.

## Where this leaves you.

The October reports are days old, and two of them have no published cause. What the record supports is narrow. The keys that were taken lived a long time and sat in one place, and every control on the list above existed before attackers had agents. Ask two things of every key: how long it lives, and who can revoke it.

## Sources

- [Railway, “Security disclosure, Wednesday October 21st,” 21 October 2026](https://blog.railway.com/p/security-disclosure-wednesday-october-21st)
- [Railway, “Redeploy buckets and reconnect GitHub after the credential reset,” 22 October 2026](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset)
- [Railway, “Check for unexpected Grok usage,” 22 October 2026](https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-grok-usage)
- [The Hacker News, “OpenCode Console breach may have exposed AI provider keys,” 19 October 2026](https://thehackernews.com/2026/10/opencode-console-breach-may-have.html)
- [Zeabur, “October 2026 security incident,” 19 October 2026](https://zeabur.com/blogs/october-2026-security-incident)
- [Vercel, “Vercel April 2026 security incident,” April 2026](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident)
- [Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign,” November 2025](https://www.anthropic.com/news/disrupting-AI-espionage)
- [Anthropic, Threat Intelligence Report, September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)
- [Google Threat Intelligence Group, “From prompting to autonomy: the evolution of adversarial AI,” 8 September 2026](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai)
- [Mandiant, M-Trends 2026, 23 March 2026](https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026)
- [VulnCheck, “State of exploitation 2026,” 21 January 2026](https://www.vulncheck.com/blog/state-of-exploitation-2026)
- [Microsoft, Digital Defense Report 2026](https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/)
- [Verizon, 2026 Data Breach Investigations Report, executive summary](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf)
- [AWS, security bulletin AWS-2025-015, 23 July 2025](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/)
- [Nx, “s1ngularity postmortem,” 5 September 2025](https://nx.dev/blog/s1ngularity-postmortem)
- [Wiz, “s1ngularity’s aftermath,” 3 September 2025](https://www.wiz.io/blog/s1ngularitys-aftermath)
- [CVE-2025-32711 (EchoLeak), Microsoft, June 2025](https://www.cve.org/CVERecord?id=CVE-2025-32711)
- [Invariant Labs, “GitHub MCP exploited,” 26 May 2025](https://invariantlabs.ai/blog/mcp-github-vulnerability)
- [GitHub advisory GHSA-vxw4-wv6m-9hhh (CVE-2026-22812), OpenCode, 12 January 2026](https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh)
- [OWASP GenAI Security Project, “LLM01: Prompt injection,” 2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
- [NIST AI 100-2e2025, “Adversarial machine learning,” March 2025](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf)
- [Simon Willison, “The lethal trifecta,” 16 June 2025](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)
- [Supabase, “Defense in depth for MCP servers,” 2025](https://supabase.com/blog/defense-in-depth-mcp)
- [ASD’s ACSC, CISA, NSA, Cyber Centre, NCSC-NZ and NCSC-UK, “Careful adoption of agentic AI services,” 1 May 2026](https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services)
- [PostHog, “Shai-Hulud attack post-mortem,” 26 November 2025](https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem)
- [CISA, “Widespread supply chain compromise impacting npm ecosystem,” 23 September 2025](https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem)
- [CISA, “Implementing phishing-resistant MFA,” October 2022](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
- [Google, “New research: how effective is basic account hygiene at preventing hijacking,” 17 May 2019](https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html)
- [New York State Department of Financial Services, industry letter on cybersecurity risks arising from AI, 16 October 2024](https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks)
- [Davis Wright Tremaine, “HHS updates HIPAA rulemaking timeframes,” 8 July 2026](https://www.dwt.com/blogs/privacy--security-law-blog/2026/07/hhs-updates-hipaa-rulemaking-timeframes)
- [Federal Reserve, FDIC and OCC, SR 26-2, attachment, 17 April 2026](https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf)
- [NERC Project 2023-09 drafting team, white paper on third-party cloud services, December 2025](https://www.nerc.com/globalassets/standards/projects/2023-09/white-paper/project-2023-09-risk-management-for-third-party-cloud-services-white-paper_121825.pdf)
- [NIST IR 8596, Cyber AI Profile, initial preliminary draft, 16 December 2025](https://csrc.nist.gov/pubs/ir/8596/iprd)

---
Grayhaven Industries · https://www.grayhavenindustries.com/blog/attackers-run-agents