Your OAuth grants and AI tools are the breach — not your CVE queue

The identity layer stopped being a control

Two campaigns are running against your tenants right now, and neither triggers the alerts you're paying for. ShinyHunters spent a year inside Salesforce environments after vishing employees into approving a connected app that impersonated Data Loader. No CVE. No MFA bypass. No re-authentication prompt. The app inherited user permissions and ran high-volume API exports for twelve months while the sign-in dashboard stayed green.

The parallel Entra ID campaign is worse because it scales. Attackers spoof legitimate Microsoft OAuth client IDs and POST stolen credentials through the Resource Owner Password Credentials flow to validate them at scale. Default sign-in logging doesn't record the interactive event. The only footprint is a scatter of blank application IDs and AADSTS700016 errors — which double as a free credential-triage oracle, since the error family tells the attacker which of username, password, and conditional access each passed.

Yes, but — Microsoft, Salesforce, and Palantir all spent the same 72 hours warning that model providers harvest customer data, and the messaging is transparently self-serving. Fine. The messaging is self-serving and the attack surface it describes is real, because the actors compromising you this week aren't the labs. They're using consent grants and OAuth flows that were architected to be invisible to login-centric SOCs.

Do this before Friday: hunt Entra sign-in logs for blank application IDs and AADSTS700016, disable ROPC tenant-wide unless a named legacy app requires it, and inventory every connected app in Salesforce and M365. Revoke anything unused or over-permissioned. Consent-grant monitoring is off by default in most tenants — turn it on.

The AI dev tool became the exfiltration channel

xAI's Grok Build CLI was caught uploading entire Git repositories — full commit history, files the agent never read — to an xAI-controlled GCS bucket. Undisclosed. No DPA. Musk promised 48-hour deletion, which is a reversal, not a remedy. Every repo it touched is a confirmed disclosure to an uncontracted processor, and full history is exactly where the deleted secrets live.

Ghostcommit is the same class of failure at the model layer: prompt injection hidden inside images pushed to a repo, instructing the coding agent to cat .env and exfiltrate byte-by-byte. Cursor and Antigravity complied. PR review bots skipped the images and auto-approved. Only Claude Code on Opus caught it. Tracebit's context bombs — guardrail-triggering payloads planted in decoy secrets — cut agentic attacker admin success from 57% to 5%, and to zero against the most capable models. That is the paradox worth naming: the more capable your agent, the more susceptible it is to adversarial content in its data environment, and the more useful adversarial content becomes as your defense.

Block Grok Build CLI on internal codebases today. Add data-boundary review — what leaves the machine, where it goes, retention terms — as a hard gate on every AI coding tool your org approves. Exclude .env, credential paths, and keychain directories from agent context, and restrict agent network egress. If you run security canaries, retrofit context-bomb payloads into your decoy secrets this sprint.

The supply chain is on fire in three places

@asyncapi npm namespace hijack: three poisoned versions (generator 3.3.1, generator-helpers 1.1.1, generator-components 0.7.1) drop a Miasma loader from IPFS on import, persisting as sync.js with C2 at 85.137.53.71. IPFS staging is censorship-resistant, and the loader fires during normal CI import before any secret scanner runs. Timing is the point.

npm 12 went GA the same week with lifecycle scripts disabled by default — the single biggest supply-chain hardening in the registry's history. It will also silently ship you broken installs. Postinstall no-ops don't throw; native builds (sharp, better-sqlite3), binary fetchers (esbuild, prisma), and husky-style setup simply fail to complete, and CI stays green. Stage through 11.18.0 first to surface the deprecation warnings, inventory affected packages via npm query ':attr(scripts,[postinstall])', and allow-list back what you actually need. A blanket global re-enable puts you back exactly where npm just moved you from.

And patch RabbitMQ 3.13.0+ today. Unauthenticated GETs to /api/auth return the broker's OAuth client secret — full admin takeover of the trust center of your event-driven architecture. Patching closes the flaw. Only rotation closes the leak.

The through-line, and what it costs to ignore

Every serious incident this week ran on trust you had already granted: an OAuth consent, a notarized installer, a package namespace, a coding agent's default file access, a broker's /api/auth endpoint. Nothing on the list needed a zero-day. The CVE queue is not where the risk lives anymore, which is uncomfortable because the CVE queue is where your tooling, your metrics, and your board reporting still point.

The one action that compounds across all of it: build a standing-authorization inventory this quarter. Every OAuth grant, every non-human identity, every AI tool with credentials, every MCP server, every CI token — enumerated, owned, and revocable by a named human. Half your organization will discover it can't produce that list. That's the finding. The other half will discover the list is three times longer than anyone thought. That's the work.