AI agents in the attack chain: why identity controls still matter
Recent reporting describes attackers using agentic tooling in a supply-chain campaign. Treat every automated agent as a privileged identity that needs narrow access and audit trails.
Microsoft reports that the China-aligned group Storm-0940 used the agentic penetration-testing framework ARTEX to automate parts of a campaign targeting organisations and abusing a compromised multi-tenant ConnectWise application. In some affected environments, the activity reached privileged cloud access quickly. Microsoft advises defenders to inspect service-principal sign-ins, OAuth application changes and Microsoft Graph activity. Read Microsoft's incident analysis and response guidance.
Controls to review
- Give agents and service accounts their own identities; do not reuse employee credentials.
- Restrict permissions to the smallest set of actions and resources required, and require approval for sensitive changes.
- Use phishing-resistant multi-factor authentication for administrators and remove stale credentials.
- Alert on unusual sign-in patterns, privilege changes and bulk access to tenant data.
- Keep logs for agent actions so responders can connect an automated task to its identity, tools and approvals.
This is a developing security story. Follow the vendor's live advisory for affected application identifiers and containment steps before changing integrations. Presence of an application alone does not establish that a tenant was compromised.