Four incident records published between 9 October and 6 November describe different victims and the same target: credentials that one system stores so that another system can be reached. Chainalysis, Todyl, the Cloud Security Alliance and Wiz each document a different link in that chain.
Chainalysis: the notice grew as the investigation did
On 30 October, Chainalysis told customers it had “detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” The first update said investigators had found no indication that investigation content, passwords in clear text, MFA secrets or user session tokens were accessed. The data the company confirmed at that point was user IDs, full names, email addresses and organization role labels.
The company’s page has been updated four times since. Its 4 November entry says that on Monday 2 November it discovered that “names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor.” Chainalysis wrote: “While we investigated, we removed access to Reactor and Data Solutions.” The same day it took the KYT transaction-screening interface and API offline after “abnormal activity,” and it said it was notifying customers whose KYT accounts appeared to have been accessed without authorization.
Chainalysis also told a subset of customers that an “on-path attack” had exposed their passwords, that the vector was contained, and that their accounts were locked. At 3:30 a.m. EST on 6 November it reported a phased restoration of KYT and Address Screening. Every user must reset a password and rotate API keys before registering transactions, and customers send trusted IP addresses for an allowlist. The company says it has no evidence that investigations data was accessed or that its attribution data was manipulated.
The recovery steps show what an incident like this costs a customer. Resetting a password was not enough, because the exposed material included live tokens and API credentials that sit in customers’ own pipelines.
Todyl: valid application secrets, no vulnerability
A second record comes from the managed detection and response team at Todyl, published 3 November and still being updated. Todyl says that since 1 November one operator has been signing in to managed service providers’ Microsoft 365 and Azure environments as the providers’ own applications, using stolen credentials that are still valid. About 45 app registrations at roughly 18 organizations were targeted, and more than 33 authenticated successfully. Todyl’s summary states: “No Microsoft vulnerability is involved.”
Through those applications the operator reached 27 organizations, including the providers’ downstream clients in government, energy, food and agriculture, transportation, legal and education. Todyl counted searches across about 25 tenants, 81 downloaded files and around 2,279 mailbox items, and says the figures are a floor because they cover only organizations that send logs to Todyl.
The timing is the part Todyl dwells on. Scripted clients made 95% of the sign-ins, with bursts of up to 24 sign-ins in 10 seconds. In one case the operator downloaded a connector archive and signed in as that connector’s application about 2.5 minutes later. Todyl says this “fit automated, possibly AI-assisted agentic tooling,” and also says it has not tied the activity to a specific agentic workflow or framework. The firm holds the possibility that an AI model directed the activity at low confidence, and it calls the activity unattributed and unrelated to the October ConnectWise Cloud Backup compromise that Microsoft attributed to Storm-0940.
How the operator first obtained the secrets is unknown. Todyl notes that several seed secrets had only been used from staff devices and office networks, and some arrived as current-and-expired pairs, which it reads as pointing to a file store or live backend. On the consequence for providers it is direct: “One compromised MSP app exposes every client it manages.” It also advises that rotating credentials is not sufficient on its own, because the operator kept retrying against disabled and rotated applications and moved to replaying users’ refresh tokens, all of which Conditional Access blocked on 3 November.
CSA: the custodian layer holds the keys
The third record is a research note from the Cloud Security Alliance AI Safety Initiative, dated 23 October. It tabulates three platform disclosures from a two-week window. Fireworks AI reported on 9 October that internal credentials had been used to read environment variables in customer evaluation jobs. OpenCode disclosed on 17 October that an intruder reached a legacy Console system holding OpenAI, Anthropic and Google keys saved by about 1.4% of its users. Railway disclosed on 21 October that customer environment variables may have been read and in some cases decrypted, and described its incident as part of “a series of attacks recently targeting platform companies.”
CSA is careful about attribution. It writes that no vendor has publicly linked the incidents to a single actor, and that the campaign framing so far comes from Railway alone. Its finding concerns structure. Each intermediary that brokers AI calls needs working provider credentials to do its job, so each one holds secrets on behalf of many downstream customers. CSA’s summary of the consequence is that “The credential as a whole is only as safe as its least-protected copy.”
That sentence changes the remediation. CSA recommends rotating keys at the issuing provider and not only deleting them from the intermediary, and it cites Fireworks telling customers that deleting a stored secret does not invalidate the credential. A key pasted into a hosting platform, a gateway database, an evaluation service and a coding-agent console exists in four places, and an attacker who read one of them still holds a working copy after the others are cleaned up.
Wiz: what machine-speed intrusion looks like
The fourth record measures pace. On 29 October the Wiz team published a review of agentic intrusions from its own incident response work and from public reports. It says it increasingly sees intrusions “where AI agents appear to handle much of the hands-on work,” and that “AI agents compress the skilled, hands-on work that such escalation once required.”
Wiz describes three investigated attacks. In one, a new purpose-built script appeared roughly every one to two minutes for about 24 hours, 99 scripts in all. In another, a Java gateway intrusion produced 602 unique steps over about 4.5 hours with seconds between phases. In a third, a chain through an AI-agent backend ended in bulk exfiltration of secrets, including a cloud credential and a Kubernetes token. Wiz also notes the defender’s opening: “Current agentic attacks tend towards the noisy, leaving behind a broad trail of observable activity.”
A separate Wiz CIRT write-up of 20 October, by Shira Ayal and Andre Maccarone, shows the same appetite for stored access from a different angle. Threat actors hijacked cloud billing accounts to fund unauthorized AI usage, running up hundreds of thousands of dollars in charges, starting from a single sponsored-search ad that led to a fake Google login page.
What the four records add up to
In our reading, the records agree on three points even though no single source says all three. The first is that the stolen item is a credential with standing access, such as an application secret, an environment variable, a live token or a billing link. Todyl found no software flaw. CSA’s platforms were reached through internal credentials and a legacy system. Chainalysis lost live tokens and password hashes.
The second is that the custodian is the target. A managed service provider’s multi-tenant application, a platform that stores a customer’s provider key and a security vendor’s customer database each concentrate access for many organizations. Our earlier coverage of Wiz’s count of 11 AI developer platform incidents followed the same pattern from the provider side, and our report on token replay in 79 Microsoft 365 organizations showed that a valid token can stand in for a password.
The third is speed. Todyl measured minutes between a harvest and the next sign-in, and Wiz measured scripts arriving every minute or two. A response plan that starts with a ticket and a weekly rotation schedule runs slower than the activity it is meant to stop.
The records also differ on one point. Chainalysis and Todyl describe active incidents with open questions, including initial access, and both have revised their numbers as work continued. CSA’s note is a pattern analysis that says outright that root causes and affected-user counts remain undisclosed. Treat the figures in all four as provisional.
What it means for the security leader
A CISO can start by counting how many places hold a working copy of each credential the organization issues. The inventory has to include the secrets a vendor stores on the organization’s behalf, since a vendor breach gives the attacker those copies. Chainalysis customers are living this now, with an allowlist, a password reset and a key rotation required before service returns.
Providers that manage client tenants carry the largest concentration. Todyl reports that the operator expanded inside each provider’s family of applications within minutes, and that the stolen files included password lists, private keys, VPN profiles, MFA and remote-management API keys and backup-storage credentials. A client of a managed provider should ask which of the provider’s applications have delegated rights to its tenant and how those secrets are stored.
What defenders can do this week
- List every application registration and service principal with tenant-wide or delegated rights, and remove the ones with no owner. Todyl’s sign-in tell was a secret ID tried before the secret, followed by a successful sign-in from the same address.
- Rotate at the issuer. For AI provider keys, revoke and reissue in the provider’s console, as CSA advises, so a copy held by a compromised intermediary stops working.
- Prefer short-lived, narrowly scoped and spend-capped credentials, which CSA names as the longer-term move because they keep a stolen copy’s value low.
- Check that Conditional Access covers scripted clients signing in from hosting providers and that it applies to token replay. Todyl reports it blocked every replay it saw on 3 November.
- Alert on machine-paced sign-in bursts and on a Resource Manager token followed at once by a Key Vault token for the same application. Wiz expects agentic activity to leave a broad, noisy trail.
- If you are a Chainalysis customer, follow the company’s restoration steps: submit trusted IP addresses, reset passwords and rotate API keys, and reset any password reused on another system.
