Threat reportThreat IntelligenceTL-2026-1686
AI Agent Identities Emerge as the Enterprise's Fastest-Growing Attack Surface: OAuth Tokens, Shadow AI, and AI-Driven EDR Evasion (STAC6994, UNC6395, NadMesh)
AI Agent Identities Emerge as the Enterprise's (TL-2026-1686), also tracked as Shadow AI Workforce, is a medium-severity tracked intrusion set, first published 2026-07-25. It is attributed to UNC6395 with low confidence, affects Salesloft Drift AI chat agent (Salesforce/Slack/Google, maps to 21 MITRE ATT&CK techniques (T1027.002, T1036.005, T1059.001), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1UNC6395
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1686
- Threat ID
- TL-2026-1686
- Also known as
- Shadow AI Workforce, AI Identity Attack Surface, Agentic AI Identity Sprawl
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- UNC6395
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, government administration, health, professionalservices, retail, softwaredevelopment
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in AI Agent Identities Emerge as the Enterprise's
Malware and tooling: JADEPUFFER, Lumma Stealer - S1213, NadMesh, XMRig
How AI Agent Identities Emerge as the Enterprise's works
Sophos' AI Security 2026 Report and BeyondTrust/Phantom Labs research document a 466.7% year-over-year surge in enterprise AI agents alongside a parallel rise in attacks against the OAuth tokens, API keys, and access permissions that govern them. Sophos disclosed STAC6994, a threat actor using roughly a dozen AI agents to author ~80 EDR-evasion modules against Sophos, CrowdStrike, and Microsoft Defender in days rather than weeks, while separate 2025-2026 incidents (UNC6395/Salesloft-Drift, NadMesh, JADEPUFFER) show OAuth-token theft and exposed AI/MCP infrastructure already being exploited at scale.
AI agent identities -- OAuth-connected service accounts, API keys, and machine credentials bound to coding assistants, chatbots, and autonomous agents -- have overtaken traditional exploit/PoC-driven vulnerabilities as the primary vector cited in current risk-landscape reporting. Sophos' AI Security 2026 Report (published 2026-07-22) and independent research from BeyondTrust's Phantom Labs team (2026-03-23) both frame this as a governance failure rather than a single software flaw: enterprise AI agent deployment grew 466.7% year-over-year, frequently through low-code platforms and embedded AI features in Microsoft Copilot, Azure AI Foundry, Salesforce, ServiceNow, Jira, and Confluence, without centralized identity governance, alert coverage, or least-privilege scoping. In many environments studied, AI agents operate with administrator-equivalent privileges and, unlike static service accounts, can inherit user permissions, call APIs autonomously, and act across systems without an interactive login to anchor detection.
Sophos' most concrete evidence is the STAC6994 cluster: analysts observed a threat actor running a software-development operation inside a compromised network using approximately 12 AI agents to author and test attacks against endpoint protection products (Sophos, CrowdStrike, Microsoft Defender), producing nearly 80 attack modules and more than 70 distinct evasion techniques in days -- work Sophos CTO John Peterson described as AI functioning for the first time as a demonstrated 'operational force multiplier' for an intrusion.
This risk is not hypothetical elsewhere in the ecosystem. The 2025 UNC6395/Salesloft-Drift campaign -- still cited as the canonical AI-agent-identity case study in 2026 reporting -- stole OAuth/refresh tokens from the Drift AI chat integration via voice-phishing of Salesforce administrators, and pivoted through 700+ downstream Salesforce, Slack, Google Workspace, AWS, Azure, and OpenAI-connected tenants before Salesloft and Salesforce revoked all active tokens. In 2026, the NadMesh botnet operationalized Shodan-powered scanning against exposed self-hosted AI/MCP infrastructure (Ollama, Langflow, ComfyUI, Open WebUI, Gradio, n8n) with 20+ exploitation vectors, CISA added a Langflow IDOR to its Known Exploited Vulnerabilities catalog after in-the-wild exploitation of 7,000+ exposed instances, and JADEPUFFER became the first documented ransomware operation run end-to-end by an autonomous LLM agent. Across these campaigns, the consistent root causes are broad or 'Allow All' OAuth scope grants that persist after tool removal, unauthenticated internet-facing AI/MCP servers, and a lack of behavioral baselining for what 'normal' AI agent API activity looks like -- enabling stolen-token traffic to blend in with legitimate usage.
No CVE, CVSS score, or single PoC applies to this item; it is a documented, evidence-backed risk-landscape trend spanning multiple named vendors, named threat clusters, and multiple corroborated 2025-2026 incidents, assembled here as an aggregate threat-intelligence record rather than a single-vulnerability advisory.
MITRE ATT&CK techniques used in TL-2026-1686
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location
Execution
Privilege Escalation
Persistence
Command and Control
Credential Access
T1110 Brute Force; T1528 Steal Application Access Token; T1552.001 Credentials In Files
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain; T1566.004 Spearphishing Voice
Collection
T1213 Data from Information Repositories
Impact
T1486 Data Encrypted for Impact
Discovery
Lateral Movement
T1550.001 Application Access Token
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Resource Development
T1584.001 Domains; T1588.002 Tool
Reconnaissance
Affected products and versions in AI Agent Identities Emerge as the Enterprise's
- Salesloft — Drift AI chat agent (Salesforce/Slack/Google Workspace/AWS/Azure/OpenAI integrations)
Vulnerable versions: OAuth/refresh tokens issued prior to the September 2025 revocation
Fixed in: All active Drift OAuth/refresh tokens revoked and reissued by Salesloft and Salesforce, September 2025 - Multiple (Microsoft, Salesforce, ServiceNow, Atlassian) — Embedded enterprise AI agents (Microsoft Copilot, Azure AI Foundry, Salesforce AI, ServiceNow AI, Jira/Confluence AI)
Vulnerable versions: Any AI agent/service account provisioned without centralized non-human-identity governance
Fixed in: N/A -- governance/process control, not a patchable version - Langflow — Langflow AI agent-building platform
Vulnerable versions: Pre-patch versions with unauthenticated IDOR, added to CISA KEV; exploited in the wild on 7,000+ internet-exposed instances
Fixed in: Patched release closing the IDOR; instances must additionally be removed from public internet exposure - Ollama — Self-hosted LLM server
Vulnerable versions: Versions affected by the 'Bleeding Llama' out-of-bounds heap read (300,000+ exposed servers observed)
Fixed in: Patched release; recommend authenticated, non-internet-facing deployment - LiteLLM — AI gateway / LLM proxy
Vulnerable versions: Internet-exposed deployments paired with privileged cloud IAM roles and no authentication
Fixed in: Authenticated deployment behind a network boundary with least-privilege IAM role scoping - Various (ComfyUI, Open WebUI, Gradio, n8n) — Self-hosted AI/automation infrastructure
Vulnerable versions: Internet-exposed instances discoverable via Shodan and targeted by the NadMesh botnet
Fixed in: N/A -- requires authenticated deployment and network isolation
Remediation for AI Agent Identities Emerge as the Enterprise's
Patches
- Apply vendor patches for disclosed AI-agent-framework vulnerabilities where present in your stack (e.g., CISA KEV Langflow IDOR, Ollama 'Bleeding Llama' heap read, NVIDIA Triton auth bypass)
Immediate actions
- Restrict AI agent OAuth scopes to least privilege; ban 'Allow All'/broad grants for third-party AI browser extensions and integrations
- Treat AI agent and non-human identities like human users: require manual verification before granting new access areas or scopes
- Revoke and rotate OAuth/API tokens for any AI browser extension, chatbot, or SaaS-embedded AI integration (Drift-style Salesforce/Slack/Google Workspace connectors) with unclear scope history
- Inventory and take offline any internet-exposed self-hosted AI/MCP infrastructure (Ollama, Langflow, LiteLLM, ComfyUI, Open WebUI, Gradio, n8n) discoverable via Shodan
Workarounds
- Place any self-hosted AI/MCP infrastructure behind authenticated network boundaries; never expose Ollama, Langflow, LiteLLM, or similar services directly to the internet
- Disable or quarantine third-party AI integrations pending scope review until 'Allow All'-style grants are replaced with narrowly scoped permissions
Longer-term hardening
- Deploy centralized non-human/AI identity governance covering provisioning, scope review, and periodic access recertification (per BeyondTrust/Phantom Labs 'shadow AI workforce' findings)
- Instrument behavioral analytics and alerting for anomalous AI agent API activity, unexpected data access, and exfiltration patterns
- Adopt AI-aware EDR/XDR detection content able to spot AI-assisted malware development and evasion-technique testing (per STAC6994)
- Establish a joint AppSec/identity review gate for any new AI agent, coding assistant, or MCP server before production deployment
Weaknesses (CWE) in AI Agent Identities Emerge as the Enterprise's
Timeline of AI Agent Identities Emerge as the Enterprise's
- UNC6395 begins a widespread OAuth-token-theft campaign against the Salesloft-owned Drift AI chatbot integration, using voice-phishing (vishing) to trick administrators into authorizing a malicious connected app.
- Salesloft discloses the Drift OAuth breach; stolen tokens are later found to have granted attacker access across Salesforce, Slack, Google Workspace, AWS, Azure, and OpenAI integrations at 700+ organizations.
- Mandiant confirms containment of the Salesloft Drift incident after Salesloft and Salesforce revoke all active Drift OAuth access and refresh tokens.
- BeyondTrust's Phantom Labs publishes research, presented at RSA Conference, documenting a 466.7% year-over-year increase in active enterprise AI agents and coining the 'shadow AI workforce' problem of ungoverned non-human identities.
- CISA adds a Langflow IDOR vulnerability to the Known Exploited Vulnerabilities catalog -- the first AI agent platform listed -- after in-the-wild exploitation against 7,000+ internet-exposed instances.
- JADEPUFFER, the first documented end-to-end agentic ransomware operation run entirely by an autonomous LLM agent, encrypts 1,342 Nacos service-configuration items in a live extortion operation.
- The Go-based NadMesh botnet is documented combining Shodan-powered reconnaissance with 20+ exploitation vectors to autonomously discover and hijack exposed AI/MCP infrastructure (ComfyUI, Ollama, Langflow, Open WebUI, Gradio, n8n).
- Sophos CISO Ross McKerchar publicly describes Sophos analysts discovering a threat actor running roughly a dozen AI agents to test EDR evasion against endpoint protection products.
- Sophos publishes its AI Security 2026 Report, formally tracking the campaign as STAC6994 and detailing the compressed development of ~80 attack modules and 70+ evasion techniques against Sophos, CrowdStrike, and Microsoft Defender.
- Infosecurity Magazine reports on the Sophos and BeyondTrust findings, framing AI agent identities as the enterprise's fastest-growing exposed attack surface.
Sources cited for AI Agent Identities Emerge as the Enterprise's
- AI Agents Now the Enterprises Fastest Growing Exposed Attack Surface
- AI Is Compressing Cyberattack Timelines and Targeting Ungoverned AI Identities, Sophos AI Security Report Finds
- AI Is Compressing Cyberattack Timelines and Targeting Ungoverned AI Identities, Sophos AI Security Report Finds (mirror)
- When the attacker is an AI agent
- Phantom Labs Analysis of BeyondTrust's Identity Security Insights Data Finds Enterprise AI Agents Growing 466.7% Year Over Year
- BeyondTrust Data Shows 466.7% Growth in Enterprise AI Agents
- Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances
- Unpacking the Salesloft Incident
- The Drift OAuth breach: A cybersecurity wake-up call
- awesome-ai-agent-attacks -- curated timeline of AI agent security incidents (2024-2026)
- NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure
- Steal Application Access Token, Technique T1528 - MITRE ATT&CK
- Use Alternate Authentication Material: Application Access Token, T1550.001 - MITRE ATT&CK
- AIMap: Open-source tool finds and tests exposed AI endpoints
Detection coverage for TL-2026-1686
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1686 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.