# AI Agent Identities Emerge as the Enterprise's Fastest-Growing Attack Surface: OAuth Tokens, Shadow AI, and AI-Driven EDR Evasion (STAC6994, UNC6395, NadMesh)

> Sophos' AI Security 2026 Report and BeyondTrust/Phantom Labs research document a 466.7% year-over-year surge in enterprise AI agents alongside a parallel rise in attacks against the OAuth tokens, API keys, and access permissions that govern them. Sophos disclosed STAC6994, a threat actor using roughly a dozen AI agents to author ~80 EDR-evasion modules against Sophos, CrowdStrike, and Microsoft Defender in days rather than weeks, while separate 2025-2026 incidents (UNC6395/Salesloft-Drift, NadMesh, JADEPUFFER) show OAuth-token theft and exposed AI/MCP infrastructure already being exploited at scale.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1686
- **ID:** TL-2026-1686
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** UNC6395
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AI agent identities -- OAuth-connected service accounts, API keys, and machine credentials bound to coding assistants, chatbots, and autonomous agents -- have overtaken traditional exploit/PoC-driven vulnerabilities as the primary vector cited in current risk-landscape reporting. Sophos' AI Security 2026 Report (published 2026-07-22) and independent research from BeyondTrust's Phantom Labs team (2026-03-23) both frame this as a governance failure rather than a single software flaw: enterprise AI agent deployment grew 466.7% year-over-year, frequently through low-code platforms and embedded AI features in Microsoft Copilot, Azure AI Foundry, Salesforce, ServiceNow, Jira, and Confluence, without centralized identity governance, alert coverage, or least-privilege scoping. In many environments studied, AI agents operate with administrator-equivalent privileges and, unlike static service accounts, can inherit user permissions, call APIs autonomously, and act across systems without an interactive login to anchor detection.

Sophos' most concrete evidence is the STAC6994 cluster: analysts observed a threat actor running a software-development operation inside a compromised network using approximately 12 AI agents to author and test attacks against endpoint protection products (Sophos, CrowdStrike, Microsoft Defender), producing nearly 80 attack modules and more than 70 distinct evasion techniques in days -- work Sophos CTO John Peterson described as AI functioning for the first time as a demonstrated 'operational force multiplier' for an intrusion.

This risk is not hypothetical elsewhere in the ecosystem. The 2025 UNC6395/Salesloft-Drift campaign -- still cited as the canonical AI-agent-identity case study in 2026 reporting -- stole OAuth/refresh tokens from the Drift AI chat integration via voice-phishing of Salesforce administrators, and pivoted through 700+ downstream Salesforce, Slack, Google Workspace, AWS, Azure, and OpenAI-connected tenants before Salesloft and Salesforce revoked all active tokens. In 2026, the NadMesh botnet operationalized Shodan-powered scanning against exposed self-hosted AI/MCP infrastructure (Ollama, Langflow, ComfyUI, Open WebUI, Gradio, n8n) with 20+ exploitation vectors, CISA added a Langflow IDOR to its Known Exploited Vulnerabilities catalog after in-the-wild exploitation of 7,000+ exposed instances, and JADEPUFFER became the first documented ransomware operation run end-to-end by an autonomous LLM agent. Across these campaigns, the consistent root causes are broad or 'Allow All' OAuth scope grants that persist after tool removal, unauthenticated internet-facing AI/MCP servers, and a lack of behavioral baselining for what 'normal' AI agent API activity looks like -- enabling stolen-token traffic to blend in with legitimate usage.

No CVE, CVSS score, or single PoC applies to this item; it is a documented, evidence-backed risk-landscape trend spanning multiple named vendors, named threat clusters, and multiple corroborated 2025-2026 incidents, assembled here as an aggregate threat-intelligence record rather than a single-vulnerability advisory.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.002 Tool
- T1584.001 Domains
- T1566.004 Spearphishing Voice
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 PowerShell
- T1098 Account Manipulation
- T1078.004 Cloud Accounts
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1110 Brute Force
- T1526 Cloud Service Discovery
- T1550.001 Application Access Token
- T1213 Data from Information Repositories
- T1102 Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact

## Sources

- [AI Agents Now the Enterprises Fastest Growing Exposed Attack Surface](https://www.infosecurity-magazine.com/news/ai-agents-attack-surface/)
- [AI Is Compressing Cyberattack Timelines and Targeting Ungoverned AI Identities, Sophos AI Security Report Finds](https://kbi.media/press-release/ai-is-compressing-cyberattack-timelines-and-targeting-ungoverned-ai-identities-sophos-ai-security-report-finds/)
- [AI Is Compressing Cyberattack Timelines and Targeting Ungoverned AI Identities, Sophos AI Security Report Finds (mirror)](https://finance.yahoo.com/technology/ai/articles/ai-compressing-cyberattack-timelines-targeting-100000271.html)
- [When the attacker is an AI agent](https://www.sophos.com/en-us/blog/when-the-attacker-is-an-ai-agent)
- [Phantom Labs Analysis of BeyondTrust's Identity Security Insights Data Finds Enterprise AI Agents Growing 466.7% Year Over Year](https://www.beyondtrust.com/press/rapidly-expanding-shadow-ai-workforce)
- [BeyondTrust Data Shows 466.7% Growth in Enterprise AI Agents](https://securitymea.com/2026/03/25/beyondtrust-data-shows-466-7-growth-in-enterprise-ai-agents/)
- [Threat Brief: Salesloft Drift Integration Used To Compromise Salesforce Instances](https://unit42.paloaltonetworks.com/threat-brief-compromised-salesforce-instances/)
- [Unpacking the Salesloft Incident](https://cloudsecurityalliance.org/blog/2026/07/20/unpacking-the-salesloft-incident)
- [The Drift OAuth breach: A cybersecurity wake-up call](https://www.wtwco.com/en-us/insights/2025/09/the-drift-oauth-breach-a-cybersecurity-wake-up-call)
- [awesome-ai-agent-attacks -- curated timeline of AI agent security incidents (2024-2026)](https://github.com/webpro255/awesome-ai-agent-attacks)
- [NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure](https://cybersecuritynews.com/nadmesh-uses-shodan/)
- [Steal Application Access Token, Technique T1528 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1528/)
- [Use Alternate Authentication Material: Application Access Token, T1550.001 - MITRE ATT&CK](https://attack.mitre.org/techniques/T1550/001/)
- [AIMap: Open-source tool finds and tests exposed AI endpoints](https://www.helpnetsecurity.com/2026/05/06/aimap-ai-attack-surface-discovery/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1686