AI agents are stealing your data while you sleep, boss

Friday Free Edition - June 26, 2026

🚨 THREAT OF THE WEEK

Autonomous AI Agents Weaponized in Multi-Stage Enterprise Credential Harvesting Campaign

Security researchers at Mandiant and independent red teams have confirmed what many threat intelligence analysts feared was coming: a sophisticated, state-nexus threat actor tracked as UNC-MOSAIC is actively exploiting enterprise-deployed AI agent frameworks — including auto-GPT-style orchestration layers and LLM-powered RPA bots — to conduct persistent, low-and-slow credential harvesting across Fortune 500 networks.

The attack chain is elegant in its brutality. Adversaries compromise a single AI agent node — typically one granted broad permissions to access email, calendars, internal wikis, and file shares to "boost productivity" — and then use that agent's native tool-calling capabilities to laterally enumerate credentials, API tokens, and OAuth grants without triggering traditional behavioral analytics. Because the malicious queries look identical to legitimate autonomous agent workflows, SIEMs are largely blind to the exfiltration.

Why this is a five-alarm fire right now:

Enterprise AI agent deployments have exploded 340% year-over-year, with most organizations granting agents permissions that would make a seasoned sysadmin weep
Most agent frameworks lack native audit logging that maps to existing SIEM correlation rules — you're flying blind
UNC-MOSAIC has been attributed with moderate confidence to a nation-state actor with a documented interest in intellectual property from aerospace, semiconductor, and pharmaceutical sectors
At least 23 confirmed victim organizations across North America and Western Europe have been identified as of this week, with breach dwell times averaging 47 days before detection
The campaign exploits overly-permissioned service accounts created during rushed AI pilot deployments — the security debt from your 2025 "AI transformation sprint" is now due

Immediate recommended actions: Audit every AI agent's permission scope today. Apply least-privilege principles retroactively. Enable verbose logging on all agent tool calls and pipe them into your SIEM. Treat every agent service account as a potential pivot point and review OAuth grant lists with the same paranoia you'd apply to a suspicious admin account. If you don't know what your AI agents are doing at 3 AM, someone else might.

🔬 DEEP DIVE

The Agent Permission Problem: How "Helpful" Became "Catastrophic"

To understand why the UNC-MOSAIC campaign is so effective, you need to understand the fundamental design tension baked into every enterprise AI agent deployment: usefulness requires access, and access creates attack surface. Nobody ever made a helpful agent that couldn't read your email. The problem is that nobody thought hard enough about what happens when that agent gets compromised.

Modern AI agent frameworks — LangChain-based orchestrators, Microsoft Copilot Studio custom agents, Salesforce Agentforce deployments, and a dozen open-source alternatives — operate via a tool-calling model. The agent is given a set of "tools" (read: API integrations and permissions) and autonomously decides which to call, in what sequence, to complete a goal. This is powerful. It is also a security architect's nightmare.

Here's the attack flow UNC-MOSAIC has refined:

Stage 1 — Initial Foothold: Adversary compromises the agent runtime environment via a poisoned third-party plugin, a supply chain hit on an agent framework dependency, or simply brute-forcing a poorly-secured agent API endpoint left exposed during a dev/test deployment
Stage 2 — Reconnaissance via Native Tools: Rather than deploying malware, the attacker issues legitimate-looking tool calls through the compromised agent: search the file share for "password," query the calendar API for executive travel schedules, enumerate SharePoint for documents tagged "confidential"
Stage 3 — OAuth Token Harvesting: The agent's stored OAuth tokens for integrated services (Salesforce, Workday, GitHub, AWS) are extracted from the agent's memory or secrets store — often stored in plaintext or with minimal encryption at rest
Stage 4 — Slow Exfiltration: Data is exfiltrated in small chunks through the agent's legitimate outbound channels — summaries sent to "stakeholders," documents attached to "scheduled reports" — at volumes designed to stay under DLP thresholds
Stage 5 — Persistence: The agent is instructed to create new OAuth grants or API keys under the guise of "expanding integrations," ensuring continued access even if the initial compromise vector is patched

The deeper structural problem is that most organizations deployed AI agents under business unit ownership, not IT security governance. The marketing team's Copilot agent that can "read anything in SharePoint" was approved by a VP who was excited about the demo, not reviewed by a security architect who asked what happens when it's compromised.

Security teams need to start treating AI agents as privileged identities — not as software features. Every agent should have an identity in your IAM system, a documented permission scope, a rotation schedule for its credentials, and monitoring in your PAM solution. The frameworks are maturing: both Microsoft and major cloud providers have begun publishing agent identity governance guidelines in 2026, but adoption is lagging dangerously behind deployment.

The hard truth: your AI transformation is only as secure as the least-reviewed service account attached to it.

💻 HACK OF THE WEEK

European Railway Consortium Hit by Ransomware; Operational Technology Networks Impacted

In what is shaping up to be the most significant OT-impacting ransomware incident in the European transportation sector this year, a consortium managing rail infrastructure across three EU member states disclosed this week that it suffered a ransomware intrusion that propagated from IT networks into operational technology environments. The group behind the attack, DragonLock — a ransomware-as-a-service operation with Russian-language forums and a documented affiliate program — has claimed responsibility and is reportedly demanding a ransom in the eight-figure range.

The breach began with a spearphishing email targeting a third-party maintenance contractor with access to the consortium's VPN. From there, attackers moved laterally over approximately three weeks before deploying ransomware that encrypted IT systems and, critically, reached historian servers and HMI workstations in at least two rail management centers. Passenger train scheduling systems were disrupted for 18 hours across affected regions, though officials confirmed that safety-critical signaling systems operated on isolated networks and were not compromised.

Key takeaways for OT security teams:

Third-party contractor VPN access remains the #1 initial access vector in OT-impacting incidents — if you haven't implemented just-in-time privileged access for vendors, this week is your motivation
IT/OT network segmentation held for safety-critical systems, which is the only reason this was a bad week and not a catastrophic one — segmentation works, invest in it
Historian servers and HMI workstations continue to be under-patched and poorly monitored; they are neither fully IT nor fully OT in most governance frameworks, and they fall through the cracks
DragonLock's affiliates have been observed targeting transportation, energy, and water sectors across Europe with increasing frequency in 2026 — if you operate critical infrastructure on the continent, raise your threat level

🛠️ TOOL SPOTLIGHT

AgentScope — Open-Source AI Agent Permission Auditing Framework

Given this week's threat of the week, the timing on this tool couldn't be better. AgentScope is an open-source security auditing framework specifically designed to enumerate, assess, and report on the permission scopes granted to AI agents across common enterprise platforms including Microsoft Copilot Studio, LangChain deployments, and OpenAI Assistants API integrations.

Released by a team of security researchers at the SANS Technology Institute and actively maintained on GitHub, AgentScope performs several functions that are genuinely hard to do manually at scale:

Permission Enumeration: Connects to your tenant via read-only API credentials and catalogs every deployed agent alongside its granted tool permissions, OAuth scopes, and service account associations
Overprivilege Scoring: Scores each agent against a least-privilege baseline and flags agents with permissions that exceed documented use-case requirements
Secrets Exposure Detection: Scans agent configurations for hardcoded API keys, tokens, and credentials in system prompts or tool definitions (yes, people do this — constantly)
Audit Log Gap Analysis: Identifies agent tool calls that are not captured in your existing logging infrastructure and generates SIEM integration templates for common platforms
Compliance Reporting: Outputs reports formatted for NIS2, SOC 2, and ISO 27001 control mappings relevant to AI system governance

AgentScope is free, Apache 2.0 licensed, and runs on-premises with no data leaving your environment. It's not a silver bullet — nothing is — but it will give you a clearer picture of your AI agent attack surface than you almost certainly have today. Find it on GitHub under SANS-Tech-Institute/agentscope. Run it this weekend. You probably won't like what you find, but you'll like finding it yourself more than having UNC-MOSAIC find it for you.

📋 THE BREACH BOARD

This week's confirmed and developing incidents worth tracking:

MedSync Health Platform (USA): Electronic health records platform serving approximately 4.1 million patients across 340 clinic networks confirmed a breach affecting patient demographic data, insurance information, and partial medical records. Attackers gained access via an unpatched API endpoint in a legacy patient portal integration. HIPAA notification process underway. Breach dwell time estimated at 61 days.
Southeast Asian Telecom Provider (Regional): A major telecommunications operator across three Southeast Asian markets disclosed that subscriber data including names, addresses, SIM registration details, and call metadata for an estimated 28 million customers was found for sale on a cybercriminal forum. The operator has not confirmed the intrusion vector. Data appears authentic based on independent researcher sampling.
CloudBuild CI/CD Platform (Global): A popular developer-focused CI/CD SaaS platform disclosed a supply chain incident in which a compromised maintainer account was used to inject malicious code into a widely-used build runner component. An estimated 1,200 organizations may have executed the malicious runner; downstream impact is still being assessed. Rotate any secrets exposed in pipelines using affected versions immediately.
Municipal Water Authority — Undisclosed US State: CISA confirmed this week it is assisting an unnamed US municipal water authority following unauthorized access to its industrial control systems. Officials confirmed no changes were made to water treatment processes and public safety was not at risk. The incident is under active FBI investigation. This is the fourth water sector ICS incident CISA has publicly acknowledged in 2026.
Major HR Software Vendor (Global): A human resources software provider used by over 6,000 enterprise clients confirmed that an attacker accessed a cloud backup repository containing HR data exports including employee PII, compensation data, and in some cases Social Security and national ID numbers. The vendor is notifying affected client organizations; downstream employee notification timelines vary by client. If your HR platform notified you of anything unusual this week, prioritize that ticket.