Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This summer, we launched Identity Security for AI. That post described an upcoming wave of attacks and security challenges unique to Large Language Models (LLMs) and agentic workflows. As the traditional MITRE ATT&CK framework reached its limits, Google DeepMind published TRAIT&R, a taxonomy of rogue AI tactics and routines closely modeled after MITRE ATT&CK.

In most organizations, standing privileges don’t show up all at once. They accumulate quietly. A role is added “temporarily.” A contractor needs broad access to finish a project. A service account gets oversized permissions because no one has time to fine-tune them. None of these choices seem harmful in the moment, but over time they build into a privilege surface that’s far too large to monitor and far too easy to misuse.

At 1Password, we believe strong security should feel like part of the workflow, not an interruption. That is the goal behind our work on user verification (UV) for passkeys.

An AI support agent picks up a customer case, signs in with valid credentials, works on it in only approved systems, and closes it. I would reasonably predict that if someone were to review this workflow, it would likely come back clean, with no policy rule violation. But if we were to take a closer look, we might find that the agent did more than just close the case.

Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity.

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants.

Risk in the agentic enterprise spans people, service accounts, and AI agents. All three act with legitimate credentials, so access controls alone can’t show whether their activity is safe. A behavioral risk framework applies one model to every actor: Verify expected behavior before access goes live, observe activity once it does, analyze behavior for risk and drift, and improve detection coverage over time.

The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. Indeed, the disclosures included an actively exploited flaw that allowed attackers to execute commands on affected gateways without signing in. As with any emergency patch, admins had to weigh cutting off or disrupting their users’ access with the risk of delaying a critical security update.

Your site loads in Chrome fine. Then a deploy script, a webhook, or integration calls the same URL and gets this: Python says certificate verify failed: unable to get local issuer certificate. Node says unable to get local issuer certificate, or unable to verify the first certificate. It’s all the same problem. It’s a misconfiguration between your certificate and a trusted root. Either the server isn’t sending it, or the client doesn’t have it.

Researchers pulled real, leaked API keys out of three LLMs using only API output. Here is how AI agents carry secrets from developer laptops into model context, and how to stop them before the model sees them.