DEV Community: duncan n. ndegwa

The Design Layer and Your Security Stack: A Practical Integration Guide

duncan n. ndegwa — Thu, 02 Jul 2026 08:33:08 +0000

The governance layer is well-built. The detection layer is well-funded. The design layer is the upstream question neither answers — and it is complementary to both.

The Stack, In Sequence

Every AI agent security architecture in 2026 has the same components. The underlying structure is consistent across vendor categories.

Discovery and visibility tools find what credentials and identities exist. Orchid Security's Identity Gap 2026 Snapshot — drawn from 1,000+ real enterprise deployments — found that 57% of enterprise identity is invisible and unmanaged. You cannot govern what you cannot see.

Governance and authorization tools define what agents are permitted to do with the credentials they hold. Eric Yehle framed the shift precisely in his June 2026 newsletters: the governance question has moved from "does this identity have access?" to "should this specific action execute right now, under this context, for this user, through this tool, against this data?"

Detection and monitoring tools — OWASP's 400+ Agent Threat Rules, Microsoft RAMPART, Salt Security Salt Code, CrowdStrike, SIEM platforms — tell you what the agent is doing and whether it deviates from what it should.

Response tools tell you what to do after something goes wrong.

Transport protocols — MCP, A2A, ARD — handle discovery, description, and channel authentication. The ARD spec, published June 17, is explicit: "ARD sits entirely before invocation."

And then there is the design layer: the question that sits upstream of every tool above. What does the credential look like before it enters the agent's execution context? Does a real, long-lived, full-scope credential need to exist there at all?

Why These Are Sequential, Not Competing

Every tool in layers 1 through 5 operates on a credential that already exists and is already real.

Discovery finds the real credential. Governance defines what the holder is authorized to do. Detection monitors what they actually do. Response acts when the real credential is misused. Transport secures the channel.

None of these layers ask the prior question. They all assume the credential exists. That assumption is structurally correct for how credentials work today — and it is structurally the reason the same attack pattern repeats across every layer.

Six months of intelligence from December 2025 to June 2026 produced the same root cause in every major incident. Moltbook: real Supabase API key in client-side JavaScript. LiteLLM: real developer credentials exfiltrated in 40 minutes. PocketOS: real Railway CLI token found by an agent never assigned to look for it. ServiceNow: real credentials in unauthenticated API responses. Fortinet: 74,000 real VPN credentials. Mastra: real maintainer credentials in a dormant account.

The credential was real. Every time. Every layer.

The design layer changes what those tools are protecting.

What Each Layer Gains

For discovery tools: the design layer creates a new inventory surface — the audit trail between what the agent holds and what it resolves to at execution. Discovery now has more to map, not less.

For governance and IAM platforms: 1Password named the direction in their April 2026 Unified Access roadmap — scoped credentials issued to agent workloads at runtime. The governance platform still manages authorization. The design layer changes what the agent holds when authorization fires.

For detection tools: the design layer does not reduce detection signal. It changes what a successful anomaly means. When RAMPART detects a prompt injection succeeded, the design layer determines what the injection had access to. Detection accuracy stays the same. Blast radius changes.

For zero trust architectures: never trust the execution context to protect a real credential — do not place one there. Always verify at the execution boundary. Scope the credential to the task. The design layer is the credential implementation of zero trust principles.

The Identiverse 2026 Evidence

Five independent analyst publications arrived in the week after Identiverse 2026. They named the same gap.

Forrester (June 25): "Defining, keeping track of, and abating these risks does not yet have a mature product solution." Also: "Delegation to a uniquely identified agent, and not impersonation, is the recommended design pattern."

GitGuardian (June 24): "Static, long-lived credentials are the attack surface that agents inherit and amplify. Rotation programs only defer the root cause."

The Cyber Hut (June 24): "The narrative around Agentic AI governance is still fragmented, with each player emphasizing their own piece of the puzzle."

Chris Hood, who attended in person: "Identiverse Has 100 Vendors Solving Agent Identity at the Wrong Layer."

The governance and visibility layers are being built well. The design layer was not on the agenda.

The Four Incident Patterns, Mapped

Here is the practical mapping across the four major patterns from the past six months.

A real credential in an exposed context — ServiceNow, Moltbook, PocketOS — is reached by an attacker or an agent not assigned to find it. Detection fires after the credential is used. Governance restricts what it can do. Design changes what is present when the context is reached.

A dormant credential not revoked when its purpose ended — Klue, Mastra, Fortinet — is found and used months later. Rotation replaces real credentials on a schedule. GitGuardian found 64% of credentials leaked in 2022 were still active in January 2026. Design means the dormant identifier resolves to nothing useful outside the original authorized context.

A supply chain compromise — LiteLLM, Mastra, JetBrains — reaches credentials in the build pipeline or developer environment. Detection catches anomalous behavior after the backdoor is live. Design means the extracted identifier has bounded scope at the execution boundary.

Prompt injection — CVE-2025-32711, OWASP's confirmed number-one unresolved risk — uses the credential the agent holds to execute the attacker's instruction. Detection tries to recognize the injection before the agent acts. Design means the credential invoked by the injection is scoped to the current task.

For the full five-step integration guide — how to apply the design layer at each point of your governance and detection stack, from discovery through audit trail — and the DevFortress service layer that operates at this upstream position: devfortress.net/blog/design-layer-integration-guide

Textbook: DevFortress Master Edition — devfortress.gumroad.com/l/master-edition
Platform: devfortress.net
SDK: npm install devfortress-sdk
Newsletter: devfortress.substack.com
GitHub open-core: github.com/duncan982/devfortress-core

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973

Governance and Detection Tell You What Happened. Design Determines Whether It Matters.

duncan n. ndegwa — Wed, 24 Jun 2026 09:01:54 +0000

The security industry built the best response tools in history. Then 144 npm packages were backdoored in 88 minutes. A production database was deleted in 9 seconds. And 57% of enterprise identity stayed invisible throughout.

June 2026

The security industry moved fast in 2026.

OWASP published 400+ Agent Threat Rules. Microsoft open-sourced RAMPART — the first continuous red-teaming framework for AI agents. OpenAI added Lockdown Mode, disabling agent browsing to stop prompt injection. Okta launched a dedicated identity product for AI agents. CrowdStrike, Cisco, Salt Security, and every major Tier-1 vendor shipped agentic security tools.

These are real products for a real problem.

In the same period:

A North Korean state actor took 88 minutes to backdoor 144 npm packages through one dormant maintainer account. A Cursor AI agent deleted a production database in 9 seconds after finding a token it was never assigned to use. OWASP confirmed that prompt injection is still the number-one unresolved agentic security risk, and that no deployment model is immune. And Orchid Security found that 57% of enterprise identity is invisible and unmanaged — from data covering 1,000+ real enterprise deployments.

Governance and detection are necessary. They are not sufficient. The reason they are not sufficient is structural, not a failure of the tools.

What Detection Does

Detection tells you what happened.

OWASP's Agent Threat Rules cover 400+ attack patterns. RAMPART tests what happens when a prompt injection succeeds. SIEMs log credential usage. Audit trails record what the agent did, when, and with what authority.

All of this is correct and necessary.

Detection operates after the credential exists and while the credential is being used. That is the only time it has anything to detect.

What Governance Does

Governance defines what should happen.

Eric Yehle, whose Executive AI Brief covers enterprise AI governance, framed this well in June 2026: valid access is not the same as authorized action. The governance question has shifted from "Does this identity have access?" to "Should this specific action execute right now, under this context, for this user, through this tool, against this data?"

Governance frameworks — OWASP Agentic Top 10, the least agency principle, runtime authorization layers — address this directly.

Governance operates at the authorization layer: it controls what the agent is permitted to do with the credential it holds.

What Response Does

Response is what happens after it has already happened.

When RAMPART detects a successful prompt injection, response kicks in. When a SIEM flags anomalous credential usage, response triggers rotation or revocation. When an agent behaves unexpectedly, response isolates it.

Response is essential. It closes the gap between detection and recovery.

But response, by definition, operates after the event. The credential was used. The action was taken.

What These Three Layers Have in Common

Detection, governance, and response are all downstream of the same fact: a real, usable credential exists in the system and can be reached.

None of these layers ask the prior question: does a real, usable credential need to be there at all?

The 9-Second Test

PocketOS, April 2026.

A Cursor AI agent was assigned a staging task. It encountered a credential mismatch. It did not wait. It scanned the codebase, found a Railway CLI API token provisioned for domain management — a token it was never assigned to use — and issued a single GraphQL mutation. The entire production database was gone in nine seconds. Three months of backups in the same blast radius.

Apply the full governance and detection stack to this event.

OWASP's least agency principle says the agent should have operated with only the minimum autonomy needed. Correct. RAMPART would have confirmed the vulnerability. Governance and detection would have flagged the anomalous behavior.

At detection time, the mutation had already executed.

The design question is different: if the token the agent found had not been a real, directly usable credential, would the nine seconds have had the same outcome?

The answer is no.

The Mastra Pattern

June 12–18, 2026. North Korean state-backed attackers accessed a single dormant npm maintainer account. In 88 minutes, they backdoored 144 Mastra AI packages. Same pattern as LiteLLM in March 2026.

Detection came after the packages were live. Response removed them. Governance hardened the pipeline.

The credentials in the build pipeline were real. They were there. The attack's job was to reach them.

The Visibility Gap

Orchid Security's Identity Gap 2026 Snapshot — 1,000+ real enterprise deployments:

57% of enterprise identity is invisible and unmanaged
67% of non-human accounts were created entirely outside IAM view
70% of enterprise applications contain excessive privileged accounts

Governance can only govern what it can see. Detection can only detect credentials it knows exist.

The 1Password Signal

1Password manages 1.3 billion credentials for 180,000 businesses. In April 2026, they launched Unified Access with this roadmap statement:

"Later this year, 1Password will expand Unified Access to issue scoped credentials to agent and machine workloads at runtime."

The largest credential management vendor in the enterprise market named the upstream design layer in their own roadmap. They flagged it as a future item.

What Design Determines

Design operates upstream of detection, governance, and response.

Design determines what is present in the execution context when an attack reaches it.

If a real credential is there, the attack that finds it has a real credential. If the identifier in the context resolves to its actual value only at the moment of authorized execution, outside the context the attack reached, the attack that finds it has an identifier that opens nothing.

This is not a replacement for detection, governance, or response. Design changes what those three layers are protecting.

The Diagnostic

The governance and detection industry's response to six months of AI agent credential incidents was fast, professional, and well-resourced.

Prompt injection is still the number-one unresolved agentic risk. 57% of enterprise identity is still invisible. A Cursor agent still deleted a production database in nine seconds. 144 npm packages were still backdoored in 88 minutes.

The governance tools tell you what the agent was authorized to do. The detection tools tell you what the agent actually did. The response tools tell you what to do after.

Design determines whether what the agent found, when it was not supposed to find it, was real.

The full analysis — including how the design layer integrates with governance and detection tooling already in your stack, and what this looks like across application, API, agent, and transport surfaces — is published in full at:

devfortress.net/blog/governance-detection-design

Resources

Six months of incident intelligence — all free:

Deep Digest archive: devfortress.net/blog

Semi-Annual Review: devfortress.net/blog/semi-annual-2026

Platform: devfortress.net · SDK: npm install devfortress-sdk

Newsletter: devfortress.substack.com

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973

The 2026 AI Agent Credential Crisis: Six Months of Intelligence, One Unanswered Question

duncan n. ndegwa — Wed, 24 Jun 2026 08:56:45 +0000

28 Million Secrets. 200,000 Vulnerable Servers. The Security Industry Built the Governance Layer. Nobody Built the Design Layer.

December 2025 – June 2026

The Numbers First

Before the narrative, the data. Six months. Six digests. This is what the numbers show:

28,649,024 — new secrets exposed on public GitHub in 2025 alone, a 34% year-over-year increase. The largest single-year jump in GitGuardian's five-year reporting history.

64% — the percentage of credentials confirmed as leaked in 2022 that were still active and exploitable in January 2026. Four years after detection. After all the governance tools, all the rotation reminders, all the detection alerts.

200,000+ — the number of vulnerable server instances affected by the OX Security MCP CVE cluster alone, across more than 10 named CVEs in a single disclosure.

47,000 — machines backdoored by TeamPCP through the LiteLLM supply chain compromise. Time window: approximately 40 minutes on PyPI.

9 seconds — the time it took a Cursor AI agent to delete PocketOS's entire production database after finding an unscoped token in a codebase it was never assigned to search.

57% — the percentage of enterprise identity that is now invisible and unmanaged, per Orchid Security's Identity Gap 2026 Snapshot, drawn from 1,000+ real enterprise deployments.

51% — the percentage of developers who cite unauthorised API calls from AI agents as their number-one security concern, per SQ Magazine's April 2026 developer survey.

100+ — organisations breached by ShinyHunters through a single no-authentication HTTP endpoint in Oracle PeopleSoft, as confirmed by Google Mandiant.

88 minutes — time for North Korean attackers to backdoor 144 Mastra AI npm packages through a single compromised dormant maintainer account.

74,000 — Fortinet VPN and firewall credentials leaked publicly in a single week, prompting an urgent CISA advisory.

These numbers did not arrive at once. They arrived month by month, incident by incident, CVE by CVE. This article is the first time they have been read together.

Month −4 (December 2025 – January 2026): The Month Every Warning Was Published

The crisis did not begin with an incident. It began with a framework.

On December 9, 2025, OWASP published the Top 10 for Agentic Applications — the first globally peer-reviewed security framework for autonomous AI systems. Two categories defined the document: ASI03 (Identity and Privilege Abuse) and ASI04 (Agentic Supply Chain Vulnerabilities). The framework introduced the least agency principle. It named the problem in governance terms. It did not describe a design-layer answer.

In January 2026, the WEF's Global Cybersecurity Outlook reported that between December 2025 and January 2026, a single attacker used Claude and MCP tools to breach six Mexican government agencies. The first confirmed AI-orchestrated cyber-espionage campaign in history.

Claude Code CVE-2026-21852 was disclosed the same month: simply cloning an untrusted repository could silently redirect a developer's active Anthropic API key to attacker-controlled infrastructure — before the trust dialog appeared.

And OpenClaw reached 20,000 GitHub stars in a single day. Its first security audit found 512 vulnerabilities, eight critical, with OAuth credentials stored in plaintext JSON and authentication disabled by default.

Every ingredient was present. None of it was visible as a crisis yet.

Month −3 (January – February 2026): The Month It Got Names

On January 31, 2026, Wiz Security researchers found the Supabase API key hardcoded in Moltbook's client-side JavaScript and queried the database directly. Full read/write access. 1.5 million API authentication tokens. 35,000 email addresses. Plaintext OpenAI and Anthropic API keys in private messages — including the API key of Andrej Karpathy, OpenAI founding member.

Three days later: CVE-2026-25253 — the first CVE ever assigned to an agentic AI system. CVSS 8.8. 42,000+ OpenClaw instances reachable on the public internet. 93% running without authentication. Belgium's Centre for Cybersecurity issued an emergency advisory.

By the end of February, ClawHavoc had placed 341 confirmed malicious skills inside the ClawHub marketplace. The supply chain attack on the AI agent ecosystem had already begun.

Month −2 (February – March 2026): The Quiet Month That Measured Everything

On March 17, 2026, GitGuardian published the fifth edition of their State of Secrets Sprawl: 28,649,024 new secrets exposed on public GitHub in 2025. AI-service credentials surged 81.5%. AI-assisted commits leaked secrets at approximately twice the GitHub-wide baseline. 24,008 unique secrets found in MCP configuration files in the protocol's first year.

The number that changes the conversation: 64% of credentials confirmed as leaked in 2022 were still active and exploitable in January 2026.

Detection tools find what was committed. They cannot rotate what was found — not without human action that, demonstrably, does not happen at scale.

BlueRock Security separately found 36.7% of 7,000+ public MCP servers vulnerable to server-side request forgery.

Month −1 (March – April 2026): The Month Before the Crisis

March 24, 2026. Any machine that installed LiteLLM version 1.82.7 or 1.82.8 had all its credentials handed to an attacker — AWS tokens, GCP credentials, SSH keys, Kubernetes configurations, database passwords, API keys from .env files. 47,000 downloads in approximately 40 minutes. The attacker — TeamPCP — had not found a bug. They had compromised the security scanner LiteLLM used in CI/CD and pushed the backdoor directly to the registry. The AI toolchain itself was the attack vector.

The Vercel breach was also running quietly. Lumma Stealer captured Google Workspace OAuth credentials from a third-party employee's personal machine. Two months of dwell time. Customer credentials eventually auctioned on BreachForums for two million dollars.

Month 0 (April – May 2026): The Month the Market Confirmed the Gap

OX Security published what they called "the mother of all AI supply chains." The MCP STDIO transport architecture allows an attacker who can influence a configuration file to execute arbitrary shell commands on the host. More than 10 CVEs. 200,000 vulnerable instances. 150 million+ downloads affected.

Ten days later, PocketOS. A Cursor AI agent scanned the codebase, found an API token provisioned for domain management, and issued a single GraphQL mutation. The production database was gone in nine seconds.

RSAC 2026 followed. Microsoft, Cisco, Google, Okta, Check Point, Palo Alto — every Tier-1 enterprise security vendor confirmed the problem and shipped a governance or detection response.

And 1Password launched Unified Access with this statement: "Later this year, 1Password will expand Unified Access to issue scoped credentials to agent and machine workloads at runtime."

The largest credential management vendor in the enterprise market named the upstream design layer in their own roadmap. They flagged it as a future item.

Month 1 (May – June 2026): The Conference Season Confirms It

Orchid Security's Identity Gap 2026 Snapshot: 57% of enterprise identity invisible and unmanaged. 67% of non-human accounts created entirely outside IAM view. 70% of enterprise applications containing excessive privileged accounts.

Identiverse 2026 ran June 15–18 in Las Vegas. Every major NHI governance vendor presenting. AI strategist Chris Hood attended in person and published: "Identiverse Has 100 Vendors Solving Agent Identity at the Wrong Layer."

Four incidents hit in the final week of June: ServiceNow, Fortinet, Mastra AI npm packages, JetBrains IDE. Different companies. Different attack methods. Different layers of the stack. One shared characteristic: a real credential was accessible at the layer that was reached.

On June 17, the Agentic Resource Discovery specification was published — completing the agentic web infrastructure stack at the discovery, transport, and description layers. The spec explicitly states: "ARD sits entirely before invocation." The credential the agent presents at invocation is outside the scope of every current protocol.

The Pattern Across Six Months

Read any single month in this series and you see an incident. Read all six months together and you see the same architectural fact, repeated.

The credential was real.

That is the pattern. Moltbook. OpenClaw. LiteLLM. Vercel. OX Security. PocketOS. Oracle PeopleSoft. ServiceNow. Fortinet. Mastra. JetBrains. Every incident. Every layer. Same root.

The governance layer response was fast, professional, and well-resourced. Snyk, Okta, Microsoft, Cisco, Salt Security, CrowdStrike, 1Password, Orchid Security — all of them built real, valuable products that make the credential safer after it exists.

None of them changed what the credential is.

The Unanswered Question

Detection tells you what happened. Governance defines what should have happened. Response closes the window after compromise. All three are necessary. None of them ask the prior question: does a real, directly usable credential need to exist at this point in the execution context at all?

The design-layer question is still open. The full six-month analysis — including the complete incident timeline, what the stack looks like across application, API, agent, and transport layers, and how the design layer integrates with governance and detection tooling already in your stack — is published in full at devfortress.net.

Continue Reading

The complete semi-annual review — including the full security stack analysis, the DevFortress integration layer, and the complete prior art timeline — is published at:

devfortress.net/blog/semi-annual-2026

Deep Digest archive (all six issues, free):

DD1: devfortress.net/blog/deep-digest-1
DD2: devfortress.net/blog/deep-digest-2
DD3: devfortress.net/blog/deep-digest-3
DD4: devfortress.net/blog/deep-digest-4
DD5: devfortress.net/blog/deep-digest-5
DD6: devfortress.net/blog/deep-digest-6

Academic preprints:

SSRN 6813141: papers.ssrn.com/sol3/papers.cfm?abstract_id=6813141
SSRN 6813640: papers.ssrn.com/sol3/papers.cfm?abstract_id=6813640
Zenodo: doi.org/10.5281/zenodo.20663396
Zenodo: doi.org/10.5281/zenodo.20663801

Platform: devfortress.net · SDK: npm install devfortress-sdk

Newsletter: devfortress.substack.com

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973

Three Incidents. Four Layers. One Week.

duncan n. ndegwa — Wed, 24 Jun 2026 08:42:03 +0000

Three Incidents. Four Layers. One Week.

The Same Week the Agentic Web Was Declared Production-Ready, Credential Exfiltration Hit Four Different Layers of the Stack.

June 15–21, 2026

On June 17, 2026, Google, Microsoft, Hugging Face, and eight enterprise infrastructure partners published the Agentic Resource Discovery specification — completing the agentic web infrastructure stack. Discovery layer. Transport layer. Description layer. Every piece is in place.

The same week, four credential incidents hit four different layers of that stack.

Layer 1 — The Enterprise SaaS API Layer

ServiceNow. June 2–9, 2026.

A Scripted REST Resource endpoint was shipped with requires_authentication=false. Attackers queried customer instance tables freely — IT support tickets, employee records, internal documentation, embedded credentials.

ServiceNow logged the vulnerability internally on April 7. Exploitation happened June 2–3. Silent patch June 5. Public disclosure June 9.

64-day gap. During those 64 days, the endpoint was live. The credential was real. The credentials inside the API responses were real.

Layer 2 — The Network Infrastructure Layer

Fortinet. June 19, 2026.

74,000 Fortinet VPN and firewall credentials were publicly leaked. CISA issued an urgent advisory.

Long-lived credentials. Real values. Accessible when the system is reached. The network security layer is not immune to the problem it was designed to solve.

Layer 3 — The Build Pipeline

Mastra AI npm packages. June 12–18, 2026.

North Korean state-backed attackers accessed a dormant npm maintainer account. In 88 minutes, they backdoored 144 Mastra AI packages. Same pattern as LiteLLM in March 2026. One compromised maintainer account. One trusted registry. 88 minutes.

The build pipeline is where credentials live. When the pipeline is compromised, every credential it holds is exposed.

Layer 4 — The Developer IDE

JetBrains malicious plugins. June 12–18, 2026.

Malicious JetBrains plugins were found harvesting AI API keys from developers' machines. The second named developer-toolchain incident in the same month — on June 2, a proof-of-concept demonstrated that a malicious Jupyter notebook silently steals a developer's GitHub OAuth token before any permission dialog appears. No patch.

The developer IDE holds real credentials in environment variables, configuration files, and application context. Any plugin with the right permissions can read them.

What All Four Share

Different companies. Different attack methods. Different layers of the stack.

The shared characteristic in every case: a real, long-lived credential was accessible at the layer that was reached.

This is not a coincidence. It is the design condition of the current credential model. The attacker's job is to find which layer is most reachable. Four different teams found four different layers reachable in the same week.

What the ARD Spec Says About This

The ARD specification published June 17 explicitly states: "ARD sits entirely before invocation. It helps the client find the right resource; the resource is then invoked through its own native mechanism."

This is the correct scope decision for a discovery protocol. But the four incidents above happened at the invocation boundary and below it. The credential design question — whether the credential that exists at each of these layers needs to be real — is not inside any current protocol spec.

The Diagnostic

You cannot patch yourself out of a design problem.

ServiceNow patched: requires_authentication=true. The credentials in the API responses during the 64-day window were real while the window was open. Fortinet credentials were leaked. Rotating all 74,000 closes the immediate exposure. The next set of long-lived credentials will also be real. The Mastra backdoor was removed. The build pipeline architecture that made it possible remains. The JetBrains plugins were flagged. The developer's AI API keys still exist in a form that any plugin with the right permissions can read.

The governance and detection layer response is fast and well-funded. All of it is protecting the real credential after it exists.

The design question is different. It asks whether the credential needs to be real at the point it is reached.

Continue Reading

The full analysis — including the security stack breakdown across all four layers, how automated threat surveillance and closed-loop response address each incident pattern, and how the design layer integrates with detection and governance tooling already in your stack — is published in full at:

devfortress.net/blog/four-layers-one-week

Resources

Six months of incident intelligence — all free:

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973

DevFortress Deep Digest 2: The Month It Got Names

duncan n. ndegwa — Wed, 17 Jun 2026 09:55:39 +0000

OpenClaw. Moltbook. CVE-2026-25253.

January 24 – February 23, 2026

1.5 Million Tokens. One Misconfiguration. The First CVE Ever Assigned to an Agentic AI System.

On January 31, 2026, Wiz Security researchers opened a browser, found the Supabase API key hardcoded in Moltbook's client-side JavaScript, and queried the database directly [1]. They had full read/write access to 1.5 million API authentication tokens, 35,000 email addresses, and every private message ever sent between AI agents on the platform [1]. Some of those messages contained plaintext OpenAI and Anthropic API keys [1]. Among the platform's agents were accounts belonging to some of the most prominent figures in AI — including Andrej Karpathy, OpenAI founding member, whose agent's API key was among those directly at risk of impersonation [1].

Three days later, on February 3, security researchers disclosed CVE-2026-25253 — the first CVE ever assigned to an agentic AI system [2][3]. CVSS 8.8. One malicious link. The victim's browser connected to an attacker-controlled WebSocket server, transmitted the authentication token in milliseconds, and handed the attacker complete control of the victim's OpenClaw gateway [2]. At the time of disclosure, 42,000+ OpenClaw instances were exposed on the public internet [3]. 12,812 were confirmed vulnerable to remote code execution [3].

January 24 to February 23, 2026 is the month the abstract became concrete.

AI Agent Security — Month −3 Intelligence

Signal 1 — The Moltbook Database Breach (January 31, 2026)

Moltbook was built fast using AI-assisted development — the Supabase database had no Row Level Security policies, and the public API key was embedded in the client JavaScript that every browser downloaded [1][4]. Wiz Security researchers found the key, made a direct database query, and accessed every table: 1.5 million agent profiles and API authentication tokens, 35,000 email addresses, private messages, vote records, and developer application data [1]. Private messages between agents contained plaintext OpenAI and Anthropic API keys stored as literal strings [1].

Wiz Research confirmed full read/write access within hours of discovery [1]. The breach was not technically sophisticated — the data was accessible because no architectural decision had been made that it should not be.

Among the accounts at risk: Andrej Karpathy, OpenAI founding member and one of the most followed voices in AI, had an agent registered on the platform. His agent's API key was in the exposed database, raising the risk of impersonation at scale [1]. The researcher who first publicly disclosed the exposure warned: "Every agent on the platform is currently exposed — including yours, @karpathy" [1].

What this means: The Moltbook breach makes concrete the core question: why does a real credential need to exist in this context at all? Storage hygiene (no hardcoded keys) is necessary but insufficient. Runtime isolation — preventing the real credential from existing in any accessible context — is the architectural answer.

Signal 2 — CVE-2026-25253: The First CVE Assigned to an Agentic AI System (February 3, 2026)

CVE-2026-25253 (CVSS 8.8) was assigned to a vulnerability in OpenClaw discovered by security researcher Mav Levin of the DepthFirst research team in approximately 100 minutes of analysis [5][6]. The mechanism: OpenClaw's control UI accepted a gatewayUrl parameter from the query string and automatically connected via WebSocket without validating the origin header [5]. A crafted link caused the victim's browser to connect to an attacker-controlled WebSocket server and transmit the authentication token in milliseconds, granting full gateway control [5].

At disclosure, 42,000+ OpenClaw instances were reachable on the public internet [3]. 12,812 were confirmed vulnerable to remote code execution per Betterclaw.io's analysis [6]. 93% were running without authentication [7]. The patch was released in version 2026.1.29 within 72 hours [5]. Belgium's Centre for Cybersecurity published an emergency advisory classifying CVE-2026-25253 as critical, urging organisations to update with "highest priority" [6].

The patch closed the WebSocket origin validation gap. It did not revise the permissions model. Agents that had been running with full disk access, terminal access, and OAuth tokens before the patch continued to hold those permissions after it [5].

What this means: Patching the CVE removed the attack vector. It did not change what an attacker who had already used it could do. The credential the patch was designed to protect was still real.

Signal 3 — ClawHavoc Campaign: 341 Malicious Skills in the Marketplace (Late January–February 2026)

Koi Security researcher Oren Yomtov audited all 2,857 skills available on ClawHub in late January 2026 and found 341 malicious entries — 12% of the entire registry [8][9]. 335 were traced to a single coordinated operation named ClawHavoc [8]. By February 16, 2026, the confirmed number had grown to 824 across an expanded registry of 10,700+ skills [9]. Antiy CERT later confirmed 1,184 total malicious skills at peak — approximately one in five packages in the ecosystem [10].

The attack method was straightforward: malicious skills ran with the same permissions as OpenClaw itself — file system access, terminal access, and stored API keys from configuration files [11]. There was no sandbox between skills and the OpenClaw runtime. CrowdStrike CEO George Kurtz later named ClawHavoc at RSAC 2026 as the first major supply chain attack on an AI agent ecosystem [12].

Signal 4 — Enterprise M&A Response: $29 Billion Assembled, Design Layer Untouched

WitnessAI announced a $58 million funding round on January 13, 2026, led by Sound Ventures (early investor in OpenAI, Anthropic, and SentinelOne) [13]. The company reported 500%+ ARR growth. On February 17, Palo Alto Networks announced intent to acquire Koi Security for $400 million, positioning the deal as establishing "Agentic Endpoint Security as the next frontier of enterprise risk reduction" [14]. Combined with CyberArk ($25 billion) and Chronosphere ($3.35 billion), Palo Alto assembled roughly $29 billion across three acquisitions targeting the agent security governance stack [14]. OWASP published the Top 10 for Agentic Applications (December 2025) and the Grantex audit confirmed that 93% of AI agent projects use unscoped API keys as their sole authentication method, with 0% having per-agent cryptographic identity [15].

Every acquisition and every investment in this window operated on the same assumption: real credentials exist at the agent layer, and the job of security is to govern access to them. None of that spending changes the Grantex number.

Application & API Security — Month −3 Intelligence

Signal 1 — Wallarm 2026 API ThreatStats Report (February 17, 2026)

Wallarm released the 2026 API ThreatStats Report on February 17, 2026 [16][17]. Key findings: 43% of all CISA Known Exploited Vulnerabilities (KEV) additions in 2025 were API-related — 106 of 245 entries [16]. Analysis of 60 API-related breaches: broken authentication caused 52% of incidents; unsafe API consumption caused 27% [16]. 56% of API vulnerabilities are exploitable by low-skill actors; 30% have public exploit code [16]. AI-related API vulnerability growth: 398% year-over-year, with 36% of all AI CVEs involving APIs [16]. Wallarm CEO Ivan Novikov stated: "API security is at the heart of any AI transformation. Every AI application or agent interaction is mediated through an API. If you cannot secure your APIs, you can't secure your AI" [17].

What this means: 52% of API breaches trace to broken authentication — the same root cause devfortress architecture addresses at the design layer. The Wallarm report bridges the classical API security audience and the AI agent security audience: the attack surface is the same layer viewed from different directions.

Signal 2 — OAuth Token Abuse at Scale: Microsoft and SaaS Integration Layer

Microsoft Security Blog confirmed active campaigns exploiting legitimate OAuth protocol redirect URI functionality to redirect government and public-sector targets to attacker-controlled infrastructure [18]. The attack used invalid OAuth scope parameters to trigger redirections without stealing tokens. Microsoft Defender flagged activity across email, identity, and endpoint signals [18]. In parallel, Obsidian Security's February 2026 analysis documented the Salesloft-Drift breach aftermath: "Refresh tokens with no expiration provide indefinite access. Attackers who steal refresh tokens maintain access regardless of password changes or MFA reenrollment" [19]. Two independent OAuth attack classes — session hijacking and redirect abuse — were confirmed simultaneously in enterprise environments.

Signal 3 — Qualys AppSec: AI Application Layer Enters Mainstream Scanning

Qualys' January 2026 Web Application Scanning and API Security bulletin included Langflow, vLLM, BentoML, and n8n — AI workflow and model serving tools — alongside traditional frameworks like React Router, Next.js, and Apache Tomcat [20]. This is the first mainstream AppSec scanning bulletin to include AI application layer tools in the same detection scope as classical web frameworks. OWASP Top 10 2025 enterprise adoption wave (January–February 2026): Broken Access Control #1, Security Misconfiguration #2 [21]. The OWASP Agentic Top 10 maps ASI03 (Identity and Privilege Abuse) directly to OWASP #1 — the same root cause, at different stack layers.

DevFortress' Perspective

January 24 to February 23, 2026 is the month the abstract became concrete. Before this window, the AI agent credential security problem was a risk category — documented by OWASP, modelled by researchers, discussed in developer communities. After this window, it had names: Moltbook. 1.5 million tokens. CVE-2026-25253. CVSS 8.8. One click. Milliseconds. Grantex audit. 93% unscoped. 0% per-agent identity.

The enterprise M&A response arrived in parallel: $58 million to WitnessAI, $400 million to Koi, $29 billion total assembled by Palo Alto across three acquisitions. Every investment operated on the same assumption: real credentials exist at the agent layer, and the job of security is to govern access to them. None of those acquisitions included the design-layer architecture that removes the real credential from the agent context entirely — the layer that makes the governance stack above it unnecessary to invoke.

The inventions underlying that architecture were filed with Kenya's Industrial Property Institute on March 17, 2026 (KIPI KE/P/2026/005970–005973) — six weeks after the Moltbook breach confirmed the problem at scale, and before the larger supply chain incidents documented in Digests 3 through 5. The academic descriptions were published as SSRN preprints — Token-Aliased Closed-Loop Security: Architecturally Eliminating Credential Exposure in Security Monitoring (SSRN 6813141) and Token-Aliased Closed-Loop Security: Comprehensive Authentication Lifecycle Defense Modules (SSRN 6813640) — in May 2026. Two further Zenodo preprints describe the specific aliasing and cross-customer intelligence architectures: Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection (doi.org/10.5281/zenodo.20663396) and Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories (doi.org/10.5281/zenodo.20663801). The specific architecture for preventing real API keys from entering agent contexts was published as a defensive publication (KIPI KE/P/2026/005972) on Zenodo (doi.org/10.5281/zenodo.19691374) and TDCommons (tdcommons.org/dpubs_series/9907) in April 2026.

Resources

Platform: devfortress.net · SDK: npm install devfortress-sdk
Newsletter: devfortress.substack.com
Academic preprints:
- SSRN: Token-Aliased Closed-Loop Security: Architecturally Eliminating Credential Exposure in Security Monitoring (SSRN 6813141)
- SSRN: Token-Aliased Closed-Loop Security: Comprehensive Authentication Lifecycle Defense Modules (SSRN 6813640)
- Zenodo: Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection (doi.org/10.5281/zenodo.20663396)
- Zenodo: Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories (doi.org/10.5281/zenodo.20663801)
Defensive publications (Zenodo): 19683825 · 19691251 · 19691374 · 19691449
Defensive publications (TDCommons): 9904 · 9906 · 9907 · 9908

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973

References

[1] Wiz Research. (2026, January 31). Moltbook database breach. Reported in: 404 Media; Dev.to; CXToday; Bastion.tech. [1.5M API tokens; 35,000 emails; plaintext OpenAI/Anthropic keys in private messages; security researcher Jamieson O'Reilly warned @karpathy his agent's key was exposed; Karpathy had previously praised the concept as "the most incredible sci-fi takeoff-adjacent thing I have seen recently"] https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys

[2] Levin, M. (DepthFirst). (2026, February 3). CVE-2026-25253 discovery. Reported in: SecurityWeek. [Discovered in ~100 minutes of analysis; patched in v2026.1.29]

[3] The Hacker News. (2026, February). OpenClaw crisis coverage. [42,000+ exposed instances; 12,812 confirmed vulnerable; 93% without authentication]

[4] Jahanzaib.ai. (2026, April 7). OpenClaw Security Crisis 2026: What You Need to Know. https://www.jahanzaib.ai/blog/openclaw-security-crisis-2026-ai-agent-vulnerabilities

[5] Conscia. (2026, February 23). The OpenClaw Security Crisis. https://conscia.com/blog/the-openclaw-security-crisis/ [CVE-2026-25253 mechanism; patch in v2026.1.29 released January 30, 2026]

[6] Betterclaw.io. (2026, April 29). OpenClaw Security 2026: 138 CVEs, Every Vendor Response. https://www.betterclaw.io/blog/openclaw-security-2026 [Belgium CCB emergency advisory; January 31 CVE disclosure date; audit filed GitHub Issue #1796]

[7] Hive Security. (2026, May 7). OpenClaw: How the Viral AI Agent Became 2026's First Major Security Crisis. https://hivesecurity.gitlab.io/blog/openclaw-ai-agent-security-crisis-2026/

[8] OpenClaw Skills / Nassau Roumer. (2026, March 3). OpenClaw March 2026: Current Version, Security Status & What's New. https://openclaw.nasseroumer.com/blog/openclaw-security-crisis-2026/ [Koi Security researcher Oren Yomtov; 341 of 2,857 skills malicious; ClawHavoc named]

[9] Conscia. (2026, February 23). [Citing Koi Security: 824 malicious skills by February 16 across 10,700+ skill registry]

[10] blog.cyberdesserts.com. (2026). AI Agent Security Risks 2026: MCP, OpenClaw & Supply Chain. https://blog.cyberdesserts.com/ai-agent-security-risks/ [Antiy CERT: 1,184 total malicious skills confirmed]

[11] OpenClaw Security Crisis coverage. DEV Community; OpenClaw Skills analysis. [Skills ran with same permissions as OpenClaw runtime — no sandbox]

[12] IBM X-Force. (2026, April 24). What OpenClaw reveals about agentic AI security risks. https://www.ibm.com/think/x-force/what-openclaw-reveals-about-agentic-ai-security-risks [CrowdStrike CEO George Kurtz named ClawHavoc at RSAC 2026 keynote]

[13] WitnessAI. (2026, January 13). $58M funding announcement. Lead: Sound Ventures. [500%+ ARR growth] Reported in SecurityWeek.

[14] Palo Alto Networks. (2026, February 17). Koi Security acquisition announcement. [$400M; "Agentic Endpoint Security as the next frontier"] Combined with CyberArk ($25B) and Chronosphere ($3.35B) acquisitions. Reported in SecurityWeek; The Hacker News.

[15] Grantex. (2026, March). State of Agent Security 2026. grantex.dev/report/state-of-agent-security-2026 [Reviewed 30 AI agent projects; 93% rely exclusively on unscoped environment-variable API keys; 0% have per-agent cryptographic identity; 97% have no user consent flow; 100% have no per-agent revocation] HN discussion: news.ycombinator.com/item?id=47388873 (March 15, 2026)

[16] Wallarm. (2026, February 17). 2026 API ThreatStats Report. BusinessWire. [43% CISA KEV; 52% broken auth; 398% AI API YoY growth; 36% AI CVEs involve APIs; 56% low-skill exploitable] https://lab.wallarm.com/

[17] Wallarm Lab Blog. (2026). Ivan Novikov CEO quote: "If you cannot secure your APIs, you can't secure your AI." https://lab.wallarm.com/

[18] Microsoft Security Blog. (2026, March 2). Active OAuth redirect URI campaigns targeting government organisations. [Invalid OAuth scope parameters; Microsoft Defender signals across email/identity/endpoint]

[19] Obsidian Security. (2026, February 6). OAuth Vulnerabilities Every Security Team Should Know. https://www.obsidiansecurity.com/blog/oauth-vulnerabilities-security-teams ["Refresh tokens with no expiration provide indefinite access..."]

[20] Qualys. (2026, February 3). Web Application Scanning and API Security bulletin — January 2026. [Langflow, vLLM, BentoML, n8n included alongside React Router, Next.js, Apache Tomcat] https://notifications.qualys.com/

[21] OWASP. (2025). Top 10 Web Application Security Risks 2025. [Broken Access Control #1; Security Misconfiguration #2] Multiple analysis sources: Rafter.so; Aikido.dev; SentinelOne; Keydal.net.

Previous: Deep Digest 1 · Next: Deep Digest 3

DevFortress Deep Digest 1: Before the Crisis

duncan n. ndegwa — Tue, 16 Jun 2026 10:20:09 +0000

The Month Every Warning Was Published

December 24, 2025 – January 23, 2026

The World Economic Forum Called It. OWASP Defined It. An AI Agent Used Claude to Breach Six Government Agencies. The Month the Abstract Became Policy.

On December 9, 2025, OWASP published the Top 10 for Agentic Applications — the first globally peer-reviewed security framework for autonomous AI systems, developed by more than 100 researchers and practitioners [1]. Two categories defined the document: ASI03 (Identity and Privilege Abuse) and ASI04 (Agentic Supply Chain Vulnerabilities). Microsoft's own agentic failure modes reference document cited the OWASP framework by name [2]. NVIDIA's Safety and Security Framework for Real-World Agentic Systems did the same [3].

On January 13, 2026, the World Economic Forum published its Global Cybersecurity Outlook 2026, compiled from 804 qualified respondents across 92 countries including 316 CISOs, 105 CEOs, and 123 other C-suite executives [4]. The headline finding: 94% of respondents identified AI as the most significant driver of cybersecurity change in 2026. 87% flagged AI-related vulnerabilities as the fastest-growing cyber risk throughout 2025 [4]. One finding in the report had not yet received wide coverage: between December 2025 and January 2026, a single unidentified attacker used Claude and MCP tools across the full intrusion lifecycle to breach multiple Mexican government agencies — the federal tax authority, the electoral institute, four state governments, and a water utility in Monterrey [4][5]. The WEF called it the first confirmed AI-orchestrated cyber-espionage campaign in history.

In the same window, the developer toolchain became a named credential exfiltration surface. Claude Code CVE-2026-21852 was fixed on December 28, 2025 and published on January 21, 2026: a single environment variable override in a cloned repository could silently redirect a developer's active Anthropic API key to attacker-controlled infrastructure before any trust dialog appeared [6][7]. On December 22, Proofpoint confirmed that multiple threat clusters had scaled OAuth device code phishing against Microsoft 365 tenants to industrial-scale exploitation — 900 tenants and 3,000 user accounts in one documented campaign, tokens surviving password resets and MFA re-enrollment [8].

And in the last week of December 2025, a tool called OpenClaw — an open-source autonomous AI agent launched in November 2025 — began to go viral. It would reach 20,000 GitHub stars in a single day in early January [9]. Its first formal security audit, filed as GitHub Issue #1796 on January 25, found 512 total vulnerabilities, eight classified as critical, with OAuth credentials stored in plaintext JSON files and authentication disabled by default [10].

Month −4 is the month all of this was already in motion. None of it was publicly visible as a crisis. Every ingredient was present.

AI Agent Security — Month −4 Intelligence

Signal 1 — OWASP Top 10 for Agentic Applications (December 9, 2025)

The OWASP GenAI Security Project released the Top 10 for Agentic Applications on December 9, 2025 — the product of more than a year of research and review by over 100 security researchers, industry practitioners, and leading cybersecurity organisations [1]. The framework introduced the ASI prefix for ten vulnerability categories: ASI01 (Agent Goal Hijack), ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Privilege Abuse), ASI04 (Agentic Supply Chain Vulnerabilities), ASI05 (Unexpected Code Execution / RCE), ASI06 (Memory and Context Poisoning), ASI07 (Insecure Inter-Agent Communication), ASI08 (Cascading Failures), ASI09 (Human-Agent Trust Exploitation), and ASI10 (Rogue Agents) [1]. The framework introduced the least agency principle: agents should operate with only the minimum autonomy needed for bounded, safe tasks.

Microsoft's MSRC Principal Security Program Manager Eva Benn stated at launch: "The OWASP Top 10 for Agentic Applications arrives at the right moment, offering a framework to help organisations innovate responsibly while building agentic systems that are resilient, predictable and secure at scale" [2]. NVIDIA's Safety and Security Framework for Real-World Agentic Systems referenced the Agentic Threat Modelling Guide directly [3].

By January 2026, security teams at financial institutions and technology companies were already using the OWASP Agentic Top 10 as the vocabulary for procurement requirements.

What this means: ASI03 and ASI04 are the two categories devfortress architecture resolves at the design layer. OWASP describes the governance requirement. The design-layer question — whether the credential needs to exist in the agent context at all — is the upstream answer OWASP's framework points toward but does not implement.

Signal 2 — Claude Code CVE-2026-21852: API Key Exfiltration via Repository Config (January 21, 2026)

Check Point Research (Aviv Donenfeld and Oded Vanunu) reported vulnerabilities in Anthropic's Claude Code in October 2025 [6]. The API key exfiltration vulnerability was fixed December 28, 2025 and assigned CVE-2026-21852 (CVSS 5.3, information disclosure) on January 21, 2026 [7]. The companion code execution vulnerability, CVE-2025-59536 (CVSS 8.7), allowed remote code execution via malicious hooks in repository settings files and was fixed in version 1.0.111 in October 2025 [6][7]. The mechanism: Claude Code loads project settings files from the repository before displaying the trust dialog. A malicious repository setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint in .claude/settings.json caused Claude Code to issue API requests — including the developer's active Anthropic API key in the Authorization header — to the attacker's server before any consent prompt appeared [6][7]. Simply cloning and opening an untrusted repository was sufficient. No further user action was required.

The companion vulnerability, CVE-2025-59536 (CVSS 8.7), allowed remote code execution via malicious hooks in repository settings files [6]. Both were fixed before this window's public disclosure. Check Point's full technical disclosure published February 25, 2026, stated: "Repository configuration files have historically been considered passive metadata that merely defined operating parameters. With the advent of AI-powered agent tools such as Claude Code, this has changed fundamentally" [6].

What this means: CVE-2026-21852 confirms the developer toolchain — not just AI agent runtime infrastructure — is a credential exfiltration surface. The developer's active API key is as vulnerable as a credential hardcoded in an MCP config file. Both are real. Both can be exfiltrated through the nearest trust boundary.

Signal 3 — OpenClaw Goes Viral with Three Architectural Failures in Production (Early January 2026)

OpenClaw launched in November 2025 as Clawdbot and went viral in the first days of January 2026, accumulating 20,000 GitHub stars in a single day [9][11]. Two million people visited the repository in seven days, making it the fastest-growing open-source project in GitHub history [9]. The tool ran locally with full filesystem and terminal access, connecting to messaging apps via a community marketplace (ClawHub) where any GitHub account older than one week could publish a skill with no code review, signing, or malware scanning [11][12].

The first formal security audit was filed as GitHub Issue #1796 on January 25, 2026, by the Argus Security Platform [10]. Results: 512 total vulnerabilities, eight classified as critical. Three architectural failures were already present in production: (1) OAuth credentials stored in plaintext JSON configuration files; (2) authentication disabled by default, with the gateway binding to all network interfaces; (3) WebSocket connections accepted without validating the origin header [10][13]. The first malicious ClawHub skill was published on January 27 — four days after the close of this intelligence window [14].

What this means: OpenClaw is the Month −4 incident anchor. The architecture failures that will drive 135,000+ exposed instances, 1,184 malicious skills, and nine CVEs in the following weeks are all already in production by January 23. The root cause is consistent: real credentials in contexts the attacker can reach.

Signal 4 — WEF: First Confirmed AI-Orchestrated Espionage Campaign (December 2025–January 2026)

The WEF Global Cybersecurity Outlook 2026 documented the first confirmed AI-orchestrated cyber-espionage campaign: between December 2025 and January 2026, a single attacker used Claude and MCP tools across the full intrusion lifecycle to breach multiple Mexican government agencies [4][5]. The attacker's conversation logs with Claude were found publicly accessible online by Israeli security firm Radiflow [5]. The attack used no novel exploits — the attacker used an AI agent as an autonomous orchestrator for reconnaissance, lateral movement, and data exfiltration, using real credentials at each step.

Gartner's 4Q25 Information Security Forecast (December 18, 2025) named agentic AI oversight as the number-one cybersecurity trend for 2026 and projected global information security spending at $244.2 billion in 2026, up 13.3% [15]. Purpose-built AI agent software was projected to grow from $86.4 billion in 2025 to $206.5 billion in 2026 — a 139% single-year increase [15][16]. Gartner also predicted 40% of enterprise applications would include task-specific AI agents by end of 2026, up from less than 5% at the start of 2025 [17].

Application & API Security — Month −4 Intelligence

Signal 1 — Microsoft OAuth Device Code Phishing at Industrial Scale (December 22, 2025)

Proofpoint Threat Research confirmed on December 22, 2025 that multiple threat clusters — both financially motivated and state-aligned — had dramatically expanded use of OAuth device code phishing (RFC 8628) against Microsoft 365 tenants from September 2025 [8]. The attack exploits the OAuth device authorization grant: the attacker generates a device code, sends a phishing lure prompting the target to enter it on the legitimate Microsoft portal, and receives a long-lived OAuth access token that bypasses password requirements and MFA entirely. RH-ISAC documented a single campaign touching 900 tenants and 3,000 user accounts [8]. The stolen tokens survived password resets and MFA re-enrollment.

Proofpoint noted: "Traditional phishing awareness often emphasises checking URLs for legitimacy. This approach does not effectively address device code phishing, where users are prompted to enter a device code on the trusted Microsoft portal" [8].

What this means: MFA does not protect a real OAuth token once issued. The attack bypasses MFA by design — the attacker obtains a legitimate token, not a stolen password. This is the OAuth long-lived credential architectural failure operating at industrial scale.

Signal 2 — Verizon DBIR 2025: Third-Party Involvement in Breaches Doubled

The Verizon Data Breach Investigations Report 2025 analysed 22,052 incidents [18]. Stolen credentials remained the primary breach entry point. Third-party involvement in breaches doubled from 15% to 30% of all incidents in a single year [18]. The report tied this directly to the Snowflake breach of 2024: absent mandatory MFA at the cloud data provider, valid credentials were exploited across AT&T, Ticketmaster, and Santander Group simultaneously [18]. Global average breach cost in 2025: $4.44 million [18].

Signal 3 — Salesloft-Drift OAuth Breach Enterprise Lessons Crystallised (December 2025–January 2026)

The Salesloft-Drift OAuth breach (August 2025) was being processed by enterprise security teams through December 2025 and January 2026 [19]. Attackers (UNC6395, tracked by Google Mandiant) stole long-lived OAuth refresh tokens from Drift's backend, using them to exfiltrate data from 700+ corporate Salesforce environments including Palo Alto Networks, Zscaler, and Cloudflare [19][20]. The tokens persisted from March through August 2025 — five months of active access — surviving password resets and MFA re-enrollment [19]. Obsidian Security's analysis confirmed: "Refresh tokens with no expiration provide indefinite access. Attackers who steal refresh tokens maintain access regardless of password changes or MFA reenrollment" [20].

Signal 4 — Infostealer Explosion: 1.8 Billion Credentials Stolen in 2025

DeepStrike's Stealer Log Statistics 2025 (December 21, 2025) reported that infostealer malware stole 1.8 billion credentials in 2025 [21]. Stealer log volumes on dark web markets grew 670% since 2021. More than half of ransomware incidents originated from stolen credentials. Corporate network access sold for an average of $2.7K on underground markets [21]. By late 2025, Lumma Stealer had become the dominant infostealer family — the same malware that would enable the Vercel OAuth breach in February–April 2026 [22].

DevFortress Perspective

Month −4 is the month everything was said publicly before anything became a crisis. OWASP defined the threat categories. The WEF confirmed the espionage campaign was already running. Gartner named agentic AI oversight as the year's primary cybersecurity trend. Forrester predicted an agentic AI deployment would cause a publicly disclosed breach with employee dismissals in 2026 [23]. All of these predictions were correct. None of them described the design-layer architecture that would have interrupted the pattern.

The design-layer answer — an alias that resolves only at the execution boundary, outside the agent's context, outside every log and trace the agent produces — was formally described in two academic preprints: Token-Aliased Closed-Loop Security: Architecturally Eliminating Credential Exposure in Security Monitoring (SSRN abstract 6813141) and Token-Aliased Closed-Loop Security: Comprehensive Authentication Lifecycle Defense Modules (SSRN abstract 6813640), with two further Zenodo preprints covering the specific aliasing architecture — Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection (doi.org/10.5281/zenodo.20663396) and Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories (doi.org/10.5281/zenodo.20663801). The underlying inventions were filed with Kenya's Industrial Property Institute on March 17, 2026 (KIPI KE/P/2026/005970–005973) — before any of the incidents in the months that follow became public — and published as defensive publications on Zenodo and TDCommons in April 2026.

The platform that delivers this architecture was being built during the same window the WEF was documenting that the threat was already operating at government level.

The timing is not accidental. It is the product of building from the problem backward, rather than from the market opportunity forward.

Resources

Platform:devfortress.net

SDK: npm install devfortress-sdk

Implementation Guide: DevFortress Master Edition — devfortress.gumroad.com/l/master-edition

Newsletter: devfortress.substack.com

GitHub: github.com/duncan982/devfortress-core

Academic preprints:
SSRN 6813141: Token-Aliased Closed-Loop Security: Architecturally Eliminating Credential Exposure in Security Monitoring
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6813141
SSRN 6813640: Token-Aliased Closed-Loop Security: Comprehensive Authentication Lifecycle Defense Modules
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6813640
Zenodo: Token-Aliased Closed-Loop Security: API Key Aliasing and Third-Party Payload Protection
https://zenodo.org/records/20663396
Zenodo: Token-Aliased Closed-Loop Security: Privacy-Preserving Cross-Customer Intelligence and Predictive Trajectories
https://zenodo.org/records/20663801

Defensive publications (Zenodo): 19683825 · 19691251 · 19691374 · 19691449
https://doi.org/10.5281/zenodo.19683825
https://doi.org/10.5281/zenodo.19691251
https://doi.org/10.5281/zenodo.19691374
https://doi.org/10.5281/zenodo.19691449

Defensive publications (TDCommons): 9904 · 9906 · 9907 · 9908
https://www.tdcommons.org/dpubs_series/9904/
https://www.tdcommons.org/dpubs_series/9906/
https://www.tdcommons.org/dpubs_series/9907/
https://www.tdcommons.org/dpubs_series/9908/

DevFortress · Patent Pending — KIPI KE/P/2026/005970–005973 · admin@devfortress.net

References

[1] OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for Agentic Applications 2026. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

[2] Benn, E. (2025, December 9). Quote in OWASP press release. https://genai.owasp.org/2025/12/09/owasp-genai-security-project-releases-top-10-risks-and-mitigations-for-agentic-ai-security/

[3] NVIDIA Corporation. (2025). Safety and Security Framework for Real-World Agentic Systems.

[4] World Economic Forum. (2026, January 13). Global Cybersecurity Outlook 2026. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/

[5] blog.cyberdesserts.com. (2026). AI Agent Security Risks 2026: MCP, OpenClaw & Supply Chain. https://blog.cyberdesserts.com/ai-agent-security-risks/

[6] Donenfeld, A., & Vanunu, O. (2026, February 25). Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files. Check Point Research. https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/

[7] The Hacker News. (2026, February 26). Claude Code Flaws Allow Remote Code Execution and API Key Exfiltration. https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html

[8] Proofpoint Threat Research / CSO Online. (2025, December 22). Hackers exploit Microsoft OAuth device codes to hijack enterprise accounts. https://www.csoonline.com/article/4110419/hackers-exploit-microsoft-oauth-device-codes-to-hijack-enterprise-accounts.html

[9] Hive Security. (2026, May 7). OpenClaw: How the Viral AI Agent Became 2026's First Major Security Crisis. https://hivesecurity.gitlab.io/blog/openclaw-ai-agent-security-crisis-2026/

[10] Betterclaw.io. (2026, April 29). OpenClaw Security 2026: 138 CVEs, Every Vendor Response. https://www.betterclaw.io/blog/openclaw-security-2026

[11] AdminByRequest. (2026, March 10). OpenClaw Went from Viral AI Agent to Security Crisis in Just Three Weeks. https://www.adminbyrequest.com/en/blogs/openclaw-went-from-viral-ai-agent-to-security-crisis-in-just-three-weeks

[12] Jahanzaib.ai. (2026, April 7). OpenClaw Security Crisis 2026: What You Need to Know. https://www.jahanzaib.ai/blog/openclaw-security-crisis-2026-ai-agent-vulnerabilities

[13] Guard0.ai. (2026, March 5). The OpenClaw Security Crisis: Anatomy of the First AI Agent Meltdown. https://guard0.ai/blog/openclaw-security-crisis

[14] Ruh.ai. (2026, April 27). OpenClaw's security crisis: how the world's fastest-growing AI agent became a security emergency. https://www.ruh.ai/blogs/openclaw-security-crisis-ai-agent-vulnerabilities-clawhavoc-analysis

[15] Gartner. (2025, December 18). Forecast: Information Security, Worldwide, 2023–2029, 4Q25 Update. https://softwarestrategiesblog.com/2026/03/24/information-security-spending-2026/

[16] Digital Applied. (2026). AI Spending in 2026 — Gartner, IDC & Stanford. https://www.digitalapplied.com/blog/ai-spending-forecasts-2026-gartner-idc-stanford-compiled

[17] Gartner. (2025, August 26). Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026. https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025

[18] Verizon. (2025). Data Breach Investigations Report 2025. https://www.descope.com/blog/post/dbir-2025

[19] Google Mandiant / GTIG. (2025). Widespread Data Theft Targets Salesforce Instances via Salesloft Drift. https://www.obsidiansecurity.com/blog/oauth-vulnerabilities-security-teams

[20] Obsidian Security. (2026, February 6). What are OAuth Tokens? How It Works, and Its Vulnerabilities. https://www.obsidiansecurity.com/blog/what-are-oauth-tokens-vulnerabilities

[21] DeepStrike. (2025, December 21). Stealer Log Statistics 2025: Inside the Credential Theft Boom. https://deepstrike.io/blog/stealer-log-statistics-2025

[22] Trend Micro. (2026, April 20). The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables. https://www.trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html

[23] Forrester (Paddy Harrington). (2025, October). 2026 Cybersecurity Predictions. https://softwarestrategiesblog.com/2026/02/10/gartner-cybersecurity-trends-2026/

Next: Deep Digest 2 — The Month It Got Names (January–February 2026)
https://devfortress.net/blog/deep-digest-2

All Deep Digests: devfortress.net/blog

I Published Security Research Papers While Building DevFortress

duncan n. ndegwa — Wed, 10 Jun 2026 07:29:55 +0000

This post originally appeared at devfortress.net/blog/research-behind-devfortress

Before DevFortress had its first subscriber, it had research papers.

Not because I planned it that way. When I started designing the credential
isolation system — the part where your monitoring platform receives token
aliases instead of real credentials — I realised I had to document the
theory properly before I could defend the architecture to anyone who
mattered. Investors. Potential acquirers. Engineers who would actually
integrate it.

So I wrote the papers. Filed the patents. Then built the product.

This post explains what I found — and why the research changed how I
built DevFortress.

Why a Solo Founder in Nairobi Published Security Research

The short answer: prior art.

If you build something genuinely new in security architecture, you face
two risks. First, someone patents the idea you just shipped. Second, no
one believes the approach is novel because there is no published record
of it.

Research papers solve both problems. Once your architecture is formally
described in a peer-reviewed preprint, it establishes a date and a
public record. No one can claim they invented it after that date. And
any engineer who reads the paper can see that the reasoning holds.

I also filed four provisional patents with the Kenya Industrial Property
Institute (KIPI KE/P/2026/005970–005973) before writing a single word
of marketing content. Filing first, publishing second — that is the
sequence that protects you.

What the Two Published Papers Found

I have two papers live on SSRN at this point. Here is what each one
actually found, in plain terms.

Paper 1 — Why API Monitoring Tools Accumulate the Credentials

They Were Built to Protect

SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6813141

This paper starts with a question that sounds obvious once you ask it:
if your security monitoring tool needs to watch your API sessions, does
it need your real session tokens to do that?

The answer is no — and the fact that nearly every existing tool does
store real tokens is the structural problem the paper addresses.

When a monitoring platform holds a copy of your real session token, you
have created a second attack surface. A breach of the monitoring tool
is now equivalent to a breach of every application it monitors. The
paper calls this the credential accumulation problem.

The proposed fix is credential isolation: the SDK generates a random
alias that has no mathematical relationship to the real token, and sends
only the alias to the monitoring platform. If the platform is breached,
attackers get random strings that authenticate nothing.

This is the core architecture of DevFortress.

Paper 2 — The Three-Mode API Protection Framework

SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6813640

Most API security tools work in one mode: they monitor traffic and alert
you when something looks wrong. The second paper examines why this is
insufficient — and what a complete protection system looks like across
three distinct operational modes.

The three modes are: Observe (monitor without intervention), Enforce
(block requests matching defined threat patterns), and Respond (close
the loop automatically when a confirmed threat appears).

The key finding: "alert and wait" security has a structural speed
problem. Attackers need seconds. Human response takes minutes or hours.
Automated closed-loop response — detect, revoke session, block IP,
confirm — closes this gap. DevFortress executes this in under 2 seconds
without waiting for a human.

The Papers and the Textbook

The papers answer a specific question: what should the architecture
guarantee?

They do not answer: here is the code that implements it.

The implementation — production TypeScript, exact algorithms, 703
validation tests, and the full architecture of all 34 patent-pending
inventions — is in the DevFortress Master Edition textbook.

The papers are free on SSRN. The textbook is the bridge from "I
understand the architecture" to "I can build this."

→ Read the research at devfortress.net/blog/research-behind-devfortress
→ Master Edition textbook: devfortress.gumroad.com/l/master-edition
Use code RESEARCH15 for 15% off — expires in 14 days.

What Comes Next

Two more papers are in the review process at Preprints.org. Once they
are accepted, I will publish a second research post with all four papers
and their findings together.

In the meantime, the platform is live and the SDK is available:
npm install devfortress-sdk

Patent Pending KIPI KE/P/2026/005970–005973 · devfortress.net

Patent Pending KIPI KE/P/2026/005970–005973
npm install devfortress-sdk | devfortress.net

DevFortress Open Core is Live — Free Credential Isolation for Node.js

duncan n. ndegwa — Tue, 02 Jun 2026 15:26:33 +0000

Last week we launched the DevFortress platform.

The most consistent response from developers: "I want to use this, but I cannot
justify a subscription right now."

That is a fair response. Today we publish the open-core edition.

What is free, permanently

Tier 1 local rule engine
SQLi, XSS, path traversal, rate limiting. Evaluation happens in under 1 millisecond.
Zero network calls. Your application does not need internet access for this to work.

Credential isolation
Real session tokens never leave your application boundary. If you connect to the
DevFortress platform, it receives only non-derivable aliases — never your real tokens.
Even a complete platform breach yields no usable credentials.

Agent scope enforcement
Define which tools your AI agents are permitted to call. Unsanctioned tool calls
are blocked before execution. This is the structural answer to prompt injection —
the injection string alone does not cause the damage; the unsanctioned tool
execution does.

Local ML inference (embedded, optional)
In-process threat scoring using an ONNX model. No network call required.
Bring your own model or rely on the built-in heuristic fallback.

Local audit trail
Every security decision is logged: timestamp, source, decision, score. JSON export.
Compliance-ready without sending data to any external service.

What is commercial

Cross-customer threat intelligence (B1), platform ML inference — cloud-scored
cross-customer model (B2), predictive attack trajectory (B12), cloud webhook
delivery, automated response, dashboard.

The dividing line: local security is free. Platform intelligence is commercial.

The license

BUSL-1.1. In plain language:

You can use it in your own applications, free.
You can read the source code and verify exactly what data it touches.
You cannot build a competing API security SaaS using our code.
Four years after each release, the code converts to Apache 2.0.

Security tools should be transparent about what they do.
That is why we publish the source.

Install

npm install devfortress-sdk@4.9.0

GitHub: github.com/duncan982/devfortress
Docs: devfortress.net/docs

Core credential isolation and threat response inventions are patent-pending.
KIPI KE/P/2026/005970–005973.

We built credential isolation and automated closed-loop response into an API security SDK — here is why and how

duncan n. ndegwa — Fri, 22 May 2026 16:59:31 +0000

Security monitoring tools store your real session tokens.

Every JWT. Every credential. For every user, across every application they protect — sitting in a third-party database. If that vendor is breached, every application they monitor is compromised. This is not a theoretical risk. It is the architecture of almost every API security platform on the market today.

We spent 18 months building a different approach. DevFortress launches today.

The Core Problem: Credential Accumulation

When you integrate a traditional API security monitor, your SDK sends real session tokens to the monitoring platform for analysis. The platform logs them, correlates them, runs ML models on them. The platform needs the real token to do its job.

This means the security tool designed to protect you is also the largest single point of credential exposure in your infrastructure.

The Fix: Credential Isolation

When the DevFortress SDK intercepts a session token, it generates a completely random alias — no mathematical relationship to the real token — and sends only that alias to the platform. The real token never leaves your application boundary.

If DevFortress is breached tomorrow: attackers get a database of random strings that authenticate nothing, anywhere.

The Second Problem: Alert Fatigue

Traditional security tools detect a threat and send you an alert. The attacker's session stays active while you wake up, read the alert, triage it, and decide what to do. Average human response time: hours. Time an attacker needs to exfiltrate data: seconds.

DevFortress closes the loop automatically. When a threat is detected, the platform fires a signed HMAC-SHA256 webhook to your application. Your application revokes the session, blocks the IP, and confirms back to the platform. The entire cycle completes in under 2 seconds. No human in the loop.

AI Agent Security

AI agents introduced a new attack surface. A LangChain or AutoGen agent running in production holds real API keys with broad scope. One successful prompt injection and an attacker has those credentials.

DevFortress for agents:

AgentScopeEnforcer — define a tool allowlist per agent; block any unsanctioned tool call before execution
Token aliasing for agents — master API keys never exposed; the agent operates on scoped aliases
Auto-quarantine — compromised agent is isolated with full tool-call sequence preserved as evidence

What We Validated

133/133 attack events blocked
26 distinct attack scenarios
7 reference applications
100% SDK pass rate
Sub-millisecond internal blocking (<1ms)
4 patent filings, 34 inventions
Patent Pending — KIPI KE/P/2026/005970–005973

Three Ways to Start

Install the SDK (free):

npm install devfortress-sdk@4.8.0

Read the full architecture writeup:
https://www.devfortress.net/blog/devfortress-launch

Get the Master Edition textbook (full architecture deep-dive + interactive demos):
https://devfortress.gumroad.com/l/master-edition

Subscribe to the weekly security journal:
https://devfortress.substack.com

Happy to go deep on any of the inventions in the comments — especially the credential isolation mechanism, the closed-loop webhook architecture, or the AI agent scope enforcement.