Elmoz Research https://elmoz.de/blog/ Teardowns and guides on AI agent and non-human identity security. en The Vercel breach was an attack path, not a vulnerability.https://elmoz.de/blog/vercel-breach-ai-oauth-attack-pathhttps://elmoz.de/blog/vercel-breach-ai-oauth-attack-pathSun, 27 Sep 2026 08:00:00 +0000The 2026 Vercel breach started with an AI tool's OAuth token. We trace the attack path step by step and show where it could have been broken. Autonomous AI agents breached online retailers for about $25 a company.https://elmoz.de/blog/autonomous-ai-agents-25-per-companyhttps://elmoz.de/blog/autonomous-ai-agents-25-per-companySat, 26 Sep 2026 08:00:00 +0000Gambit recovered the staging server of an AI-run campaign against online retailers. At least 27 companies, 600,000 card records, about 25 dollars a target. Coding agent sandbox escapes: a checklist after the Codex research.https://elmoz.de/blog/coding-agent-sandbox-escape-checklisthttps://elmoz.de/blog/coding-agent-sandbox-escape-checklistThu, 24 Sep 2026 08:00:00 +0000Accomplish escaped the OpenAI Codex sandbox twice, once out of read-only mode. Use this checklist to review what your coding agents can reach. Spain logged the first breach notification where the attacker was an AI agent.https://elmoz.de/blog/first-ai-agent-breach-notification-aepdhttps://elmoz.de/blog/first-ai-agent-breach-notification-aepdMon, 21 Sep 2026 08:00:00 +0000Spain's AEPD logged its first breach notification naming an autonomous AI agent. The agent logged in before it found the flaw. Trace the path and what to check. Three of OpenAI’s six new incidents are access problems, not alignment problems.https://elmoz.de/blog/openai-agent-incidents-access-not-alignmenthttps://elmoz.de/blog/openai-agent-incidents-access-not-alignmentFri, 18 Sep 2026 08:00:00 +0000OpenAI disclosed six new model incidents. Three are access findings: leaked API keys, an internal artifact store, public file hosts. Trace the reach. AI agents breached 395 organisations. A service account opened the domain.https://elmoz.de/blog/papercut-ai-agents-service-account-domain-adminhttps://elmoz.de/blog/papercut-ai-agents-service-account-domain-adminThu, 17 Sep 2026 08:00:00 +0000GreyNoise and Blackpoint traced an AI-run campaign against PaperCut servers. Follow the path from one unauthenticated request to Domain Admins. Infostealer logs are full of AI session tokens that replay past MFA.https://elmoz.de/blog/ai-session-tokens-replay-past-mfahttps://elmoz.de/blog/ai-session-tokens-replay-past-mfaWed, 16 Sep 2026 08:00:00 +0000Okta found replayable AI session tokens and working API keys in a free infostealer dump. Trace the path from an infected laptop to your AI accounts. GitSpawn: one line in .git/config runs code in seven AI coding agents.https://elmoz.de/blog/gitspawn-git-config-ai-coding-agentshttps://elmoz.de/blog/gitspawn-git-config-ai-coding-agentsFri, 11 Sep 2026 08:00:00 +0000GitSpawn lets a repository’s .git/config run code in Claude Code, Codex, Cursor and four other AI coding agents. The attack path, patch status and checks. AI agents in OT and KRITIS: a security checklist for operators.https://elmoz.de/blog/ai-agents-in-kritishttps://elmoz.de/blog/ai-agents-in-kritisTue, 08 Sep 2026 08:00:00 +0000Deploy AI agents in critical infrastructure with clear ownership, scoped access, logging and human oversight. Six security measures for OT and KRITIS operators. MCP security: risks and a 12-point hardening checklist.https://elmoz.de/blog/mcp-security-guidehttps://elmoz.de/blog/mcp-security-guideTue, 08 Sep 2026 08:00:00 +0000Secure Model Context Protocol servers against prompt injection, tool poisoning and credential misuse. A practical 12-point MCP security checklist. NIS2 reporting for AI agent incidents: when the 24-hour deadline applies.https://elmoz.de/blog/nis2-reporting-ai-agent-incidentshttps://elmoz.de/blog/nis2-reporting-ai-agent-incidentsTue, 08 Sep 2026 08:00:00 +0000When is an AI agent incident reportable under NIS2 in Germany? Review the significance threshold, 24-hour and 72-hour deadlines, and evidence to collect. AI-assisted attacks on critical infrastructure: evidence and security lessons.https://elmoz.de/blog/ai-agents-critical-infrastructure-2026https://elmoz.de/blog/ai-agents-critical-infrastructure-2026Tue, 08 Sep 2026 08:00:00 +0000Separate documented AI-assisted OT attacks from claims of autonomous attacks. Review incident evidence, access risks and priorities for infrastructure operators. Non-human identity security: risks, controls and a practical plan.https://elmoz.de/blog/non-human-identities-nhi-security-2026https://elmoz.de/blog/non-human-identities-nhi-security-2026Tue, 08 Sep 2026 08:00:00 +0000What are non-human identities? Learn how to secure service accounts, API keys and AI agents, evaluate NHI security tools, and reduce access to sensitive data. Cursor deleted the PocketOS database on Railway. How did it get access?https://elmoz.de/blog/cursor-deleted-production-database-railway-pocketoshttps://elmoz.de/blog/cursor-deleted-production-database-railway-pocketosTue, 08 Sep 2026 08:00:00 +0000How a Cursor agent reached the PocketOS production database through a Railway API token, what Railway changed, and the access controls to review. The Salesloft Drift breach: how stolen OAuth tokens exposed Salesforce data.https://elmoz.de/blog/salesloft-drift-oauth-breach-700-companieshttps://elmoz.de/blog/salesloft-drift-oauth-breach-700-companiesTue, 08 Sep 2026 08:00:00 +0000How stolen Salesloft Drift OAuth tokens enabled Salesforce data theft. Trace the access path and review token scope, stored secrets and revocation. JADEPUFFER ransomware: tracing the agentic attack path.https://elmoz.de/blog/jadepuffer-first-agentic-ransomwarehttps://elmoz.de/blog/jadepuffer-first-agentic-ransomwareTue, 08 Sep 2026 08:00:00 +0000Examine Sysdig’s JADEPUFFER research: Langflow exploitation, credential theft and database extortion, with lessons for non-human identity security. The Nx s1ngularity attack: how malware targeted AI coding CLIs.https://elmoz.de/blog/s1ngularity-nx-supply-chain-ai-cli-attackhttps://elmoz.de/blog/s1ngularity-nx-supply-chain-ai-cli-attackTue, 08 Sep 2026 08:00:00 +0000How the Nx s1ngularity supply-chain attack targeted AI coding CLIs and developer credentials. Review the access path and controls that limit exposure.