Codezero @Codezero_io

New this month: infostealer malware now hunts AI agent tokens specifically. Families like Amatera and Remus are harvesting Claude, Cursor and Codex access tokens, plus MCP configs holding credentials, straight from the plaintext locations agents leave them in. Attackers follow the access. Agent tokens are now the loot. Cordon keeps the credential out of those locations entirely, injected only at the point of use. Nothing left on disk to steal. See how on our profile. Source: adversa.ai/blog/top-ai-co…

The vault isn’t the weak point anymore. The moment of use is. Your secrets sit safely encrypted, right up until an agent actually uses one. For that instant it’s decrypted in memory, readable by anything sharing that space. That’s where this year’s breaches keep landing. Cordon injects the credential at that exact moment, in transit, so the readable secret never exists where the agent can reach it. Walkthrough’s pinned to our profile.

If one of your AI agents went rogue tonight, could you prove what it was able to reach, or would you be guessing? Most teams would be guessing. That’s the gap worth closing before an incident forces the answer. We break down how agent containment actually works, every day. Follow along.

“You probably need to assume that’s already going to happen.” Mike Privette on the inversion security teams now have to make. For a decade, deception and containment, things like canary tokens, were the mark of a mature program that had already done everything else right. Not anymore. An autonomous agent can chain a harvested credential into lateral movement faster than any SOC can react, so the question shifts from how fast can we catch it to assume it gets in, and make sure what it finds is worthless. Full episode of Nothing to Steal, CodeZero’s podcast on AI security and identity, is live on YouTube. #Cybersecurity #AIAgents #NothingToSteal #CISO

Step back from the individual headlines this month. AWS agents handing over credentials. Infostealers harvesting agent tokens. Agents leaking screenshots and passing secrets between departments. Different stories, one root cause. The credential was sitting somewhere the agent could reach it. That is the one thing Cordon removes. Credentials injected at the point of use, scoped to the task, never held in the runtime. Take away the thing sitting there to be taken, and the whole category of problem shrinks. Source: adversa.ai/blog/top-ai-ag…

Here is the pattern behind almost every AI agent incident this year, said plainly. The agent did not need to be hacked. It already held a credential it could reach, read, hand over, or misuse. The attack, when there was one, just pointed it in the wrong direction. Fix the holding, and most of these stories never start.

Every hosted agent platform is converging on the same hard lesson this year. The sandbox boundary, the vault, the permissions, all of it fails the moment the credential becomes readable at the point of use. Zenity put it well describing the AWS flaw. The model was just the messenger. The door was never locked. Cordon locks that door. The credential is injected in transit, used for the one call, and gone. It never exists in a readable form inside the agent’s reach for a prompt, a stealer, or a bug to grab. Source: explainx.ai/blog/agentcorr…

A simple weekend check for anyone running AI agents. If an attacker got one plain-text message to one of your public-facing agents, what could they talk it into handing over? Last week a researcher answered that question for Amazon Bedrock. The answer was: its own credentials, and a path to every other agent in the account.

The FTC opening a probe into OpenAI and Anthropic this month tells you where this is heading. Agent behaviour is becoming something you have to answer for, not just manage internally. When that day comes, the hardest question will be simple. If one of your agents acted wrongly, can you prove what it could and could not reach. Cordon makes that answerable. Credentials are injected per task and never held, so what an agent could access at any moment is defined and bounded, not a mystery you reconstruct after the fact. Source: securityweek.com/ftc-is-investi…

The FTC has opened a broad investigation into the biggest AI companies over how their autonomous systems behave. Whatever comes of it, the direction is clear. Agents acting beyond their instructions is no longer a research curiosity. It is now a regulatory and consumer-safety question. If regulators are taking agent behaviour seriously, the teams deploying agents probably should be too. Source: securityweek.com/ftc-is-investi…

There is a quieter version of the agent credential problem that nobody screenshots. Security researchers flagged this month that sanctioned, approved AI agents are passing credentials between each other inside companies. An onboarding agent pulls HR data, hands off to a provisioning agent, which hands off again. At each step, credentials get passed along. Nobody decided to share them. The agents just did. Cordon sits under that whole chain. Each agent gets the credential injected for its specific task and never holds it to pass on, so a secret cannot quietly accumulate across tools it was never meant to reach. Source: it-online.co.za/2026/10/09/san…

“It’s hard to put a guardrail in front of something that feels like a magic wand.” Mike Privette, former CISO and founder of Return on Security, on why credential security keeps losing the fight. A compromised agent isn’t just a risk in itself. It can use every credential it was ever handed to pivot and move, the same way an attacker pivots off a stolen password hash. The fix is making sure those credentials either never reach the agent or only arrive tokenised. But that means adding friction, and the whole industry has been told friction is the enemy of good AI. Full episode of Nothing to Steal, CodeZero’s podcast on AI security and identity, is live on YouTube. #Cybersecurity #AIAgents #NothingToSteal #CISO

Ask yourself one question about every AI agent you run. Not “could someone hack it.” Ask “what can it already reach, and what would it do with all of that if a task pushed it somewhere I did not expect.” Almost every agent incident this year is the answer to that second question, not the first.

The 13,000 leaked screenshots this month are worth understanding, because no attacker was involved. Coding agents hit a limit, needed to complete a task, and took the route left open to them. That route happened to be public. The access they used was access they were simply holding. This is the whole argument for scoping. An agent with standing access will use all of it, in ways you did not predict. Cordon gives the agent only what the task needs, only when it needs it, so there is no broad standing access to misuse in the first place. Source: techrepublic.com/article/news-a…

13,000 internal screenshots from 343 companies ended up in public GitHub repositories this month. No hacker. No breach. AI coding agents could not attach images to a private pull request, so they pushed them somewhere public instead, using access they already had. The scary part of agent security is not the attack. It is what an agent does with the access you already gave it.

New this month: infostealer malware has a fresh target. Not your bank login. Your AI agent. Families like Amatera and Remus now specifically harvest Claude, Cursor and Codex access tokens, plus MCP configs holding credentials, from the predictable, sometimes plaintext locations agents leave them in. Attackers follow the access. Agent tokens are now high-value loot. Cordon keeps the credential out of those locations entirely, injected only at the point of use and never left sitting on disk for a stealer to find. Source: adversa.ai/blog/top-ai-co…

Your password manager locks your credentials in a vault. Good. But the moment your AI agent actually uses one of those credentials, it has to be decrypted into memory in plaintext. For that moment, it is readable by anything sharing that space. The vault protects the key at rest. The gap is at the point of use. That is where this year’s incidents keep happening.

Zenity Labs showed last week that one prompt to an exposed Amazon Bedrock agent could make it surrender its own credentials, with a path to every agent in the same AWS account. Here is the part worth sitting with. AWS stores those credentials in a vault. But to use them, the vault decrypts the secret into the agent’s memory in plaintext. At the moment of use, it is readable. That is exactly the gap Cordon closes. The credential is injected in transit and never sits decrypted where the agent or anything else can read it. Source: cybersecuritynews.com/agentcorruptio…

A researcher sent one plain-English message to a single AI agent last week. That one message was enough to make the agent hand over its own cloud credentials, and open a path to every other agent in the account. No exploit. No malware. Just an agent holding keys it should never have been able to give away.

The industry spent a decade building vaults, scanners, and identity platforms. All of it protects credentials where they are stored. None of it protects the credential at the one moment that matters, when the agent actually uses it. That is the gap every incident this year walked straight through. Cordon sits at exactly that point. The credential is injected in transit, used, and gone. The agent completes the call and never holds the secret it used.