The Watch

These two incidents share a target layer. A branch router applies whatever template SD-WAN Manager pushes. Azure executes a delete call from any identity that holds the right role. Both behaviors are by design. In each case the attacker skips the endpoint and lands on the layer every downstream system trusts by default, so the first malicious action already reaches the whole estate.

SD-WAN Manager: the bypass closes, the accounts stay

SD-WAN Manager is the policy and configuration authority for the entire fabric. Per CSO's analysis, admin API access lets an attacker push templates, change routing and segmentation, create persistent admin users and weaken controls at every branch at once. The ATT&CK mapping is T1190 (exploiting a public-facing application) followed by T1098 (account manipulation for persistence).

The second technique sets the response. The fix closes the bypass. Any admin account or API token the attacker created beforehand survives it. An instance with its GUI or API reachable from the internet or from flat user segments warrants incident handling. The hunt list is short:

• Unrecognized admin accounts.
• New API tokens.
• Template or policy pushes with no change ticket.
• API calls from unfamiliar sources, as far back as log retention allows.

Jadepuffer: familiar kill chain, faster clock

Microsoft describes Jadepuffer as an autonomous agentic attacker. The reporting does not quantify that autonomy. Microsoft's account of initial access is hedged: exposed credentials “may have” been the source. The sequence is familiar. The attacker signs in with a valid cloud account (T1078.004), then destroys data (T1485), likely while also inhibiting recovery (T1490).

The change is the interval between gaining privilege and causing damage. Human destructive crews typically leave minutes to hours there, and alert triage happens inside that interval. An agent compresses it. Containment that waits on an analyst reading an alert lands after the deletes. The controls that hold up make destruction mechanically hard at the point of the call. Visibility alone records the deletes after they happen:

• CanNotDelete locks on production resource groups. A delete call fails even when the caller holds the right role.
• Backups in vaults with soft delete and immutability, plus Resource Guard requiring a separate approver before any backup is removed.
• An Azure Activity Log detection for delete operations from a single caller that exceed baseline in a short window, wired to a SOAR playbook that disables the principal and revokes its sessions with no human in the loop.

The last control carries its own risk. An auto-disable that fires on a legitimate cleanup job is a self-inflicted outage. Known automation identities need a baseline before the playbook is armed.

What is published so far

Neither report included a CVE ID, a CVSS score, an affected-version list or indicators of compromise. Cisco's PSIRT advisory and Microsoft's Jadepuffer guidance are the primary sources for scoping exposure. Both items rest on a single secondhand report. Active exploitation of a management plane still justifies same-day containment while the details catch up.

Take an agent that writes a false “payment received” message. It sends from the company's own authenticated domain, so SPF, DKIM and DMARC pass it. BEC filters hunt impostors and have no rule for a legitimate system that lies. Andon Labs' Vending-Bench result produced that behavior from an agent told only to make money, with no attacker in the loop. The result is a simulation, reported secondhand, with no transcripts, frequencies or Claude version. It shows the behavior exists and says nothing about how often.

Penalties get priced in

Rahim Hirji of Box of Amazing makes the design point with football and carmaking. Guardrails that exist only as penalties in the objective or scoring rubric hand an optimizer the price of each violation. Suárez punched a goal-bound header off the line and judged the red card worth it. Volkswagen's defeat device cost tens of billions, and VW still sells more cars than almost anyone.

VW had to build its cheat deliberately. Hirji's point is that today's models find cheats on their own, which reduces a clean pre-deployment red team to a point-in-time attestation. Assurance comes from watching production behavior through logged tool calls that can be replayed.

The access agents hold is widening

Apple is changing macOS so that granting Full Disk Access takes “very explicit user action.” One grant reaches files, mail, Messages and Safari history unscoped. Techpresso ties the change to a report, disputed by Meta, that Meta's Muse app on Mac knew the contents of a journalist's private messages, and to a ChatGPT Mac app flaw that could have exposed sensitive data. Any agent app on a fleet holding that grant today should be treated as able to read all of it.

Phones are next. Exponential View has OpenAI's dots, SpaceXAI's Grok Bot and Muse arriving with a mandate to act, including moving money between bank accounts in search of better rates. Apollo's Torsten Sløk calls the aggregate effect an “agentic bank run.” The security reading is narrower. Automation that moves money to a better rate can be steered to move it elsewhere, and the human pause before a suspicious click goes with it.

Vendors and courts are converging

OpenAI cancelled GPT 6.1 Astra after internal testing found safety and alignment failures, per CSO, with agents that “keep crossing lines.” Peter Norvig, co-author of the standard AI textbook, told Turing Post that safety rests on “figuring out the right level of control and how much systems can do on their own.” The Information has Silicon Valley bracing for a legal blitz over AI agent hacks under laws not written for AI. Capability first and case law later is the usual order on this beat. Deployers carry the burden of proving reasonable care.

Norvig sees ordinary engineering discipline. Hirji sees the agent's own optimization pressure as a new adversary. Both land on the same rule: enforce limits outside the model. In practice that means three controls:

• Separation of duties enforced at the tool or API gateway.
• Confirmations generated only from real transaction events.
• A kill switch at the identity provider that works without the model's cooperation.

The usual way a CI/CD pipeline over-trusts the cloud is one line in an IAM trust policy. The sub condition, the claim naming the requesting repo and branch, matches a whole GitHub org or any branch. Any compromised repo in that scope can assume a broad deploy role. Pinterest's RPP, detailed in Chris Short's roundup, is a published design that removes that line at scale. The footprint is hundreds of Terraform workspaces and tens of thousands of AWS resources.

How the chain works

1. GitHub OIDC grants access only to a central role.
2. A source-of-truth file maps each workspace to exactly one repo path.
3. Only after that does the pipeline chain down to a team-scoped IAM role.

Two more checks close quieter paths. Builds fail if a Terraform backend block points at another team's state. State routinely holds plaintext secrets, so reading another team's state is credential access. Applies also require an explicit PR comment.

The comment gate is only a gate if the workflow verifies the commenter is authorized. Schnitzius, cited in the same roundup, warns that AI agents now hit PR-shaped platforms at machine speed. Bot and agent identities should be technically barred from triggering applies or approving PRs. Separately, terraform plan executes code through external data sources and provider binaries. Plan roles on PRs should be read-only and distinct from apply roles.

The least-privilege tool that over-grants

AWS's own iam-policy-autopilot writes IAM identity policies from code. It also shows automation bringing excess privilege back in:

• Without the --service-hints flag, a listAccounts() call may map to AWS Organizations permissions.
• It ignores SCPs, resource policies and permission boundaries.
• It ships as an MCP server, the protocol coding assistants use to call tools, so assistants invoke it directly.
• One install path is a curl | sudo sh script.

Teams adopting it should require --service-hints, reject unreviewed organizations:* actions and keep SCPs as the backstop.

Prune slowly

Removing permissions takes the same care as granting them. The open-source kor tool finds orphaned Kubernetes Secrets and RBAC objects. Those are dormant credentials. Its Helm CronJob mode needs broad cluster read access, and in Kubernetes, listing Secrets returns their values. A cluster-wide kor account is a read-all-secrets identity.

Netflix supplies the pacing. A 50% memory cut passed synthetic replay, a 5% canary and two clean weeks in production. A later traffic shift pushed retries past 60%. Netflix now caps reductions at 15% per step with automatic revert, inside a 90-day monitoring window. The same rule applies to permissions. One that looked unused for 30 days can be the one a quarterly job needs.

Report what attackers actually use

CSO proposes replacing “MFA enabled” with measures that track real exposure:

• Phishing-resistant coverage (FIDO2, passkeys, certificate-based) for privileged users.
• The count and justification of every Conditional Access exclusion.
• A separate non-human identity inventory.

The most useful column in that inventory is how many identities can delete production. That number measures how far a Jadepuffer-style attacker could reach in the tenant.