The Delegated Key

Permission to enter

A customer gives an AI assistant a bank password. The assistant signs in. The bank blocks it.

Has the assistant gone rogue?

That question ran through this week’s banking coverage. Reuters reported that banks were blocking third-party agents operating inside customer accounts. In some cases, customers had supplied their own login details. The dispute involved access that customers wanted but banks had not approved. Reuters

Axios’s follow-up reported no observed rogue-agent activity or evidence of a hack affecting customer funds or accounts. Axios

The distinction matters. A customer-authorized assistant and an intruder using stolen credentials present different problems. They require different responses.

But customer consent does not settle every question. An instruction to review spending does not authorize a transfer. Permission to prepare a payment does not necessarily authorize sending it. An assistant can have valid login credentials and still take an action its owner never intended.

There are three separate tests: who granted access, what that access permits, and whether the resulting action stays within those limits.

Calling every disputed login an attack obscures those tests. Treating every successful login as sufficient permission ignores them.

Where the breaches were real

Recent security incidents show why this distinction has practical consequences.

Huntress reported that compromised credentials associated with ConnectWise cloud applications were used against Microsoft 365 customer environments. By October 17, it had identified related sign-in activity across almost 1,000 organizations’ cloud environments, with successful sign-ins in more than 300. Those figures do not establish that data was stolen from every affected organization. Huntress

A more consequential detail appeared inside the investigation: attackers added credentials to other applications in a customer environment. Removing the original access would not automatically remove the additional access they had created.

That changes the containment problem. An organization must establish what the intruder did with its authority, including whether it created new ways to return.

The software supply chain offered another example. On October 21, attackers published a malicious LiteLLM release. The project’s investigation described stolen developer credentials and the defeat of multiple security controls. Datadog reported that the attackers used tokens from three engineers’ accounts to manipulate a legitimate release workflow. Malicious software then reached normal distribution channels. LiteLLM · Datadog

These incidents involved authority that systems already recognized. The attacker’s advantage came from gaining control of it.

The time available is shrinking

AI adds speed to this problem.

Microsoft attributed the ConnectWise compromise to Storm-0940, a China-state-aligned threat actor. It reported that the group used an agentic security-testing framework called ARTEX to automate parts of its campaigns. In several cases, the interval from initial targeting to privileged cloud access was less than three hours. Microsoft

That finding supports a specific conclusion: attackers can use agents to accelerate familiar methods. It does not establish that every recent breach was AI-driven.

Software defects remain a separate route into systems. Wiz described using AI in its research into PHP2Shell, a set of serious PHP vulnerabilities. AWS detected an exploitation attempt on October 17, four days before public disclosure. AWS said it was unclear whether the observed attempts would have succeeded against real-world systems. Wiz · AWS

Better credential controls would not, on their own, eliminate that class of vulnerability. Patching, isolation and detection still matter.

The common pressure is time. Defenders must discover the problem, understand its reach and contain it before an attacker turns one opening into several.

For legitimate agents, the same acceleration creates a deployment problem. A system that can complete useful work quickly can also repeat a mistake quickly. The limits on its authority need to operate at the speed of its actions.