The Watch

What Happened

An unauthorized actor compromised market-intelligence vendor Klue and stole OAuth tokens that Klue held for its integration with LastPass's Salesforce CRM. The attacker replayed those tokens directly against Salesforce, authenticating as the legitimate Klue application and exfiltrating customer contact and CRM data. LastPass confirmed vaults and core infrastructure were unaffected — but named customer data walked out the door.

No phishing. No malware. No credential stuffing. Just a third-party's over-scoped, long-lived OAuth token replayed against your downstream tenant. That's the new perimeter breach.

Why This Is Different

This is not a novel technique — it's the same SaaS-to-SaaS OAuth abuse pattern seen in Salesloft/Drift-style campaigns — but it now has a high-profile victim and a clean kill chain to brief leadership on. The critical detection gap: your EDR sees nothing because no endpoint is compromised. Your CASB likely misses it because the OAuth app is legitimate and the API traffic patterns blend with normal usage. The malicious access is indistinguishable from authorized access at the network and endpoint layers.

Kill Chain

1. Compromise the integration vendor (Klue)
2. Harvest OAuth tokens granted by downstream customers
3. Replay tokens against Salesforce/CRM tenants
4. Exfiltrate data that authenticates as legitimate app activity

Downstream Consequences

The exfiltrated CRM data — named contacts, account relationships, deal stages — is premium fuel for spear-phishing and BEC. Attackers now know which customers use LastPass, who their account contacts are, and potentially deal context. Expect highly convincing LastPass-branded lures referencing real account details within weeks.

Your Exposure

If your organization uses any market-intel, sales-enablement, or CRM-connected SaaS tool with OAuth grants into Salesforce, HubSpot, or similar platforms, you share LastPass's exposure profile. Most organizations have dozens to hundreds of these grants, approved once during onboarding and never audited again.

Cross-Source Context

This breach validates the broader pattern multiple sources flagged today: the non-human identity problem is now manifesting in production. Whether it's OAuth tokens (this incident), AI agent credentials (0DIN research), or autonomous provisioning capabilities, the common thread is machine identities with standing access that humans don't monitor.

The Research

Mozilla's 0DIN team published a working three-stage supply-chain attack against AI coding agents. A GitHub repository that passes clean code review includes a deliberate fake 'install error' that instructs the agent to run python3 -m axiom init. That command resolves a DNS-controlled payload that opens a reverse shell. The agent never 'decides' to open a shell — it decides to fix an error. The distinction is everything.

Claude Code never decided to open a shell — it decided to fix an error. And that error was the attacker's entire kill chain.

Why Point-in-Time Scanning Dies Here

The payload is DNS-swappable. The repository passes every SAST, SCA, and human review gate. Days or weeks later, the DNS record changes, and the same 'clean' code delivers a reverse shell. Your Dependabot, code signing, and SBOM controls assume static malice — this attack is temporally dynamic. The primary defense is containment, not detection at the code layer.

Compounding Factor: Agents Now Provision Infrastructure

Multiple sources confirm coding agents have crossed from code-completion into autonomous infrastructure actions: registering domains, provisioning accounts, initiating payments, and obtaining credentials with limited human oversight. O'Reilly's 2026 Technology Radar formally names credential leakage from coding agents as a significant emerging threat. A compromised agent that can also spend money and stand up infrastructure is no longer just a data exfiltration risk — it's an attacker infrastructure builder.

Attack Comparison

Defensive Tooling Catching Up

PydanticAI V2 shipped native guardrails, code-execution controls, and deferred tool loading. SARC wraps frameworks to enforce constraints. These aren't mature enough to rely on alone, but they represent a governance layer that didn't exist 90 days ago. Adopt them as defense-in-depth, not primary control.

The Capability Shift

Two releases landed this week that independently remove detection assumptions most security teams still rely on:

1. ByteDance Seedance 2.5 generates native 30-second 4K video in a single pass, fusing up to 50 references (images, video, audio, character sheets) while preserving character identity, lighting continuity, and physics. This isn't a demo reel — it's production-grade executive impersonation at a resolution that defeats the cheap visual inspection tell.
2. Frontier coding agents run fully offline on consumer hardware: Ornith 1.0 (30B-A3B) on a single RTX 4090 or M3 Max; Qwen-AgentWorld on one H100 or dual RTX 5090s. Both are Apache 2.0 licensed, uncensored, and generate zero API telemetry.

An agent that runs without a network connection leaves no API call to log, no cloud provider to subpoena, no rate limit to throttle the operator. The model sits on the endpoint. The activity stays local.

What Defenders Lose

Resolution as a deepfake tell is gone. Earlier synthetic video degraded under scrutiny — artifacts, temporal inconsistency, sub-1080p output. Seedance 2.5 at 4K with character continuity eliminates this. The world's leading digital-forensics expert, Hany Farid, now publicly states he fails his own real-vs-fake image tests and warns the human visual system will be 'utterly useless' for authentication within 1-2 years.

API-layer monitoring is bypassed. If your shadow-AI detection relies on outbound calls to OpenAI/Anthropic/model-vendor APIs, offline agents are invisible. They consume no tokens from a metered endpoint. Your CASB won't flag them. Your DLP won't intercept the prompts. The only evidence is GPU utilization on the endpoint.

Combined Threat Scenario

A threat actor generates a 4K video of your CFO requesting an urgent wire transfer (Seedance 2.5), then uses an offline agent to research your org, craft the pretext, and orchestrate delivery — all from a single workstation with no network calls that would trigger monitoring. The entire attack chain produces zero cloud telemetry.

Detection Investment Required

Practical Limits

Caveat: Seedance 2.5 generates 30-second clips, not real-time interactive video. Live deepfake conversations remain harder. The threat is pre-recorded video messages, voicemails, and asynchronous communication — not yet a Zoom call impersonation. But 30 seconds is enough for a voicemail or a short video 'urgent request.'