Blog
De la part de l'équipe
Nous écrivons sur ce que nous observons dans le domaine de la sécurité des identifiants — les violations qui auraient pu être évitées, les décisions d'architecture que nous avons prises et pourquoi, ainsi que les modèles que nous pensons que tous ceux qui développent avec des agents IA devraient comprendre.
#42
We need to face reality: agents cannot be contained.
OpenAI's own cyber-capable model breached Hugging Face production during a benchmark, and it walked in on credentials sitting on the worker. You cannot contain an agent, so the fix is to remove the credential, not to control the agent harder.
#41
The cage was never the problem. The keys inside it were.
On July 8 we wrote that a sandbox controls where an agent runs, not what it can take. Eight days later an autonomous agent ran 17,000+ actions across Hugging Face's internal clusters. Nothing escaped the worker. Nothing had to.
#39
The label on the credential is not the scope of the credential.
A 1Password service token scoped to one vault can map the entire org: every user, group, and permission. The label said one vault. The API disagreed. Scope has to be enforced, not labeled.
#38
Your Credentials Rotate Quarterly. The Machine Debugs Itself in 31 Seconds.
The first documented autonomous ransomware swept a host for every secret in reach and debugged its own failed exploit in 31 seconds. The credentials were static, on disk, waiting.
#37
Apple notarized it. It emptied fourteen password managers anyway.
Apple notarized a Mac app that emptied fourteen password managers with one forged password box. Nobody was hacked. The vaults were sitting on the machine the whole time.
#36
Passkeys secured the login. Not the lifecycle.
A passkey cannot be phished, so attackers went after enrollment, sync, and recovery instead, now with real-time voice cloning. Here is how to defend recovery against a call that sounds like anyone.
#35
Breaking research: in 7 out of 11 cases, the agent gave the secrets.
Researchers hid credential-theft instructions inside a PNG that a text-based reviewer cannot read. In 7 of 11 agent setups, the agent read the image and leaked every secret in the .env.
#34
Nobody stole the keys. The vault shared them.
A CVE in self-hosted Bitwarden let a low-privileged member walk off with the whole org's vault keys. The crypto did not fail. A vault that can hand a key to someone new can be tricked into it.
#33
The cage holds where the agent runs. Not what it can take.
Agents went from 3% of Vercel's deployments to more than half in two quarters. Vercel built a sandbox to cage where the agent runs. It says nothing about what the agent can take.
#32
The malware you approved because you couldn’t see it
GlassWorm hides its payload in invisible Unicode that passes human code review, then reads the credentials lying around your workspace. An invisible worm does not break encryption. It needs a file.
#31
CitrixBleed came back, and the lesson is older than the bug
CitrixBleed came back: send NetScaler a login it cannot parse and it reads its own memory back to you. The byte count changes. The shape, credentials sitting in internet-facing memory, does not.
#30
If it can reach Huntress, it can reach you
Huntress and LastPass, two companies you trust to stop a breach, both got breached through a forgotten vendor connection. If it reached them, it reaches you. Move the crown jewels first.
#29
The vault held. That was never the way in.
LastPass was breached again and the vault held. The way in was a dead OAuth token from an abandoned integration, the class of secret almost nobody treats as one.
#25
You cannot keep it in a box. Last week proved it twice.
The US ruled the most powerful hacking AI too dangerous to export. Days later, a Chinese lab open-sourced an equal. You cannot keep a capability in a box, so stop keeping your secrets in one.
#28
How to lose 1.3TB of secrets, the Novo Nordisk way.
One access token in a forgotten subdomain's JavaScript became 1.3TB of stolen secrets. Enterprise vaults guard people. The breach walked in through the machine credentials nobody governs.
#27
What do you restore after a credential is stolen?
You can back up data. You cannot back up trust. When a credential is stolen there is nothing to restore, so the only defense is leaving nothing worth taking behind the wall.
#26
A first-ever national Code Red. For us, a non-event — because we were ready.
The Netherlands hit its first-ever national heat Code Red. Our Amsterdam anchor ran hot and it was a non-event, because a vault that answers from one city on one grid was never the design.
#24
The credential in your app's memory is going to leak
The credentials in your application's memory are readable by any code that runs on the box, and in 2026 that includes the agent. An AI model has already taken root on FreeBSD on its own and broken out of its own sandbox. Stop keeping a resident credential to steal.
#22
Even LastPass couldn't protect its own credentials.
LastPass exists to keep credentials safe, and this month it could not keep its own: a legacy integration credential and OAuth tokens, taken through a third-party vendor. You do not guard a standing credential well enough anymore. You stop having one.
#21
You told your agent to fix the errors. One of them was written by an attacker.
A fake Sentry error report tricks AI coding agents into running an attacker's code at the developer's full privilege, 85% of the time. The injection is not the catastrophe; the standing credentials a hijacked agent can reach are.
#20
Nothing Was Hacked. Everything Was Taken.
Hand an AI agent one leaked low-privilege AWS key and it walks the chain to your customer data in about a minute, unattended. Nothing is hacked and every credential is valid. The economics of a leaked key just flipped.
#19
An AI just found 271 dormant bugs in Firefox. Your credential vault is the softer target.
Mozilla turned an AI agent loose on Firefox and it found 271 unknown vulnerabilities in one run. If a defender's agent can do that, an attacker's can point the same capability at your credential vault, the softer and more centralized target.
#18
You split the work across thirteen agents. Paperclip didn’t split the key.
A scan of a 71,000-star agent framework found twelve of its thirteen agents carrying the same plaintext token. Once you run a fleet of agents, 'the secret lives in the config' stops being a shortcut and becomes a multiplier.
#17
The whole industry just agreed your agent shouldn't see your keys. They're hiding them in the wrong place.
In one week, Claude Code, Hermes, and Codex all shipped fixes to stop agents from seeing raw credentials. Convergent patches are not an architecture: the keys should not live in the harness at all.
#16
AI agents are now phishing targets
EchoLeak (CVE-2025-32711) was the first zero-click exploit against an AI agent: a hidden instruction in an email turned Microsoft 365 Copilot against its own user, no click required. The defense that matters is not catching every prompt injection, it is making sure a hijacked agent cannot reach your credentials.
#15
The Ten Rules of Credential Management
A pass/fail scorecard for any credential system. Ten technical rules, and exactly how Clavitor keeps each one. Most tools fail several.
#12
The malware was signed by Red Hat
This week, credential-stealing code reached developers wearing Red Hat's name. The threat didn't come from outside your circle of trust — it came from inside it. You can't vet your way out of that. You can keep your credentials out of reach.
#11
Our logo is a black box. On purpose.
Every security logo is a shield, a padlock, or a wolf named Trust — a feeling sold as an icon. Ours is a black square, because the product is a black box we can’t read into, and neither can anyone who steals the database.
#7
DigiCert Lost 27 Code Signing Certificates to a Screensaver File
DigiCert, one of the world's largest Certificate Authorities, was compromised by a screensaver file sent through a customer support chat. Their antivirus blocked it four times. The agent kept clicking.
#6
Your AI Coding Assistant Just Read Your Wallet
AI coding tools read .env files before you type anything. Your API keys — each one a credit card without a spending limit — are in someone else's context window before you write your first prompt. The problem isn't the AI. The problem is that secrets are files.
#3
There Should Be Nothing to Harvest
A compromised Bitwarden CLI harvested SSH keys, cloud credentials, and npm tokens from 334 developer machines. The real problem isn't how the malware got in. It's that every secret was sitting there as a plain file, waiting to be read.
#5
634 Passwords in 56 Seconds
A developer went through two rounds of interviews with a fake company. Real website, real faces, real technical conversations. Then they ran the coding challenge. In under a minute, every Chrome password, the macOS Keychain, and crypto wallet data were gone.
#4
Vercel Stored Your Secrets in Plaintext and Called It a Feature
An attacker pivoted from a compromised AI tool through a Google account into Vercel's infrastructure, then decrypted every environment variable not manually marked 'sensitive.' The breach lasted two months before anyone noticed.
#2
View Source, Copy Key, Own Everything
A researcher opened ClickUp's page source, found a hardcoded API key in the JavaScript, and used it to pull 959 email addresses and 3,165 internal feature flags in a single request. The key had no scope, no rate limit, and no expiry.