Sandeep Padam

Your AI agents have credentials. Who governs them? Practical takes on identity security for humans, bots and agents.

[Sandeep Padam @SandeepPadam1]

1/6
PHP2Shell is the patch-today story of the week.

Two critical flaws (CVE-2026-109618, CVE-2026-109619) let an unauthenticated request run code on PHP servers. A proof of concept is public. Here's what to do, plus the step most teams skip

[Sandeep Padam @SandeepPadam1]

@SecurityWeek A model writing its own network code to escape a sandbox is why agent controls can't rely on the agent behaving. Enforce limits outside the model: network policy, scoped credentials, and logs it can't touch.

[Sandeep Padam @SandeepPadam1]

@SecurityWeek Certificate authorities are identity infrastructure for the whole internet, so even 'business customer info' matters. Expect targeted phishing aimed at cert admins next. Worth warning those teams now.

[Sandeep Padam @SandeepPadam1]

@lydiahallie @theonejvo @DarioAmodei @Boris @TheAmolAvasare @bcherny Appreciate the clarity. The lesson most teams can take from this: your exposure includes every SaaS tool your staff use, and the access those vendors hold. Third-party identities need real monitoring.

[Sandeep Padam @SandeepPadam1]

@CSOonline The governance gap with AI is mostly an identity gap. If an agent can move funds, it needs its own identity, tight scopes, and a human approval step for anything high value. Basic, but rarely done.

[Sandeep Padam @SandeepPadam1]

@SecurityWeek Auth bypass in OpenSSH is a good moment to check how many machines still accept SSH from anywhere. Putting SSH behind identity-aware access shrinks the blast radius of bugs like this a lot.

[Sandeep Padam @SandeepPadam1]

@TheRegister Agents trading tokens for help from other bots is social engineering, just aimed at software. Any agent holding real credentials needs scoped, short-lived ones, because it will be tricked eventually.

[Sandeep Padam @SandeepPadam1]

@PaloAltoNtwks 'AI needs access, access needs boundaries' is right. The practical test: can you list every agent, what it can reach, and who owns it? If not, the boundaries exist on paper only.

[Sandeep Padam @SandeepPadam1]

@SailPoint That 89% vs 99% gap is the real story. Most teams can count their service accounts; very few can say which agents act on whose behalf. Ownership is the first control to fix.

[Sandeep Padam @SandeepPadam1]

@BleepinComputer Another one through a service provider. Third-party access is still the weakest identity in most banks: broad, long-lived, and reviewed once a year if at all. Vendor accounts deserve the same scrutiny as admins.

[Sandeep Padam @SandeepPadam1]

@TheHackersNews MFA bypass with 'valid alternate credentials' is the reminder that MFA is only as strong as every other way in. Worth auditing which accounts on your VPN can still authenticate without the SAML path.

[Sandeep Padam @SandeepPadam1]

@GitGuardian @MsftSecIntel @github @Azure Five minutes from a public GitHub secret to an Azure tenant is the whole argument for short-lived, scoped credentials. A key that expires in an hour is a much worse prize than one that's been valid since 2023.

[Sandeep Padam @SandeepPadam1]

@MsftSecIntel The common thread in these ARTEX cases is speed. Exposed upload paths and SSRF aren't new, but an agent chains them in minutes. Patch windows and credential rotation built for human attackers won't keep up.

[Sandeep Padam @SandeepPadam1]

@patopet Agree. The quiet win here is identity: if every request has to come from an authenticated, scoped caller, an attacker's agent has nothing to talk to. Most orgs still have far more anonymous endpoints than they think.

[Sandeep Padam @SandeepPadam1]

6/6
The bigger lesson: agent folders like .claude, .cursor and .gemini are the new .env. Any agent config that can hold a credential belongs in your secrets inventory and scanning.

Source: https://t.co/lcEk4GxSvH

#IdentitySecurity

[Sandeep Padam @SandeepPadam1]

1/6
Claude Code's "Yes, and don't ask again" can save the exact command you approved, password included, in .claude/settings.local.json. Apiiro found 1,122 public copies of that file on GitHub holding at least one secret. This is an identity problem, not a coding one.

[Sandeep Padam @SandeepPadam1]

5/6
What I'd do this week:
- Search your org for .claude/ settings files, including git history
- Rotate every credential they ever held, then clean up
- Approve command patterns, not exact commands
- Pull secrets from a vault as variables like $DB_URL

[Sandeep Padam @SandeepPadam1]

@changgaowei Thanks for sharing. Binding the grant to the agent's own identity instead of the customer's session is the right split. How are you handling revocation? If the customer pulls consent, does every live token die with it, or only new ones?

[Sandeep Padam @SandeepPadam1]

1/6
Major US banks are now blocking third-party AI agents that log in with customers' own usernames and passwords, per Reuters and Axios last week.

This is an identity problem before it's an AI problem. A short thread