Skip to main content

Blog

Category

Written by

Robert Erenberg-Anderson

CTO & Co-founder, Crowsnest

Your AI tools have keys. Do you know where they are?

ConnectWise and OpenCode show how third-party machine credentials skip MFA and audit trails. Five questions CISOs should ask about AI keys and vendor access.

October 22, 2026

-

-

Min Read

‍What ConnectWise and OpenCode tell CISOs about machine identities

‍
Facts as reported through October 21st, 2026. Both incidents are still under investigation.

In three weeks I will be in Lisbon for Web Summit. This year its cybersecurity track runs under the theme "machines versus machines" (Web Summit). Last week gave us two clear examples of what that means in practice. Neither involved a person typing a password.

Two incidents, one pattern

ConnectWise Cloud Backup. On October 15, a credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was used to sign in to customer Microsoft 365 tenants and collect access tokens. Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16. In one tenant, a related ConnectWise app made itself Global Administrator and added new secrets to other apps (Huntress). ConnectWise has disabled the affected app identities and suspended the service while it investigates (ConnectWise).

OpenCode Console. On the night of October 16, an intruder reached a legacy system at OpenCode, maker of an AI coding tool. OpenCode told the affected 1.4% of its hosted Console users to revoke and replace the OpenAI, Anthropic and Google keys they had saved there (The Hacker News). OpenCode says the keys "may have been exposed" and has not confirmed that any were copied or used. Some users report unauthorized charges, with one user putting the loss at $1,700 (The Hacker News). OpenCode's email to affected users mentions possible reimbursement (BleepingComputer).

One is a backup tool. The other is an AI tool. The shared story is the credential: a machine identity, held by a third party, with standing access, and no person involved when it is used.

Both companies moved quickly to tell customers what to do. The lesson here is not about them. It is about how all of us manage this kind of access.

What machine credentials skip

These credentials bypass the controls most security programs are built around.

  • No MFA. App-only sign-ins involve no user and no device, so there is no MFA prompt to stop them (Huntress).
  • A thin trail. Some Microsoft Graph reads leave no audit record (Huntress).
  • Your off switch may not be the real one. Deleting a key from OpenCode Console does not revoke it, and a Console budget cannot cap its use, because Console only sees requests that pass through its own gateway. The key has to be revoked at the AI provider (The Hacker News). In the ConnectWise case, disabling the vendor apps did not remove secrets already planted on other apps.

Scale makes this harder. The Cloud Security Alliance, citing Entro Security research, says non-human identities now outnumber human users in the enterprise by an average of 45 to 1 (Cloud Security Alliance). Many were approved once, by someone who, potentially, may no longer still be employed by your organization.

The policy is fine. The evidence is missing.

Almost every security leader I talk to has a policy for third-party access and secrets. Least privilege. Rotate keys. Review access every quarter. But a quarterly review tells you what was true on the day someone looked. In one ConnectWise tenant, the whole sequence from Global Admin to planted secrets took about five minutes.

So the useful question for a CISO is not "do we have a policy?" It is "could I show my board, today, that the policy is being followed?"

Five questions for your next leadership meeting

  1. How many third-party apps and AI tools hold standing access to our core systems, and who owns each one?
  2. Which of them can change permissions or credentials for other apps?
  3. Where do our AI provider keys live, including copies held by hosted tools? Does each tool have its own key, with a spend limit set at the provider?
  4. How fast could we revoke and replace every credential tied to one vendor? Have we tested it?
  5. If a vendor told us tomorrow that its credential was stolen, what could we prove within 24 hours about what that credential did in our environment?

That last question matters more in Europe every month. Since September 11, manufacturers covered by the EU Cyber Resilience Act must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, and a full notification within 72 hours (European Commission). Reporting clocks are getting shorter, and machine identities are where the facts are hardest to find.

Where Crowsnest fits

At Crowsnest we turn security logic into automated controls against real systems and provide continuous evidence of whether controls are working. Rules like "every machine credential has an owner" and "no third-party app holds admin rights" are exactly the kind of policy that should be checked all the time, not reviewed once a quarter.

Let's talk in Lisbon

We will be at Web Summit at the MEO Arena and FIL in Lisbon, November 9 to 12. If you are working through machine identities, AI tool sprawl, or third-party access, I would like to hear how your team handles the evidence today. Come by our booth or book time with me: https://calendar.app.google/usXe3A5Har3dWMrf9

Sources

‍

Read More

Featured Articles

No items found.

Prove your systems are doing their job

See how Crowsnest helps security teams uncover blind spots, validate coverage, and prove what their stack is doing.