N014: Microsoft says China-aligned hackers aimed AI agents at 2,250 tenants through ConnectWise
Microsoft says China-aligned Storm-0940 used AI agents and ConnectWise's app identities to hit 2,250+ Microsoft 365 tenants, and a backdoored LiteLLM release stole AI keys.
N014 · Thursday 22 October 2026 · 5-min read · Covers 21 Oct 10:00 UTC to 22 Oct 11:00 UTC
Jump to: Incidents · Agent threats & vulnerabilities · Policy, protocols & compliance · Architecture & harnesses · Models & infrastructure · Defenses, tools & GitHub · Pro deep dives
Today in 30 seconds
- Microsoft says China-aligned Storm-0940 used ARTEX AI agents and hijacked ConnectWise app identities to sign in to 2,250+ Microsoft 365 tenants, reaching admin in some within 3 hours.
- A backdoored LiteLLM 1.107.0 stole coding-agent credential files and the AI provider keys stored in LiteLLM proxies.
- Claude Code 2.1.305's MCP allowlist no longer blocks some managed stdio servers; add explicit deny rules before upgrading.
Top story
China-aligned hackers used AI agents and a backup vendor's app identity to reach admin in Microsoft 365 tenants
21 Oct 2026 · Microsoft Threat Intelligence · Incident · Storm-0940 · no CVE · Relevance 10 · Capability shift
Hackers used AI agents to log in to thousands of companies' Microsoft 365 accounts as a trusted backup app, sometimes becoming administrators. Microsoft assesses Storm-0940 controlled several ConnectWise app identities and, from 15 Oct, tried 2,250+ tenants at about 2,900 sign-ins a minute using consent customers had granted, with no user sign-in. One app gave itself Global Administrator. Most targeting failed.
New risk for leaders: agents now abuse vendor-app trust at machine speed; user MFA misses app-only sign-ins, but app-permission reviews still work.
For leaders: ask which outside apps hold admin rights in your tenant, and who would notice one granting itself a role.
For builders: search service-principal sign-ins for the ConnectWise app IDs from 1 Oct; alert when apps add credentials or roles.
Incidents
Backdoored LiteLLM 1.107.0 stole coding-agent logins and the AI keys stored in its proxy
21 Oct 2026 · StepSecurity · BerriAI/litellm#47826 · Supply-chain incident · no CVE · Relevance 9
A popular tool that routes requests to AI models was briefly replaced with a version that stole passwords and AI keys. For about two hours, PyPI wheels and Docker images ran a .pth file that took cloud, SSH and coding-agent credentials and, on proxies, the provider keys in LiteLLM's database.
Do this: if anything pulled 1.107.0 or latest on 21 Oct, rotate stored provider keys and host credentials; pin 1.106.2 by digest.
Also:
- Unit 42 BUGSTER: a lone criminal ran a jailbroken Hermes Agent on DeepSeek V4 and a sandbox-bypassed Cursor to steal 5,200+ university records.
Agent threats & vulnerabilities
MCP's TypeScript server SDK sent one client's responses to another client
Listed 20 Oct 2026 · GitHub advisory · CVE-2026-111770 · GHSA-jm63-cq47-j5jp · CVSS 7.7 · Relevance 7
A common building block for AI tool servers could hand one user's results to another. In @modelcontextprotocol/server 2.0.0 to 2.2.0, a server instance shared across HTTP clients matches replies only by JSON-RPC id, which every client starts at 0.
Do this: upgrade to 2.3.0 and create one server per request or session; the upgrade alone breaks shared instances.
Policy, protocols & compliance
Also:
- Japan (Final): government AI agents need limited rights, human approval for high-impact steps, logs and a stop switch; binding on US vendors selling to ministries.
- EU (Draft, comments close 9 Nov): AI Office information requests could restart the 5-year clock on AI Act fines, including for US model providers.
Chart of the day
Chinese labs drew at least 44% of OpenRouter requests in the week of 12 Oct
DeepSeek
OpenAI
Z.ai
Qwen
Anthropic
Xiaomi
Meta Llama
Source: OpenRouter rankings, share of text requests by model maker, week beginning 12 Oct 2026 (primary). Orange = Chinese labs (44.3% together); "Others" (8.6%) not shown. Requests on one gateway, not spend.
Architecture & harnesses
Claude Code 2.1.305 loads MCP servers your allowlist used to block
20 Oct 2026 · v2.1.305 release · Harness release · no CVE · Relevance 8
An update to Anthropic's coding assistant lets some company-installed tool servers run that admins thought were blocked. allowedMcpServers no longer filters managed stdio servers using ${VAR} only in env; a new opt-in, allowNestedUserNamespaces, bypasses sandbox file protections.
Do this: before upgrading, add deniedMcpServers entries, keep the namespace opt-in off, and log 2.1.307's safety_event.
Also:
- Claude Duet: Anthropic's background agent gets its own VM, 6,000+ connectors and payments, asking approval before it sends, pays or signs.
Models & infrastructure
AI-found PHP flaws: GPT-5.6 Sol found one, and attacks followed the patch
21 Oct 2026 · OpenAI · php.net · CVE-2026-109618 · CVE-2026-109619 · Relevance 8
AI models helped find two serious flaws in PHP, which runs much of the web, and attacks followed quickly. Calif used GPT-5.6 Sol; The Register reports public exploits after an early patched-image release.
Do this: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, including in agent sandboxes and base images.
Defenses, tools & GitHub
Decoy text aimed at attacking AI agents cut cloud breaches from 70 of 71 runs to 13 of 70
21 Oct 2026 · Tracebit · Research · self-reported · Relevance 7
Planting fake clues for AI hacking tools made most fail in a test cloud. Tracebit aimed nine "context bomb" decoys, like a fake pentest report, at seven models in AWS.
Do this: seed canary credentials and decoy documents where attacking agents look; alert on use.
One concept
Multi-tenant app consent
An approved vendor app gets its own identity in your Microsoft 365 or Google tenant and signs in without any user. Whoever controls its credentials inherits that access in every customer tenant.
Basic mitigation: review admin-consented apps quarterly, remove unused ones, and alert when an app adds credentials or roles.
AgentSec Brief is published by AM Technology Solutions. Researched and drafted with AI agents, verified against primary sources, and reviewed before publication. Informational only; not legal, compliance or security advice. Verify before acting.
Pro members get the full deep dives with attack diagrams, detection queries and the fix in order, plus the vulnerability tracker, compliance calendar, open-source picks and watch list. Upgrade at https://www.agentsecbrief.com/#/portal/signup