AI
The Capital One Breach: Machine Identity Abuse
In 2019, ex-AWS engineer Paige Thompson exploited a misconfigured WAF on a Capital One web application. She used server-side request forgery to hit the AWS metadata service at 169.254.169.254. The IMDS returned temporary IAM credentials with access to over 700 S3 buckets. She downloaded records of 100 million people: social security numbers, bank account details. The bank paid an $80 million regulatory fine and settled a class action for $190 million. Capital One learned about the breach from a Twitter tip. Dwell time: four months.
Non-Human Identities: The 50:1 Blind Spot
Non-human identities include API keys, IAM roles, CI/CD tokens, Kubernetes service accounts, and AI agent credentials. They authenticate without human interaction. No MFA possible. They are rarely rotated. In most organizations, NHIs outnumber human identities 50 to 1. The adoption of AI agents accelerates this ratio. Every agent adds more API keys and service accounts. IAM teams audit human access quarterly but often never audit service accounts.
AI Agents as Unwitting Proxies
An AI agent with HTTP request capability becomes an SSRF vector. Prompt injection can instruct it to fetch content from 169.254.169.254. The agent runs the same three curl commands that a human attacker would. It unknowingly retrieves IAM credentials. Das built 11 dedicated detection rules for AI agent attacks. Seven of the ten OWASP LLM Top 10 risks, including prompt injection and excessive agency, are detectable with standard SIEM rules. The same attack chain now runs through a proxy that has no idea it is an accomplice.
Spiffy and Spire: Cryptographic Identity Attacks
Spiffy/Spire replace static credentials with cryptographic workload identities. Each workload gets a short-lived SVID. But research by Eviator Geri (Palo Alto Networks) at Nullcon showed the model can be bent without breaking it. Four attack patterns: selector spoofing (trivially spoofable selectors like Kubernetes node name), SVID harvesting via the Spire agent Unix socket, delegated identity API abuse (acts as a master key), and trust bundle poisoning in federated deployments. Das added 21 detection rules. The demo showed a single process accumulating two identities via the same UID selector.
Detection Pipeline: 100 Rules Across Nine Categories
Das built 100 custom Wazuh rules covering credential discovery, cloud metadata abuse, Kubernetes, CI/CD pipeline attacks, AI agent anomalies, secret pattern detection, Spiffy/Spire workload identity, and bidirectional correlation. 92 Sigma YAML rules can be converted for Splunk, Sentinel, or Chronicle. 30+ MITRE ATT&CK techniques are mapped. Correlation rules chain events regardless of ordering. Example: IMDS access plus credential theft fires at level 12; five or more NHI events from the same source in 10 minutes triggers level 15 (immediate response). The rules are deterministic, auditable, and tested to 96.6% detection coverage.
Compliance and Next Steps
The EU AI Act Article 12 becomes law in August 2026, requiring automatic event recording. ISO 4201 and NIST AI RMF mandate continuous monitoring. Das’s detection rules satisfy all three frameworks. Immediate actions: audit NHIs (count them), enable IMDS v2 (one CLI command), review CI/CD permissions. Long-term: secrets management (stop using env files), least privilege for every machine identity, adopt keyless federation (GitHub Actions, AWS, GCP support it), and add guardrails for AI agents (URL allowlisting, blocked host list). The open-source library includes 100 rules, 92 Sigma rules, 29 attack scenarios, and full compliance mappings.
Notable Quotes
You don’t need an AI to catch AI. You need good well-written rules. Bodhisattva Das · ▶ Watch (32:47)
It’s not really rocket science it’s just input validation we have been doing this for web apps for 20 plus years it’s the same principle just for the AI agents Bodhisattva Das · ▶ Watch (46:25)
And every single one of these things are detectable and preventable. Bodhisattva Das · ▶ Watch (6:37)
The rules and the AI aren’t really competitors. They are complimentary. Bodhisattva Das · ▶ Watch (32:55)
This is not a promise. This is the plan. Bodhisattva Das · ▶ Watch (48:52)
Key Takeaways
- NHIs outnumber humans 50:1 and are the largest unmonitored attack surface.
- Assume breach and detect early using deterministic SIEM rules, not black-box AI.
- Least privilege, secrets management, and AI agent guardrails are non-negotiable for compliance.
About the Speaker(s)
Bodhisattva Das is a Security Engineer at Rudra Cybersecurity, focused on securing non-human identities, AI agents, and automated workloads across cloud environments. He specialises in open-source threat detection using Wazuh, and builds practical solutions for identity governance and AI-driven security operations. Driven by a passion for digital rights and responsible AI governance, he strives to build secure systems that protect people as technology evolves. Outside of work, he enjoys traveling and exchanging ideas with global tech communities.