Every secret scanner hands you a big number, and almost nobody can act on it. When we verified each finding against the service that issued it, a five-figure detection count became a three-figure inventory of credentials that actually work. This is what that collapse means for how you prioritize, what you suppress, and what you tell your board.
We spent six months documenting why non-human identity (NHI) security fails in real organizations, from bug bounties that call leaked keys "out of scope" to the nine-part NHI Kill Chain. Argus is the product we built from what that research proved.
Every agent action is a credential action, and the industry is treating a governance shift as a provisioning task, exactly the way it did with service accounts.
The Korean GitHub token leaks and CISA's public-repo exposure were both filed as secrets leaks. What got out was not a file but a live identity. This piece argues that security leaders should treat API keys as identities and shift the defense from prevention rate to how fast you detect what has already leaked.
A leaked Slack incoming webhook is usually triaged as low severity: write-only, one channel, no data access. The moment an AI agent reads that channel and can act with tools, that write-only primitive becomes an indirect prompt injection path into the agent's privileges. Here is the full kill chain, the exact preconditions, and how to defend it.
Between 01:39 and 02:56 UTC on May 19, 2026, two tight publish bursts placed 639 malicious versions across 323 packages on npm. The single stolen `atool` session was only the entry point. The payload's worm logic harvested every additional maintainer npm token on the infected host and republished under those identities, which is why the wave spans 30 publisher handles. Cremit Argus surfaced 324 catches within thirty minutes via an OSV-MAL override path that intentionally bypasses LLM agreement for OSSF-flagged events. This article documents the attack structure, the detection methodology, and the false-positive trap that nearly slipped past during initial analysis.
Eight types of dangerous NHI credentials. One framework to find, classify, and eliminate them all. The complete NHI Kill Chain series summary with Cyber Kill Chain and MITRE ATT&CK mapping.
On April 22, 2026, the official @bitwarden/cli@2026.4.0 npm package was malicious for ~90 minutes. A self-propagating worm exfiltrated AWS, Azure, GCP, GitHub, npm, SSH, and AI tooling credentials from CI runners. Vaults stayed safe. CI tokens did not. Timeline, NHI kill-chain mapping, and a 10-minute checklist to know whether you were affected.
Vercel confirmed an unauthorized-access incident on April 19, 2026 that started in a third-party AI tool, pivoted through Google Workspace, and reached environment variables in a subset of customer projects. The exposure surface is every env var that was not marked sensitive. Here is what is confirmed, what is noise, and what to rotate first.
A new CISO ordered a full NHI audit. The result: 3,400 active credentials, 60% with no identifiable owner. Can't revoke them, can't rotate them, can't assign responsibility.
A PostgreSQL master password drifted across seven platform types, from Secrets Manager to GitHub, Jenkins, Docker Hub, Jira, Confluence and Slack. Each security tool saw its own silo. None saw the full picture.
An organization's core credentials sat in public repositories for years. The security industry's answer: "Out of scope."
Secret scanning alert: Resolved. Credential status: Active. Deleting a secret from code is not the same as revoking it. Inside the Zombie Key kill chain.
A single Stripe API key was copied to 14 locations over three years. When a QA repo went public, the key was exposed, and revoking it meant breaking 14 services at once.
A single AWS key, never rotated for 3 years, spread across 7 systems. When a supply chain attack hit a Terraform CI plugin, the key gave attackers full infrastructure access. Inside the Aged Key kill chain and how to defend against long-lived credentials.
A single production outage left credentials in six non-code platforms: Slack, Jira, Confluence, Sentry, Datadog and PagerDuty. Your secret scanner found none of them. Inside the Shadow Key kill chain.
A departed developer's AWS key stayed active for 92 days. When an infostealer hit their personal laptop, the key was sold on the dark web. Inside the Ghost Key kill chain and how to defend against orphaned credentials.
Aqua Security's Trivy was compromised by TeamPCP, cascading into LiteLLM. A 7-phase Cyber Kill Chain and MITRE ATT&CK analysis of how incomplete credential rotation turned a single breach into a five-ecosystem catastrophe.
A .env file pushed to a public GitHub repo is found by attacker bots in 4 minutes. We map the full kill chain, from credential exposure to infrastructure compromise, and show how to detect and respond before the damage is done.
A prompt injection in a GitHub Issue title hijacked Cline's AI triage bot, stole npm tokens, and silently installed a rogue AI agent on 4,000 developer machines. The era of AI-installing-AI supply chain attacks has arrived.
The Cremit team's report on identity and detection trends for 2025, available to download in full.
Why service accounts and API keys end up with more privilege than they need, and how A2A and MCP raise the stakes.
Lifecycle management and scheduled rotation leave a window open. What continuous detection covers inside it.
Research puts NHIs at roughly 46 per person, and 45 times the human count in DevOps. What weak authentication costs at that scale.
Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication are redrawing the NHI security boundary. What changes when AI agents become first-class identities in your infrastructure.
Human and machine accounts are issued, owned and revoked differently. Where a single process for both leaves gaps.
A GitHub Action used by more than 23,000 repositories was altered and its version tags retagged, leaking CI/CD secrets into build logs. The incident read as an NHI failure.
Secrets enter a codebase through a short list of familiar routes. What to check on each one.
Service accounts and tokens that outlive their purpose are the easiest targets in the estate. What OWASP NHI1:2025 says about offboarding.
S3 buckets accumulate the machine roles, automated services and API keys that read and write to them. Cremit now scans those buckets continuously with read-only access and returns the inventory.
Building secret detection or buying it. The factors that actually decide it, one at a time.
Bybit lost 401,347 ETH, about $1.4 billion, on February 21. How the attack worked, and what it changes for exchange security.
OWASP NHI2:2025 covers API keys and tokens ending up in stores that were never meant to hold them. Where they leak, and how to stop it.
Third-party integrations reach into your resources with credentials you never issued. What OWASP NHI3:2025 covers, and where the exposure sits.
Six practices for keeping credentials out of reach: vaulting, least privilege, rotation and the rest.
Regex-based scanners miss credential formats nobody told them about. What Probe, Cremit’s detection engine, does differently.
OWASP NHI Top 10 names the machine-credential risks most teams still do not track. Here is what each threat means, and how each maps to real controls you can deploy.
A conversation with the team at ENlighten, a Korean energy IT platform, about how they manage credentials and secrets and what led them to Cremit.
Secret sprawl stopped being a password problem and became an identity one. Where credentials accumulate, and what detection actually reduces.
We use cookies to measure traffic and ad performance. Declining costs you nothing: the site keeps working, and all that stays is your language and this answer. Everything we load is listed in the cookie policy