Delinea Labs September 2026 Threat Outlook
In this monthly series, Delinea Labs breaks down the identity-related incidents that had the greatest operational impact over the previous month: how attacks unfolded, what failed in real environments and what those failures signal for the month ahead.
On August 13, Taiwan's Ministry of Digital Affairs disclosed that overseas attackers had run AI agents alongside conventional techniques against government agencies. What made it a defining moment wasn't a new attack technique. Agents chained multiple methods in sequence and used backup and test systems as stepping stones, making the operation faster, cheaper and easier to scale.
AI didn't replace the attacker. It gave the attacker machine speed
Here's Delinea Labs' outlook for September.
Recent threat outlooks have shown that the identity population extends well beyond humans. Now we’re learning what happens when AI agents begin operating through those non-human identities (NHIs) with increasing autonomy.
An autonomous agent that can enumerate accounts, test credentials, find weak systems and pivot between environments only needs an identity to assume. That makes identity governance the boundary that determines how far the agent can go, and that boundary must hold at runtime, not only at the moment when the agent is created or authenticated.
Agent containment is now an identity control
Anthropic spent August responding to a finding that Claude models had gained unauthorized access to real organizations during cybersecurity evaluations. Three incidents occurred across more than 141,000 evaluation runs, caused by evaluation environments that were incorrectly connected to the internet.
These were not malicious campaigns. They were a clear demonstration that the boundary around an autonomous agent is only as strong as the permissions, infrastructure and network access surrounding it. The questions are familiar:
What can the agent reach?
Which credentials can it use?
Which actions is it authorized to perform?
How fast can that authority be revoked?
Developer environments are credential aggregation points
A disclosure in the August Delinea Labs report detailed the scale of the LiteLLM compromise. The compromise began with Trivy, which was consumed by LiteLLM's CI pipeline. That upstream compromise exposed LiteLLM credentials and enabled attackers to publish two malicious releases of the widely used open-source AI gateway.
Exposure spanned more than 2,500 companies and an estimated 434,000 continuous integration/continuous deployment (CI/CD) pipelines, with terabytes of exfiltrated credential data: cloud keys, Secure Shell (SSH) keys, Kubernetes tokens and AI provider API keys. One trusted tool opened access far beyond the workstation that ran it.
Shai-Hulud returned, and the target is still the secrets
JFrog identified more than 400 compromised npm packages across more than 1,700 versions in the August variant, including popular caching packages such as keyv and cacheable. Package installation runs inside environments holding repository credentials, cloud secrets, signing material and automation tokens. The objective is rarely the package itself. It's the identity material sitting next to it.
Authentication bypass keeps surfacing inside identity infrastructure
August brought flaws in the systems responsible for enforcing identity (covered below). The pattern connects straight back to June and July: When validation fails, the mechanism built to establish trusted identity becomes the way in.
August recorded 12,022 common vulnerabilities and exposures (CVEs). Of those, 1,378 were identity-related and 84 directly affected identity products.
Four CVEs from August's dataset are worth specific attention:
CVE-2026-12263. ManageEngine Password Manager Pro and PAM360. An authentication bypass lets an authenticated user log in as another user. A flaw that allows one identity to assume another's access breaks the exact trust boundary that a Privileged Access Management (PAM) platform exists to enforce.
CVE-2026-7557. Progress MarkLogic Server. The Security Assertion Markup Language (SAML) authentication module improperly verifies cryptographic signatures, allowing an unauthenticated remote attacker to impersonate arbitrary users, including administrators, wherever SAML single sign-on (SSO) is enabled. The application accepts an identity assertion that it should reject.
CVE-2026-8715. HashiCorp Vault Secrets Operator. A Kubernetes tenant with limited role-based access control (RBAC) permissions can abuse the AppRole configuration to read arbitrary files from the operator pod and send them to an attacker-controlled endpoint. HashiCorp notes that exposed material can include credentials and may enable privilege escalation inside the cluster.
CVE-2026-40144. A memory corruption flaw affects a Windows kernel-mode component of BeyondTrust Endpoint Privilege Management and can be triggered by a low-privilege user. Endpoint privilege management sits directly on the line between standard-user activity and administrative execution, making vulnerabilities in this enforcement layer particularly relevant to identity security.
Qilin led August with 16% of claimed victims, followed by TheGentleMen at 11.5% and CL0P at 4.5%. August again showed that ransomware does not need technical novelty to scale. Compromised credentials, exposed remote access and privileged accounts remain the shortest route from initial compromise to enterprise-wide impact.
The groups leading the month didn't need a new exploit. They needed an account
Give every AI agent an identity you can inventory and revoke. If an agent can authenticate, act and pivot, it needs a named owner, a defined scope and a fast path to revocation, not a standing service account that outlives the task it was created for.
Authorize agent actions at runtime, not just at onboarding. The Taiwan intrusion showed agents adapting their paths during the operation. An access decision made once at authentication can't see what the agent does 40 steps later.
Treat build pipelines as credential stores. LiteLLM and Shai-Hulud both turned a software supply-chain compromise into an identity compromise. Inventory which secrets are reachable from a package install, then remove the ones that have no reason to be there.
Patch and review your identity platforms first. ManageEngine, MarkLogic, Vault and BeyondTrust all sit at enforcement points. An authentication bypass in that layer bypasses the control you were counting on.
AI changes the speed and scale of an attack, but identity still determines how far it can go.
The Delinea Platform, powered by Delinea Iris AI, continuously discovers identities, analyzes privilege risk and enforces access control at the moment of execution across AI agent, human and machine identities. Runtime authorization extends that enforcement to the action itself, evaluating individual commands and queries inside a session rather than only the session that carries them.