Brain Cells Use Tiny Mobile Vaults to Shuttle RNA, Potentially Shaping Memory
Start with the number, because it's a good one: 81 million. That's how many Azure login attempts one threat actor fired off between June 12 and 26, compromising at least 78 Microsoft accounts across 64 organizations. But the scale isn't the story. The *how* is.
The attacker went in through the Azure CLI — and abused a deprecated OAuth flow called ROPC (Resource Owner Password Credentials). ROPC exchanges a raw username and password directly at the token endpoint and mints an access token with no interactive step — so it never touches the authorization endpoint where your Conditional Access and MFA policies actually live. The result is the part that should keep you up: organizations that *had* MFA got breached anyway, because they'd scoped it to specific apps or admin groups instead of all cloud apps and all client types — so it simply never fired for CLI logins. The credentials themselves were old username/password pairs from prior breaches that nobody ever rotated.
And who lives in the Azure CLI? DevOps, cloud admins, service principals — exactly the identities holding keys to storage, Key Vault, and CI/CD. This wasn't smash-and-grab. It was hunting for the accounts with the most reach and the least protection.
That's the spine of the whole day: the controls we built for humans-in-browsers don't cover the machine-identity paths that now run everything. And 2026 is the year everything became a machine-identity path. Once you see it, the rest of today's news is the same story from different angles.
Frontier models are now gated resources, not URLs. Anthropic's Fable 5 came back online this week after its export-control saga — but look at *how* it came back. Vercel announced Fable 5 access restored on its AI Gateway; AWS published a piece literally titled *Safely Releasing Frontier Models to Customers*. The model isn't something you curl anymore — it's a capability sitting behind an access layer with its own policies, classifiers, and routing. That's the identical architectural move as locking down the CLI: put a governed gateway between the caller and the capability. If you build on hosted models, your gateway config is now part of your security posture, not just your latency budget.
Agents are new identities you haven't governed yet. This is where it gets urgent, because today's agent releases are *all*, quietly, access-control stories. AWS shipped a serverless A2A gateway for agent discovery, routing, and access control — because agents now have to find and authenticate to each other. AgentCore added structured memory filtering so agents only retrieve what they're scoped to. Google Cloud opened a Claude apps gateway. Every one of these is a new non-human identity with credentials, permissions, and a login path. If your MFA didn't cover the Azure CLI, ask what covers your agents' service principals. Ben Lorica made the same point from the capability side this week — *agents need maps, not bigger context windows* — and he's right: the hard part was never the model, it's the structure around it. (AWS's HippoRAG, running personalized PageRank over a knowledge graph in Neptune, is that structure done well — retrieval that knows *where* things are, not just a bigger pile of context.)
And the money says: multiply the surface. The biggest business story of the week fits the same frame. Together AI raised $800M, led by Aramco Ventures with Nvidia participating, at an $8.3B valuation, on $1.15B in annual bookings, planning to grow capacity roughly 50-fold over five years. Read past the headline. The thesis investors are funding is that enterprises will route inference through neoclouds running open models — DeepSeek, Nemotron, MiniMax, Kimi — instead of paying closed-API premiums. Great for cost. But every new inference provider, every gateway, every open model you self-host is one more identity boundary, one more credential set, one more login path someone forgot to put MFA on. The open-source shift and the identity-sprawl problem are the same trend wearing two hats.
The defensive response showed up too, and it's the unglamorous kind that actually works. Artemis Security reported running detection queries 69× faster on ClickHouse Cloud — which matters precisely because Huntress measured credential-spray volume up more than 155× in six months. You cannot investigate 81 million login attempts on a dashboard that takes 40 seconds a query. The teams that win here are the ones whose detection layer can scan the whole haystack in real time.
The kicker. One of the day's quieter posts came from quantum startup Diraq, titled *Quantum Computers Are Boring.* It's a brag — boring means mature, reliable, unsurprising. And that's the actual lesson of the week. The exciting stuff — new models, $800M rounds, agent swarms — isn't where you get breached. You get breached in the boring layer: the login path nobody audited, the CLI outside the MFA scope, the service principal with a 2023 password. Make your identity plumbing boring. That's the whole brief.
One thing to do today: pull your Conditional Access policies and confirm MFA is scoped to *All cloud apps* and *All client app types* — not just browser sessions. Then go find every service principal and agent credential that authenticates without it. That's where the next 78 accounts come from.
Sources covered
1 story · 23 sources (2 news, 18 company, 3 voices)