Credentials Are Not Authority: Three Incidents, One Missing Layer

Three developments this month read like three unrelated stories: a regulator logging a breach notification, a browser security disclosure, and a case study buried in a vendor report. Read together they describe one failure with three faces. In every case the system could establish who was acting. In no case could it establish what a human had actually authorised.

A Regulator Logs the First Agent-Executed Breach

On 14 September 2026 the Agencia Española de Protección de Datos published the first notification it has received of a personal data breach in which the attack was executed by an AI agent built on a well-known language model.¹ According to the AEPD account, the agent completed a valid login, then autonomously searched the application for vulnerabilities, found one, modified personal data and accessed invoices.

The attribution deserves care. The AEPD states that its findings remain subject to analysis, and that the use of a particular model does not imply the model or its provider infrastructure was compromised. The agentic execution should be read as reported, not as conclusively established. What makes the notification significant does not depend on that question resolving either way: an autonomous-agent incident has entered a data protection regulator's incident pipeline, with the reporting obligations and documentary record that implies.

The AEPD response is unusually relevant to the delegation problem. The agency singles out digital identities and credentials as increasingly decisive, on the grounds that an agent which obtains an account, an API key or a token carrying excessive permissions can traverse services at machine speed and reach several systems before anomalous behaviour is detected. Human supervision remains essential, the agency says, but it has to be backed by detection, containment and response mechanisms capable of operating at comparable speed. Security of processing cannot depend on manual intervention alone.²

A valid login answered the question “can this identity access the application?” It did not answer the question “what human delegation authorises this sequence of actions?” Those are different questions, and in most production stacks only the first one has an answer at all.

BragJack: A Trusted Agent Taking Untrusted Instructions

The second development shows the same gap from the opposite side. Researcher Gal Weizman of Forever Security disclosed BragJack, a set of vulnerabilities affecting agentic functionality in Chrome with Gemini, Microsoft Edge, Opera Neon, Perplexity Comet and Claude in Chrome.³ The individual bugs differ by product. The architectural weakness they share does not.

Each of these products splits the agent between a component inside the browser and a reasoning service on the vendor infrastructure, and the in-browser component accepts instructions only from pages it treats as trusted. BragJack crosses that boundary. An untrusted browser extension, holding two permissions that extensions routinely request, can inject its own code into the trusted page and address the privileged agent as though it were the vendor.⁴

The demonstrated consequences varied by product and included reading local files, taking screenshots, acting on authenticated websites as the user, leaking browser profile data, and in the Chrome case activating the camera and microphone.⁵ Google assigned CVE-2026-0628 and Microsoft assigned CVE-2026-55945; both have shipped fixes. The remaining three vendors paid bounties without publishing patch timelines. As of mid-September there is no public evidence of exploitation in the wild.

So the security question is not which authenticated agent executed this action. It is who authorised this specific action. A privileged execution boundary that accepts “a trusted agent requested action X” as sufficient evidence has no way to tell the two apart. It has to evaluate the provenance attached to the request before it releases a protected resource.

Mandiant: Nothing Malicious Has To Happen

The third development removes the attacker entirely. The Mandiant AI Risk and Resilience Report 2026, published by Google Cloud, documents a case study it labels denial-of-wallet.⁶ A financial services enterprise deployed an agent to reconcile accounting ledger anomalies and granted it direct read and write access to internal billing databases. A corrupted null value broke one of the agent's tools. The agent responded by entering an unconstrained recursive reasoning loop, attempting to brute-force its way past the failure.

Mandiant recommends financial circuit breakers, bounded recursion limits and real-time rate limits, enforced at the service identity and project level rather than left to the agent.⁷ Nothing in the sequence was an attack. The agent was correctly authenticated. Its delegation was legitimate and its task was the one the business intended. It still became operationally dangerous, because the delegation carried no bound on what executing it was permitted to consume.

The Same Gap, Three Times

Set the three side by side and the pattern is hard to miss. In Spain, valid credentials were not legitimate authority. In BragJack, a trusted agent identity was not trusted instruction provenance. In the Mandiant case study, legitimate authority was not unlimited execution authority. Each incident failed at a different point on the same chain, and each one failed because the chain stops early in almost every deployment.

Identity is where agentic security investment currently ends. An agent gets a service account, a scoped token, perhaps a workload identity, and the architecture treats the resulting authentication as if it settled the authorisation question. The three incidents show three different ways that inference breaks.

Delegated Authority Should Not Imply Unlimited Resource Authority

Human Delegation Provenance, the protocol Helixar has published as an IETF internet-draft, exists to make the provenance layer independently inspectable.⁸ It does not replace identity and access management, and it does not make the policy decision. It supplies the delegation record a policy engine needs in order to answer a question credentials cannot: not which identity is acting, but which human mandate this action is executing under, and what that mandate excluded.

HDP-P extends the same provenance into enforcement at boundaries where the action cannot be undone. The Mandiant case study is the clearest public illustration yet of why that enforcement layer needs a resource dimension as well as a permission dimension. A recursion limit, a spend ceiling and a call-rate ceiling are authority statements. They belong in the delegation, and they belong at a boundary the agent cannot reason its way around.

What Defenders Can Do Now

None of this requires a new protocol to start on. Five changes are available today.

• Inventory agent credentials by blast radius, not by count. Treat any token that can traverse several services as an unresolved delegation question rather than an access control success.
• Treat every instruction channel into an agent as untrusted input. That includes the channels inside the trust boundary, which is precisely where BragJack lived.
• Give every autonomous execution an explicit budget. Spend, call rate, recursion depth and wall-clock deadline, enforced outside the agent, because an agent in a pathological loop cannot be relied on to enforce its own limits.
• Write the authorisation decision before the action runs. A log of what an agent did is not a record of what it was permitted to do.
• Make containment automatic. This is the AEPD point restated: a response procedure designed for a human attacker moves at the wrong speed for this one.

Defender Takeaway

Authentication tells you an agent is who it claims to be. It tells you nothing about whether a human authorised what the agent is currently doing, whether the instruction it is following came from a legitimate source, or whether the execution is within any bound at all. Those are three separate controls, and September produced one public incident for each of them.