Agent access needs more than permission

Which credential does your agent actually need to see? Start there, before choosing how much trust to place in its judgement. October's reports offer concrete reasons to ask: exposed credentials in Stingrai's summary of OpenAI's incident review, leaked Amap keys in Swarmchasers' report, insider risk in Microsoft's security advice, and agents inside customer bank accounts in Axios's reporting. Read them as distinct stories. Ask the same access question of each.

13 October: exposed credentials, reported by OpenAI

In its 13 October summary of OpenAI's incident review, Stingrai describes activity that used exposed credentials. It also relays OpenAI's statement that its teams had notified over 100 organisations by 26 September about activity meeting its notification criteria. OpenAI's own review confirms that it notified over 100 organisations.

Keep the figure attached to that statement: organisations notified by OpenAI. Keep the exposed-credential detail attached to the activity described in Stingrai's summary. For your own agent, start with an inventory question rather than a verdict about its behaviour: which real credentials are available to it? Which of those does it need to see, rather than merely ask your software to use?

14 October: keys already on the web

The Swarmchasers report, dated 14 October, describes agents attempting to use Amap keys published on the web. It includes a key and security code leaked in a public repository. Here, focus on that precise detail: a published key, then an attempt to use it.

The Next Web's reporting on 15 October describes more than 2,600 attempts to pull data from Amap between 28 September and 8 October. It reports no official reply from Tencent to the researchers' questions. Instead, a person close to the company, speaking on background, attributes the fleet to tests run by a Tencent evaluation team. That explanation comes through The Next Web from the background source, not an official Tencent statement.

For your own setup, ask the practical question raised by the leaked-key detail: what credential are you prepared to expose?

19 October: put the security boundary outside

Writing on Microsoft's Security blog on 19 October, Nadim Abdo connects agent capability with insider risk. His instruction is direct:

“We should not ask a model to be its own security authority.”

He places security controls outside the model, beyond its ability to bypass or tamper with them.

Satya Nadella, as quoted by Microsoft, frames trust around a system designed to require the least trust in its model, rather than the greatest. Apply that advice as a design question: where is your access boundary? Does your software enforce it, or are you asking the agent to police itself? Put the boundary beside the credential decision. Decide what the agent sees and what remains under your software's control.

22 October: customer permission, bank restrictions

Axios reports on 22 October that major US banks are detecting unauthorised third-party AI agents inside customer accounts. Those agents operate with the user's permission and login credentials. Axios reports banks blocking the technology; it also reports that most banks have authorised, or are moving towards allowing, read-only access.

Read both parts together: customer permission and credentials on one side, banks' restrictions and read-only access on the other. Keep that distinction in view when deciding what access to give your own agent. Ask what the service authorises, alongside what the user requests.

The deny.sh position: real credentials stay out of the agent; it holds a decoy. Your software resolves the real key. A decoy that gets used is an alert. Start with agents, and read the threat model.