Who's Really Using Your SaaS? The Rise of Non-Human Identities
Summary: Non-human identities such as AI assistants, automation bots, integration services, and API tokens now act across SaaS applications with the same or greater privileges as employees, and about one-third of SaaS app integrations have access to sensitive data beyond their needs. The article cites three breaches: the August 2025 Salesloft breach, where stolen OAuth tokens for the Drift chatbot integration let attackers impersonate the integration and reach Salesforce CRM data at hundreds of organizations over a ten-day campaign; the January 2024 New York Times breach, where an exposed GitHub API token gave access to about 270 GB of internal source code and data; and the 2023 Okta fallout, where a leftover API token tied to a service account let attackers into Cloudflare's Atlassian suite after some 5,000 user credentials had been rotated.
What's compelling: Cloudflare rotated roughly 5,000 human credentials after the Okta breach, yet one forgotten machine token was enough to bypass that entire reset and open a backdoor into Jira, Confluence, and Bitbucket. An identity that never logs in interactively never triggers the password-reset and review processes built for employees.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026