Nearly 3,000 sign-in attempts per minute. That's the number I keep coming back to today. It's how fast, according to Microsoft, a China-aligned group's AI agents worked through roughly 2,250 organizations after stealing one set of keys from an IT vendor.
On the very same day, 1Password shipped a product built on the opposite premise: your own agents should never hold the keys at all. Put those two stories next to each other and you get the clearest picture yet of where agent security is heading. The credential, not the model, is the thing everyone is fighting over.
One stolen keyring, 2,250 front doors#
Here's what TechCrunch reports, based on Microsoft's research. Attackers got into ConnectWise's cloud backup service and took the application credentials ConnectWise uses to connect to its corporate customers. Those credentials let them sign in to customers' Microsoft-hosted environments as authorized users, with access to email and files. Then they handed the job to agents.
The tooling is named as ARTEX, an open-source framework built to stress-test cyber defenses by pairing with AI models. The same software was reportedly used in a recent compromise of South Korean financial systems, many of which lacked multi-factor authentication. ConnectWise has paused its backup service and says it's working to restore it.
Microsoft's warning: the pace leaves defenders “little time to detect and respond.”
I don't think the AI part changes the attack. Stolen OAuth-style app credentials were always this dangerous. What changes is the timeline. A human crew needs days to work through two thousand tenants. Agents seem to need an afternoon. Any detection process that relies on someone looking at an alert the next morning is now measuring the wrong thing.
The PHP story we covered yesterday got the same lesson in a different form. Ars Technica reports that Amazon spotted an exploitation attempt against the AI-discovered PHP2Shell bug four days before it was disclosed publicly, and that the flaws are now “broadly exploited in the wild.” The AI that finds the hole doesn't care whose side it's on, and the gap between discovery and exploitation is shrinking toward zero.
1Password bets the agent should never see the password#
Against that backdrop, 1Password for Agents looks less like a feature launch and more like an architecture argument. When an agent wants to log in, it presents its own unique digital key to 1Password, you get an alert and approve it, and 1Password fills in the credentials itself. The agent does the browsing; it never holds the secret.
Supported agents at launch include Anthropic's Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse and agents from the startup Town. No pricing was given. The timing is pointed: the same day, Axios reported that US banks are seeing agentic activity inside customer accounts and mostly can't tell whether the customer asked for it.
This is the pattern I'd copy in my own agent work right now, whether or not I used 1Password. Give the agent an identity, keep the secret in a broker, and put a human approval on the first use. ConnectWise is what happens when a long-lived credential sits somewhere an automated process can read it. The fix is to make sure there's nothing worth stealing in the agent's context.
Microsoft's doctor-beating diagnosis is mostly a model story#
Microsoft AI published its MAI-DxO results in Science, and Mustafa Suleyman told The Verge that AI in healthcare “is finally here.” The headline number is big: on complex New England Journal of Medicine cases, DxO got 83% right versus 36% for generalist doctors working alone with reference material.
TechCrunch's breakdown is the more useful read, because the data undercuts the framing. GPT-5 on its own hit 78.9% on the complex cases; DxO added about four points and cut roughly $3,000 per case. On emergency department cases, the orchestrator didn't meaningfully help accuracy or cost. The biggest jumps came from swapping in stronger models. Specialists weren't in the comparison, and DxO isn't a product yet; a real-world trial with Beth Israel Deaconess comes next.
For builders, it confirms something I keep seeing in my own evals: an orchestration layer is worth a few points, and a better model is worth a lot more. Design your harness so the model is easy to swap.
Elsewhere on Thursday#
OpenAI is negotiating up to $30B at a $1.25T pre-money valuation, led by Coatue with UAE investors, per CNBC. That's below the $1.4T Bloomberg floated a month ago, which is the more interesting detail.
DeepSeek reportedly raised about $15B (around 100 billion yuan), with CATL and Tencent among possible backers, two days after US federal agencies were ordered to remove its technology. The US restriction clearly didn't scare off its domestic investors.
Canva launched Craft, its first in-house image model. It plans the layout before rendering, outputs up to 2K, and was trained on Canva's own templates rather than photos. The real motive is cost: Canva expects it to cut what it pays third-party image APIs. The Verge has more on the two-stage design.
Credentials just became the expensive part of every agent#
My prediction: within six months, “where does the agent's credential live?” will be the first question in every serious agent security review, ahead of prompt injection. Today's attackers didn't need a jailbreak. They needed one keyring and an agent fast enough to use it before anyone woke up.
I'm moving my own agent setups off long-lived tokens in environment variables and onto short-lived, scoped grants. It's tedious work. After reading about 3,000 logins a minute, it doesn't feel optional anymore.