Security roundup: Klue breach exposes SaaS OAuth tokens, OpenAI expands patching initiative
Summary
The newsletter covers a Klue breach in which stolen OAuth tokens were used to access connected customer environments, alongside OpenAI remediation efforts, Accenture’s OT security acquisitions, and other security industry news.
Key points
- Attackers reportedly used a stale credential to access Klue systems and collect customer OAuth tokens, then used the tokens to access connected services, including Salesforce.
- Klue disabled integrations with multiple services while investigating; LastPass said business contact, support case, and sales data were accessed, but customer vaults were not affected.
- OpenAI announced updates to Codex Security, a limited release of GPT-5.5-Cyber, and the open-source Patch the Planet remediation initiative.
- Accenture agreed to acquire a majority stake in Dragos and all of runZero and NetRise in a deal valued at approximately $4.175 billion.
- Dream raised $260 million to expand its sovereign AI and cyber defense platforms for governments and critical infrastructure.
- Other developments include Snyk’s agentic development security offering, Dragos’s EmberAI for OT security, and Cisco’s planned acquisition of WideField Security.
Article Details
- Event Type
- Cybersecurity news roundup covering a SaaS data breach involving stolen OAuth tokens, security-product launches, acquisitions, and funding.
- Impact
- Attackers reportedly used a stale credential to access Klue backend systems, deploy code that collected customer OAuth tokens, and access connected environments, including Salesforce, where data was extracted. Publicly disclosed affected companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said business contact, support case, and sales-related data were accessed, while customer vaults were not affected.
People
Vendors
Accenture🏭 Accenture buys into OT: Accenture agrees to take a Dragos majority stake and buy runZero/NetRise for total $4.15B.Cisco🪪 Cisco targets WideField: Cisco plans to add identity and session context to Splunk’s Agentic SOC.Dragos🏭 Accenture buys into OT: Accenture agrees to take a Dragos majority stake and buy runZero/NetRise for total $4.15B.Dream🧠 Dream raises $260M: Bicycle Capital and Group 11 co-led the round at a $3B valuation.GongKlue disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne,HackerOne🧩 Klue breach hits Salesforce: LastPass, Huntress, HackerOne, and more disclosed impact from stolen OAuth tokens.Huntress🧩 Klue breach hits Salesforce: LastPass, Huntress, HackerOne, and more disclosed impact from stolen OAuth tokens.InsurityHuntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed business contact info, support case data, and sales-related data, butJamfPublicly disclosed impacted companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed businessKlueand the week before holiday week, so the security news cycle has that weird pre-OOTO lull. Still, the Klue breach is ringing bells and stirring up Salesloft/Drift PTSD. Meanwhile, there still hasn’t been muchLastPass🧩 Klue breach hits Salesforce: LastPass, Huntress, HackerOne, and more disclosed impact from stolen OAuth tokens.NetRise🏭 Accenture buys into OT: Accenture agrees to take a Dragos majority stake and buy runZero/NetRise for total $4.15B.Newfoundland and Labrador Health ServicesNewfoundland and Labrador Health Services apologized after sending staff a phishing simulation that dangled an extra paid vacation day as bait.OneTrustdisclosed impacted companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed business contact info,OpenAI🛠️ OpenAI shifts to patching: Daybreak adds GPT-5.5-Cyber, Codex Security updates, and Patch the Planet.Recorded Futurewhile investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessedReliaQuestOAuth tokens. Those tokens were then used to access connected environments, including Salesforce. ReliaQuest observed attackers using Python scripts and the Salesforce REST API for bulk extraction, includingrunZero🏭 Accenture buys into OT: Accenture agrees to take a Dragos majority stake and buy runZero/NetRise for total $4.15B.Salesforce🧩 Klue breach hits Salesforce: LastPass, Huntress, HackerOne, and more disclosed impact from stolen OAuth tokens.SnykPublicly disclosed impacted companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed business contactSprout Socialcompanies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed business contact info, support case data, andTaniumimpacted companies include Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, OneTrust, Tanium, Gong, Sprout Social, and Insurity. LastPass said attackers accessed business contact info, support caseWideField SecurityCisco plans to acquire WideField Security to strengthen Splunk’s Agentic SOC with identity, credential, session, and blast-radius context.
Products
Agentic SOC🪪 Cisco targets WideField: Cisco plans to add identity and session context to Splunk’s Agentic SOC.Codex Security🛠️ OpenAI shifts to patching: Daybreak adds GPT-5.5-Cyber, Codex Security updates, and Patch the Planet.CorCareThe test thanked employees and physicians for their work on the CorCare software rollout, then invited them to click a button to redeem the day off. Anyone who clicked failed the test. The Registered Nurses’ UnionCyberGymthan 500,000 findings automatically determined to be fixed. While GPT-5.5-Cyber outperformed GPT-5.5 on CyberGym, ExploitGym, and SEC-bench Pro.Daybreak🛠️ OpenAI shifts to patching: Daybreak adds GPT-5.5-Cyber, Codex Security updates, and Patch the Planet.EmberAIDragos unveils EmberAI for OT securityEvo Agentic Development SecuritySnyk launched Evo Agentic Development Security, a new capability for governing AI-driven development workflows before agent-generated code hits repos, pipelines, or production.ExploitGymfindings automatically determined to be fixed. While GPT-5.5-Cyber outperformed GPT-5.5 on CyberGym, ExploitGym, and SEC-bench Pro.Google DriveKlue disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne,GPT-5.5-Cyber🛠️ OpenAI shifts to patching: Daybreak adds GPT-5.5-Cyber, Codex Security updates, and Patch the Planet.HubSpotKlue disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne,Microsoft SharePointKlue disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne,Patch the Planet🛠️ OpenAI shifts to patching: Daybreak adds GPT-5.5-Cyber, Codex Security updates, and Patch the Planet.Purple AISentinelOne turns Purple AI loose to investigate threats on its ownSalesforce🧩 Klue breach hits Salesforce: LastPass, Huntress, HackerOne, and more disclosed impact from stolen OAuth tokens.SEC-bench Prodetermined to be fixed. While GPT-5.5-Cyber outperformed GPT-5.5 on CyberGym, ExploitGym, and SEC-bench Pro.Slackdisabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne, RecordedSplunk🪪 Cisco targets WideField: Cisco plans to add identity and session context to Splunk’s Agentic SOC.ZoomKlue disabled integrations with Salesforce, HubSpot, SharePoint, Zoom, Gong, Chorus, Clari, Google Drive, and Slack while investigating. Publicly disclosed impacted companies include Huntress, LastPass, HackerOne,
Tools
Pythonthen used to access connected environments, including Salesforce. ReliaQuest observed attackers using Python scripts and the Salesforce REST API for bulk extraction, including nearly 1,000 queries in 15 minutes inSalesforce REST APIenvironments, including Salesforce. ReliaQuest observed attackers using Python scripts and the Salesforce REST API for bulk extraction, including nearly 1,000 queries in 15 minutes in one environment.
Industries
Critical infrastructuresecurity consulting biz, I can say that they service a strong portion of the federal govt. and critical infrastructure co’s (i.e., energy). These are great pickups for Accenture, especially considering that AI hasHealthcareUnion called the exercise insensitive, pointing to staffing shortages, burnout, and the difficulty healthcare workers already face getting paid time off.