CYFIRMA’s Trust Cascade Report Maps Risks Across SaaS Delegation and AI Agents
Summary
CYFIRMA’s Trust Cascade report compares four cases linking SaaS delegation, identity compromise and AI-agent risks. It prioritizes task-scoped authorization while warning that identity controls alone cannot stop prompt injection.
Key points
- The report synthesizes public reporting on four illustrative cases, presents no new proprietary intrusion data and does not establish how prevalent these attack patterns are.
- It classifies Vercel/Context.ai and Salesloft/Drift as confirmed trust cascades in which compromised credentials or delegated access crossed organizational boundaries.
- In the Salesloft/Drift case, UNC6395 used stolen integration tokens to access more than 700 organizations’ Salesforce environments; Google had not established the actor’s origins or motivations.
- Taiwan’s government confirmed AI assistance in an intrusion, while detailed account counts, exploitation steps and agent behavior remain attributed to Dream’s research and related reporting.
- EchoLeak illustrates a separate prompt-injection path requiring no identity compromise. Microsoft patched the flaw and reported no identified exploitation before patching.
- CYFIRMA recommends task-scoped, time-limited authorization, visibility into SaaS-to-SaaS trust relationships and separate detection capabilities for delegation abuse and agent-content manipulation.
- The report maps AIMS and Cross App Access to emerging identity and authorization controls, but treats their coverage and deployment gaps cautiously; its control-effectiveness comparisons are analytical assessments.
Article Details
- Publisher
- CYFIRMA
- Report Period
- August 2025 through August 2026
- Scope
- Synthesis of public incidents connecting identity compromise, delegated SaaS authorization, agentic infrastructure, and data theft; no new proprietary intrusion data.
- Sample Size
- Four illustrative case studies, not a statistically representative sample.
- Key Statistics
- Between August 8 and 18, 2025, UNC6395 used stolen Drift tokens to authenticate against more than 700 organizations' Salesforce environments.
- Dream reported that the Taiwan operation mapped 21 government systems, compromised at least 85 accounts, and extracted more than 2,500 personnel records; these details rest on Dream's account.
- Cloudflare's forensic reconstruction found that a Salesforce Bulk API 2.0 job exfiltrated a database in roughly three minutes on August 17, 2025.
- An analysis of more than 5,200 open-source MCP server implementations reportedly found 53% used static API keys and 8.5% used OAuth; comparable enterprise adoption was not measured.
- In Okta's 2026 survey of 306 CISOs and senior security executives across six markets, 47% reported confidence in identifying all agents, 46% in centrally controlling their access, and 45% in authorizing individual agents' actions.
- Recommendations
- Assign explicit cross-functional ownership for non-human identity governance and the policy/authorization control plane.
- Use task-scoped, time-boxed, purpose-bound authorization; audit broad OAuth grants and revoke or narrow unnecessary access.
- Maintain a SaaS-to-SaaS trust graph showing delegated access and downstream reach.
- Apply tool allowlisting, egress controls, provenance verification, and context isolation to agent runtimes; authenticate inter-agent interactions.
- Operate separate detection capabilities for identity/delegation abuse and agent-content manipulation, correlating activity against local baselines.
MITRE ATT&CK
T1070 · Indicator RemovalThe attacker attempted to delete a Salesforce Bulk API job to conceal the exfiltration; residual logs preserved evidence.T1078.004 · Cloud AccountsThe report describes compromised cloud-linked accounts in the Taiwan operation; Dream reported at least 85 compromised accounts.T1199 · Trusted RelationshipCompromised trusted SaaS relationships enabled downstream access in the Vercel/Context.ai and Salesloft/Drift cases.T1213 · Data from Information RepositoriesUNC6395 queried Salesforce Accounts, Contacts, Cases, and Opportunities records for embedded secrets.T1528 · Steal Application Access TokenAttackers obtained OAuth tokens in the Vercel/Context.ai case and OAuth and refresh tokens from Drift's AWS environment.T1539 · Steal Web Session CookieThe Vercel/Context.ai compromise included theft of session tokens used to reuse authenticated access.T1550.001 · Application Access TokenUNC6395 authenticated directly to Salesforce environments with stolen Drift integration tokens, bypassing MFA.T1555.003 · Credentials from Web BrowsersThe report describes Lumma Stealer harvesting browser-stored corporate credentials from a Context.ai employee's endpoint.T1567 · Exfiltration Over Web ServiceThe Salesloft/Drift attacker exfiltrated Salesforce data through Bulk API 2.0.
CVE
Threat Actors
ShinyHuntersA collective using this name claimed data from the Drift campaign and engaged in reported extortion; its link to UNC6395 is not conclusively established. A separate Vercel sale listing used the name, but established group involvement and the claimed dataset were unverified.UNC6395GTIG tracks the actor that used stolen Drift tokens against more than 700 organizations. Google had not determined its origins or motivations; AppOmni's Chinese-linked attribution remains unconfirmed.
Malware
Vendors
Context.aiand data-theft objectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak.MicrosoftEchoLeak is a boundary case showing prompt injection against Microsoft 365 Copilot without any identity-layer compromise.OktaPlane against the standards efforts currently building it (IETF’s AIMS draft, NIST’s NCCoE work, and Okta’s Cross App Access protocol); a crosswalk to OWASP’s Agentic Security Initiative Top 10 and CSA’s MAESTROSalesforce[Platforms / Services] Downstream services abused in Salesloft/Drift – Drift, Salesforce, GitHub, AWS, Bulk API 2.0.Salesloftdata-theft objectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak.Vercelinfrastructure, and data-theft objectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak.
Products
AWS[Platforms / Services] Downstream services abused in Salesloft/Drift – Drift, Salesforce, GitHub, AWS, Bulk API 2.0.Cross App AccessIt emphasizes that the Policy/Authorization Control Plane and non-human identity governance are high-leverage defenses, while standards such as AIMS and Cross App Access are emerging to close the gap.GitHub[Platforms / Services] Downstream services abused in Salesloft/Drift – Drift, Salesforce, GitHub, AWS, Bulk API 2.0.Google Workspacean endpoint infostealer harvesting browser-stored corporate credentials (‘Lumma Stealer… yielding Google Workspace credentials’).Keycloak[Organizations / Systems] Affected systems in the Taiwan case – Taiwanese government systems, Keycloak, nuclear safety agency, energy-sector suppliers.Microsoft 365 CopilotEchoLeak is a boundary case showing prompt injection against Microsoft 365 Copilot without any identity-layer compromise.Microsoft Teamsa trusted action path (‘exfiltrate it via an auto-fetched image request proxied through a trusted Microsoft Teams endpoint’).Salesforce[Platforms / Services] Downstream services abused in Salesloft/Drift – Drift, Salesforce, GitHub, AWS, Bulk API 2.0.Salesloft Driftobjectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak.
Tools
Countries
ChinaTaiwan’s Ministry of Digital Affairs did not itself name China in its public statement; “suspected China-linked” in this report reflects that narrower researcher characterization rather than an official governmentTaiwancan combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak.