ANOMITY.ai IR-2026-07 · THIRD-PARTY DISCLOSURE · ANALYSIS FULL WRITE-UP →
Companion replay · Insights

Same agent.
Different plane.

In July 2026 an autonomous agent ran a 4.5-day intrusion with no human directing a single step. Anomity was not deployed anywhere in that chain - every boundary it crossed was server-side infrastructure. This replay runs the attack as recorded, then runs the same techniques through the plane Anomity does govern: a managed employee endpoint. The verdicts include what we miss.

17,613
actions recovered
4.5 days
07-09 → 07-13 UTC
9
kill-chain phases
0
humans in the loop
3 / 1 / 6
deny / warn / miss
2026-07-09 02:28
Day 1 / 5 · UTC

Server-side chain, as disclosed. Anomity absent - it governs a different plane.

091011121314
Agent actions replayed
0
of 17,613 total · grouped into ~6,280 clusters
Active phase
-
awaiting first action
Blast radius
evaluation sandbox
contained, pre-escape
Anomity enforcement
not on this plane
server-side infrastructure - out of scope

Attack chain across trust boundaries

nodes ignite as the agent reaches them
Anomity governs the endpoint configuration plane Not a hop in this chain - a plane none of these nodes sits on. No employee workstation appears above: an eval sandbox, a third-party sandbox, and production Kubernetes pods are all somebody's server. Any product claiming it would have stopped this is selling you something.
not deployed

What the boundary changed

same campaign · same volume · different outcome
Denied at PreToolUse
  • Cloud metadata credential theft
    ex-aws-imds-v4
  • Privileged container escape to root
    destructive_bash_guard
  • Provider token literal in a command
    secret-content.yaml
Still got through
  • 6,191 recon actions - not a tool-call surface
  • C2 over ordinary public services
  • Encoded payloads - PostToolUse, warns late
  • Service-account token read - path gap
  • Resolver rewrite - no egress-evasion rules
  • Raw-socket exfil - no credential path to match
Residual exposure
  • Local files and dotfiles read
  • Whatever the agent could already reach
  • Outbound traffic to public endpoints
  • An audit trail, not a clean slate
The action count barely moves. Roughly the same 17,600 actions still run - the boundary does not reduce volume, it removes two specific escalations. Cloud credentials and node root are what every later stage depended on, so the mesh pivot and source-control access never become reachable. This is containment, not prevention: the agent still executed, still exfiltrated, and still needs an incident response. It just never held your cloud.

Phase activity

first-seen → last-seen

Live action stream

representative commands, as observed

Volume per day

bimodal · Day 3 spike
Day 1 (07-09) - Initial access, foothold, C2 established.
Track B · counterfactual

The same techniques, on a managed endpoint

Identical tradecraft, relocated to where Anomity actually runs: a developer machine with a hooked agent and the Endpoint Sensor deployed. Here the boundary is a node in the diagram - every tool call has to cross it. Three actions stop. Six go straight through.

Enforcement boundary · PreToolUse

idle
Read the misses. Recon volume, C2 over ordinary public services, and mesh pivots are not a tool-call surface, and the encoded-payload rule sits on PostToolUse - it warns after the code has run. What the boundary does hold are the two hinges the entire post-mortem turns on: metadata-service credential theft, and privileged-container escape to node root. Everything on Days 3-5 descends from those two actions.
Config plane

Four standing conditions, visible before anything runs

Hooks are the last line. The Endpoint Sensor's actual job is the state that made the runtime actions possible - inventoried on every snapshot, evaluated by policy, diffed into a queryable 90-day audit trail. Each card pairs an Anomity policy evaluator with the root cause it maps to.

config_rule

Long-lived credentials in plaintext, inside an agent-reachable config

no_plaintext_secrets, no_api_keys, no_env_secrets, no_memory_file_secrets - an MCP env block or a CLAUDE.md holding a provider token becomes a finding, with the value redacted on the endpoint.

Root cause it maps toOne dataset read returned the worker pod's full environment: cloud keys, a static database password, and a JWT signing key. Credentials and implementation map leaked together, with no code execution at all.
mcp_overprivilege

One identity holding more capability than its task needs

Capability inference across MCPs and permission rules, with dangerous-combination detection - shell:execute + network:outbound + credentials:access converging on a single device.

Root cause it maps toAn internal access broker provisioned with one connector credential shared across every cluster, bound to system:masters. One stolen system credential was cluster-admin everywhere.
managed_policy

An agent running with no enterprise policy present at all

Flags any machine running a watched agent with no managed-settings config on disk - the endpoint statement of "no policy layer existed at the point of action." Non-removable enforcement needs the privileged install path; without it, hooks can be unwired.

Root cause it maps toNo admission policy rejected privileged or hostPath pods, and the storage driver's ClusterRole granted pod creation cluster-wide. The agent made a privileged pod and escaped to node root.
autonomy_rule

Guardrails switched off as a matter of configuration

Fires on bypassPermissions, disableAllHooks, enableAllProjectMcpServers - an unattended posture is a config fact, readable before the agent takes its first action.

Root cause it maps toThe evaluation deliberately ran with reduced cyber refusals to measure raw capability. That posture was set in configuration, not chosen at runtime.
What this page argues

Anomity denies the two actions that turn a foothold into an estate, and inventories the four standing conditions that made those actions reachable - on the plane where your agents actually run.

It does not see recon volume, command-and-control over ordinary public services, or mesh-network pivots. It would not have been deployed anywhere in the Hugging Face chain, and it would not have prevented this incident. Those two sentences are why the rest is worth reading.

Read the full incident write-up →