u/OfficialLastPass

You classify AI tools based on a defined set of risk attributes.

Two tools in the same category can have very different risk profiles, depending on their data handling practices, login security, and deployment model.

Six questions to ask when classifying an AI tool

1. Data retention and use of training data: Does the vendor use your prompts to train its models? And do they retain your data after the session ends, and if so, under what terms? Be wary if the vendor's default terms allow prompt data to train models, with opt-out buried in enterprise settings.

2. Availability of Data Processing Agreements (DPA): If your organization handles EU personal data, a tool without a DPA can’t be approved under GDPR Article 28. But if your organization doesn't operate under GDPR, document vendor data handling terms in its place.

3. Secure authentication support: Does the tool support SSO? No SSO option means you can't enforce MFA at the identity layer.

4. OAuth scope: If a tool connects to your Google Workspace or Microsoft 365, what permissions does it request? A meeting summarizer that requests read/write access to your entire email inbox is asking for far more than it needs. The wider the permissions, the higher the risk tier.

5. Default deployment model: Is the tool publicly accessible without authentication to view it? AI coding platforms that deploy apps publicly by default are a distinct risk category, not just for the tool itself but for any data passed through it.

6. Vendor security posture: Does the vendor publish a SOC 2 report or any security documentation? Security posture is worth considering as part of classification.

Tools that raise red flags for #1, #3, and #5 should default to Warn or Block:

• Allow (for approved apps)
• Warn (accessible with a policy reminder at login)
• Block (restricted at the point of access)

For how to apply those tiers in practice, see Allow, Warn, Block: A Practical AI Governance Model for Lean Teams.

Recently documented by arsTECHNICA, A major AI software supply chain attack exposed large volumes of credentials from more than 2,500 organizations, including major enterprises such as Microsoft, Amazon, Cisco, Samsung, and Salesforce.

The breach stemmed from a compromise of LiteLLM, a popular open-source AI development tool. According to security researchers, attackers gained access to sensitive secrets including cloud credentials, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider API keys. The incident demonstrates how compromising a widely trusted software dependency can create widespread downstream exposure across thousands of organizations.

Key points from our perspective:

• Trivy rotated a compromised credential, but didn't fully revoke it. As a result, attackers were still able to use the token after it was replaced.
• Stolen automation tokens are hard to detect because they look like normal system activity. The longer they remain active, the more time attackers have to gain deeper access.
• LiteLLM is widely adopted and can be added to development pipelines quickly, often without a full security review. As AI tools are adopted faster than security teams can evaluate them, compromised software can make its way into production environments unnoticed.
• This incident highlights the unique risk of software supply chain attacks. Instead of attacking a company directly, attackers compromise trusted software and use that trust to reach downstream victims.

Why this supply chain attack was especially impactful:

• Attackers first compromised Trivy, a trusted software package, and then reached LiteLLM through its dependency on Trivy.
• Supply chain attacks can have a massive ripple effect. In this case, just 40 minutes of access to an upstream package led to credential exposure across more than 2,500 organizations.
• Many affected organizations may not realize they were impacted because they were using approved, trusted software. This reflects a broader visibility problem: organizations often lack insight into what third-party software, SaaS applications, or integrations are doing and what credentials they can access.

In the past, we have shared curated articles about security, passwords, etc. Below is this week's list.

Should we keep sharing this information. Let us know

Industry News:

• The Hacker News, “ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access” by Ravie Lakshmanan
• Cyber Security News, “Zoom Zero-Click Vulnerabilities Allow Meeting Participants to Hijack Other Users’ Devices” by Guru Baran (
• Dark Reading, “Walmart Leaders Transform Security Operations Without Going Bananas” by Richard Thurston
• Cybernews, “OpenAI's new cyber AI finds hundreds of bugs before launch” by Mayank Sharma
• CNBC, “AI agents, hacks and the cybersecurity spending boom” by staff
• Cyber Security News, “Hackers Actively Scanning to Exploit VMware VCenter Vulnerabilities” by Abinaya
• Help Net Security, “GPT-5.6-Cyber refuses security researchers’ requests far less often” by Sinisa Markovic
• CPO Magazine, “Meta AI Model Joins Hacking Party With Exploit of Third Party Security Vulnerability” by Scott Ikeda
• The Hacker News, “Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine” by Swati Khandelwal
• CNBC, “OpenAI rolls out new model for cybersecurity teams a month after Anthropic's Mythos debut” by Ashley Capoot

Should we keep sharing this information. Let us know?

First, let’s get definitions out of the way. An AI governance policy defines the rules, while AI governance controls enforce them (with clear evidence for it).

A policy tells employees which AI tools are approved, how to handle data, and what's prohibited.

But a policy alone doesn't tell an auditor:

• Which tool was accessed and by whom
• The date of access
• Which credentials were used
• The type of authentication (SSO versus username/password)

Consider two common failure modes:

1. When an employee logs in to an AI tool with a personal Gmail on a corporate device, attribution is unclear.
2. When three employees share access to an AI writing platform, you can't tell an auditor who accessed what, when, or how.

Together, these scenarios show why discovery and authentication are the controls you must prioritize.

Which compliance frameworks will ask for AI governance evidence?

If your employees use AI tools to process PII, corporate, or regulated data, auditors will look for:

• SOC 2: Logical access controls & user accountability
• HIPAA: Authentication, access control, audit controls
• GDPR: Records of tools processing personal data
• ISO 27001: Asset inventory, monitoring & access controls
• NIST AI RMF: AI inventory, governance, and risk management
• EU AI Act: Logging, monitoring, and risk-based oversight
• ISO/IEC 42001: AI management system controls

The common thread: Access governance (inventory, authentication, monitoring, and audit evidence).

SSO federated authentication works by linking your IdP (identity provider) to the apps you've configured. When a clinician authenticates through Okta, Entra ID, or Active Directory, the IdP verifies their identity and passes an access token to the connected app. This is how authorized access works.

But every SaaS or AI tool a nurse, physician, or administrator accesses without going through this process is completely invisible to your IdP.

This direct browser login with a business or personal email address is untracked and unprotected, which means you now have a visibility problem.

SSO coverage gap: The SaaS and AI apps your employees access outside your identity provider's reach, where no access policies apply and no visibility exists. See the types of AI tools LastPass surfaces.

"LastPass's quickness is what makes it so effective. It's fast and easy to use, which is why our employees love it."

- Brad Sweet, Network Systems and Security Manager at HealtheConnections, trusted health information exchange for 1,500+ organizations

OpenAI employees warned Black Hat attendees about the need for stronger model development safeguards during a presentation about OpenAI’s recent Infrastructure Attack. During the presentation, both speakers from OpenAI disclosed that OpenAI agents communicated on an internal message board to plan the attack.

The employees noted that OpenAI is prioritizing updates to its agents to detect and prevent similar incidents in the future, but emphasized that companies will continue to face constant, sophisticated attacks by malicious actors using powerful open-source models that labs can’t contain. The team shared that doubling down on basic security measures is vital in today’s age of cybersecurity. Cybersecurity Dive covered the research presentation here.

Top list of Password Providers. Read here

These are the top stories we we're currently following:

• Security Week, “Prompted by OpenAI Disclosure, Anthropic Finds Its Own Models Hacked 3 Organizations” by Eduard Kovacs
• The Hacker News, “Three Recent Chrome Releases Fix 1,442 Flaws, More Than Prior 23 Updates Combined” by Ravie Lakshmanan
• Help Net Security, “AI agents are changing where cybersecurity seed funding lands” byAnamarija Pogorelec
• GBHackers, “Ransomware Killers Overwrite Security Process Memory Without Terminating Applications” by Mayura Kathir
• Cyber Security News, “FBI And Allies Warn of North Korean IT Workers Using Stolen Identities” by Guru Baran

These are the headlines that caught our eye this week:

• Federal News Network, “AI incidents bolster push for federal cyber improvements” by Justin Doubleday (7/27)
• The Wall Street Journal, “Nvidia, Other Tech Giants Launch AI Defense Alliance Following OpenAI Hacking Incident” by Isabelle Bousquette and Berber Jin (7/27)
• The Hacker News, “Operation BlueDash Deploys Level RMM to Steal Data from U.S. Auto Dealerships” by Ravie Lakshmanan (7/25)
• CRN, “The AI Vs. Humans Debate Is The Wrong Question In Cybersecurity: CISO” by CJ Fairfield (7/25)
• Tech Republic, “Coca-Cola Refuses Ransom and Anubis Leaks Fairlife Data: CitrixBleed Opened the Door” Joseph Ofonagoro (7/28)
• The Hacker News, “Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates” by Swati Khandelwal (7/29)
• Forbes, “Healthcare Is Undergoing A Cybersecurity Crisis, And Its Not Slowing Down” by Dr. Sai Balasubramanian (7/28)
• Tech Republic, “More Than 45,000 Software Flaws Reported as AI Reshapes Cybersecurity” by David Curry (7/28)
• Cybersecurity News, “Claude Worldwide Outage Disrupts Users With “Request Failed With 529 Overloaded” Message” by Abinaya (7/30)
• The Hacker News, “Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts” by Swati Khandelwal (7/30)
• Bleeping Computer, “After the Break-In: What Attackers Do Once They're Already Inside” by Huntress Labs (7/30)
• Infosecurity Magazine, “Teams-Themed Phishing Campaign Abused Legitimate Microsoft Login Pages” by Danny Palmer (7/30)
• The Conversation, “What is a side-channel attack? A cybersecurity researcher explains how computers can leak secrets without being hacked” by Chetan Jaiswal (7/30)

A recent CDW article mentioned a survey of 950 IT decision-makers found that AI-powered cyberattacks are no longer a future concern—they're already happening. According to the article:
- 43% of organizations have experienced AI-enhanced phishing attacks
- 37% have encountered AI-powered malware.

The article argues that cybersecurity is entering an AI arms race, where attackers are using AI to create more convincing phishing campaigns, automate attacks, and evade detection, while defenders are increasingly adopting AI-based security tools to respond. Many organizations now view AI-generated phishing and social engineering as their most significant emerging cyber risk.

The key takeaway is that companies should have their contingency plans in place for when an AI breach might happen.

LastPass' Threat Intelligence Mitigations and Escalations (TIME) team recently hosted its first Phish Bowl Live webinar, focusing on key cybersecurity threats observed across APAC, Europe, and North America. Some of what we found is concerning: AI is accelerating existing cyber threats rather than creating entirely new ones.

1. AI is making cyberattacks faster, cheaper, and more scalable

• AI has evolved beyond improving phishing emails and is now enabling more autonomous attacks.
• One recent ecample, JadePuffer, is an AI-driven ransomware operation capable of reconnaissance, credential theft, lateral movement, and adapting to failures with minimal human involvement.
• A recent Five Eyes advisory warned that organizations have only a short window to prepare for AI-enabled threats.

2. Stolen credentials remain the most common attack method

• Across all regions analyzed, the most frequent attack was simply logging in with stolen usernames and passwords.
• The FortiGate campaign demonstrated how attackers used stolen credentials and password spraying to compromise systems and harvest over 110 million credentials.
• Small and midsize businesses (SMBs) were disproportionately affected.

3. Infostealer malware is a growing problem

• Infostealers collect saved passwords, session cookies, and authentication tokens from users' devices.
• Recent reports show approximately 1.8 billion credentials exposed last year.
• Attackers increasingly target session tokens because they can bypass MFA prompts.

4. Attackers are exploiting trusted tools

• These include phishing campaigns delivered through Microsoft Teams and prompt-injection attacks targeting AI-assisted development environments.
• Organizations are encouraged to apply least-privilege principles to AI integrations and understand exactly what data those tools can access.

Recommended Security Actions:

• Use unique, complex passwords and a password manager.
• Enable multi-factor authentication (MFA) wherever possible.
• Keep systems patched and updated.
• Monitor for compromised credentials on the dark web.
• Verify unusual IT requests through out-of-band channels (for example, by calling a known phone number).
• Review AI tools and integrations using a least-privilege approach.

Today we’re following reporting from Gizmodo on what researchers say is the first confirmed AI agent breach of a major AI platform.

According to Hugging Face, the incident demonstrates how autonomous AI agents can introduce new security risks as organizations continue adopting AI technologies. These findings highlight how quickly the AI threat landscape is evolving and the importance of understanding emerging attack techniques as AI becomes more deeply integrated into enterprise environments.
 
Our team is continuing to monitor developments around AI-driven threats and evolving attack techniques.

If you're a LastPass company administrator, then you may want to check up on your SaaS Monitoring and SaaS Protect Admin Playbook knowledge.