A pod compromise becomes a control-plane problem when workload identity turns execution into transitive authority. Kubernetes service-account tokens are not universal master keys, but permissive RBAC, workload federation, cloud IAM, and reachable credentials can connect one application incident to cluster and cloud impact.

Approving an agent tool once is not the same as trusting it forever. When mutable MCP descriptions and schemas influence the model’s decisions, routine metadata updates can alter the authority an enterprise thought it had approved..

A malicious dependency is no longer only an artifact problem. Attackers can distribute behavior across packages, build stages, and mutable infrastructure while hostile repository context pressures AI-assisted workflows elsewhere in the approval path.

Defense-industrial access can form before a conventional security workflow has a stable employee, device, or account to monitor. DPRK IT-worker schemes, suspected Iran-nexus recruitment operations, and supplier compromise remain distinct threats, but they expose the same defensive problem: workforce and delegated authority are often created from evidence scattered across teams that do not routinely compare records.

Industrial incident reporting often gives analysts the loudest facts first: ransomware branding, a production halt, and a statement that no physical impact was confirmed. Those facts matter, but they do not answer the harder question—what did the adversary learn about the process?

Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.