Chainalysis, a blockchain analysis firm, said on Friday that an outside actor used "offensive agentic techniques" to get into its systems and internal tools this month. Agentic tools are, broadly, AI programs that act on their own. The Hacker News read the phrase as a sign that an AI-powered tool was used. Chainalysis gave no details on its methods. The actor saw user IDs, full names, email addresses and role labels for platform users. The company has told its customers.
So far, Chainalysis sees no sign that cases, graphs or notes were opened. It also sees no sign of leaked clear-text passwords, multi-factor secrets or session tokens. It is still working out which records belong to each customer. How the actor got in is not stated.
The user list may be the real risk. Names, emails and job roles help an attacker write believable messages, which fits Chainalysis's warning about unexpected password resets and login prompts. Buyers can ask any vendor three things: what data it holds on your staff, whether it enforces two-factor sign-in, and how fast it tells you about a breach.