The 'Ghost Credentials' Problem: How Forgotten Digital Keys Are Leaving Cloud Systems Wide Open
A sleeping AI agent that suddenly woke up and started making unusual requests led a security researcher to a sprawling mess of forgotten, untrusted digital keys, and a tool to help organisations find them before attackers do.
Key points
- A dormant AI workflow agent reactivating after 30 days triggered the discovery of widespread "ghost credentials" inside a cloud environment.
- Security architect Aleksandr Krasnov found that some low-trust digital keys could perform the same actions as a full system administrator.
- Krasnov estimates one developer can have up to 244 non-human digital identities, making large organisations especially hard to secure.
- Krasnov is releasing a free, open-source tool called NHI Hound at Black Hat USA 2026 to help organisations map and fix hidden trust problems.
- Smaller companies (up to 2,000 employees) may need 6 to 9 months to fully clean up their identity records using the tool.
It started with something easy to miss. An AI-powered software agent, the kind that quietly carries out automated tasks inside a company's cloud computing system (a network of remote servers rented to store and process data), had been sitting idle for 30 days. Then it woke up and started making requests at odd hours.
That strange behaviour kicked off an investigation. What Aleksandr Krasnov, a security architect at Ducker Tech Consulting, found underneath was far more serious than one misbehaving agent.
What are "ghost credentials" and why does this matter?
Ghost credentials are digital keys, access tokens, and service accounts (automated logins used by software rather than people) that still work but that nobody is actively watching. Krasnov found large numbers of them sitting outside the normal security boundaries of the organisation he was investigating, yet still able to move through systems and, in some cases, gain full administrator access.
Think of it like finding a stack of old master keys in a forgotten drawer. Each one still opens doors. Nobody knows they exist. And someone with bad intentions only needs one.
Krasnov told Dark Reading that an attacker can spend two weeks crafting a fake email to trick a staff member, or spend five minutes searching for an exposed token online. The five-minute path wins almost every time.
How bad can one leaked key get?
Very bad. Krasnov plans to show at Black Hat USA 2026, a major annual security conference for professionals, how a single leaked key can be used to take over an entire cloud environment. Part of that involves abusing "chained trust relationships," where one system automatically trusts another, to break into identity providers such as Okta (a service that controls who can log into company software).
His research found that some identities he classified as low-trust could effectively act as super-administrators because of implicit permissions the organisation never consciously set up.
| Finding | Detail |
|---|---|
| Trigger event | AI agent dormant for 30 days reactivated unexpectedly |
| Root cause | Ghost credentials and unmonitored non-human identities |
| Escalation risk | Low-trust keys acting with full admin-level access |
| Scale (one developer) | Up to 244 non-human identities |
| Cleanup time (small orgs) | 6 to 9 months with NHI Hound |
| Tool release | Black Hat USA 2026 |
What is NHI Hound and can it help?
NHI Hound is Krasnov's free, open-source tool (meaning anyone can download and use it at no cost) designed to map every digital identity inside an organisation, human and automated alike. It connects to services such as Okta, GitHub, and cloud platforms, then draws a picture of how all those identities relate to each other and flags the dangerous links.
Early testing with small to mid-sized organisations showed strong results. Larger companies face a harder road: with potentially hundreds of identities per developer, Krasnov admits the output can become "too much mess and too much noise" to act on quickly. Better visualisation for bigger organisations is on his roadmap.
What should ordinary employees or customers do?
If you use software products at work, ask your IT team whether they audit automated accounts and old API keys (digital passwords used by software systems) regularly. If you are a customer of any cloud-based service, the risk here is not immediate and direct for you, but breaches that start with ghost credentials can expose customer data. Watch for any unexpected emails asking you to reset passwords or confirm account details, as those can follow a larger breach.
