The attackers didn't need a password. A backup app already had a yes.
27 Oct 2026 · News
The biggest AI attack story this month skipped the login screen entirely. It used a permission companies had granted earlier, including some that had stopped using the app.
A China-aligned group that Microsoft calls Storm-0940 got into Microsoft 365 accounts without a single password. It borrowed the identity of a backup app that organizations had already approved, then used an AI attack tool to try that identity against more than 2,250 of them. Personal agents are built on the same kind of approval. Our call is that by 30 June 2027, at least one of Anthropic, OpenAI, Google or Microsoft will make its agent's account connections expire by default and ask you to approve them again.
What happened
The app is ConnectWise Cloud Backup, formerly SkyKick. To back up a company's email and files, it needs standing permission to read them. An administrator grants that once, and from then on the app signs in as itself. No person signs in, so no password prompt or text message code is involved.
On 15 October, Sophos researchers saw someone sign in as that app and request access to one customer organization after another, in ascending order of their account IDs, for 96 minutes from a single server. "The sign-ins required no user password and no multi-factor authentication," Sophos wrote, "because the threat actor authenticated with the application's own identity."
On 21 October Microsoft named the group and the tool. ARTEX is an open-source framework of AI agents that runs an attack "from reconnaissance through data exfiltration with little needed human interaction." Microsoft says Storm-0940 used it on hundreds of organizations, and in several cases went from first contact to privileged access in under three hours. Microsoft also notes that a successful sign-in doesn't prove anyone's data was taken.
The yes outlived the customer
One line in the Sophos write-up is the whole story. The sweep "included tenants with no active backup subscription." Some of those organizations had stopped paying for the backup service. Their approval never went away, so the attackers had a list of open doors that included companies that had moved on.
Shutting it down was slow too. ConnectWise cut off the app's access on 17 October, and its advisory says that "does not reverse changes previously made inside a tenant," while tokens already issued "may remain usable until they expire." Huntress found one tenant where a second ConnectWise app had made itself a global administrator.
Then versus now
On 6 October we wrote about a Mac permission built for backup apps. Apple was tightening Full Disk Access because "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." That worry was about agents you invite in. Two weeks later a backup app's cloud permission was exactly how an attacker's agents got in. The risk Apple described showed up first somewhere else.
Yesterday we wrote that Claude Duet checks your connected accounts every few hours. To do that, it has to keep your permission the whole time. Every personal agent works this way. You connect your email, calendar and drive once, and the agent holds that approval until you take it back. That makes it the same kind of door Storm-0940 used, held by a company you trust.
Why expiry is coming
An approval with no end date suited software that did one thing, like a backup app copying files at night. An agent reads, decides and acts, and Storm-0940 showed that attackers now have agents of their own that that work through approvals at machine speed. Sophos watched one sweep finish in 96 minutes. The stale ones are the cheapest targets, because nobody is watching them.
Expiring grants have a real cost. An agent that loses its access every 90 days is worse at its one job, keeping an eye on things while you're away, and every re-approval screen trains people to click yes without reading. Vendors will push back. But a lab that has to explain why a customer who left months ago still had an open connection will choose the re-approval screen. Google's own linked apps page already lists agent access as its own filter, which is where a default expiry would go.
Our call
By 30 June 2027, at least one of Anthropic, OpenAI, Google or Microsoft will make the account connections its personal agent uses expire by default and ask you to approve them again. We're wrong if mid 2027 arrives with every one of them still holding grants until you revoke them by hand.
You don't have to wait for that. Your Google Account has a linked apps page, and a Microsoft account lists apps and services that can access your data under Privacy. Anything on those lists you stopped using is an approval nobody is watching.