Weekly Security Roundup - Identity, Supply Chain, and AI Agents

by TechHub

This week's Security roundup links attacker tradecraft with platform-side guardrails, starting with Microsoft's CaptiveCrunch reporting on Midnight Blizzard targeting travelers through captive portals and device code authentication abuse. On the supply chain front, npm and GitHub tightened automation paths with restrictions on bypass-2FA tokens, publish-time malware scanning, expanded malware advisories for Dependabot, and workflow runs that can be held for approval in public repos. Microsoft and Azure updates rounded out the week with identity and AI protections (including agentic SecOps and expanded external AI red teaming), plus concrete governance controls across Azure Policy, Fabric encryption, and data egress boundaries.

This Week's Overview

Midnight Blizzard “CaptiveCrunch” targets travelers via captive portals

Following last week's focus on OAuth abuse and identity flow manipulation, Microsoft Threat Intelligence detailed “CaptiveCrunch,” a Storm-2945 (Midnight Blizzard) campaign that goes after travelers by manipulating captive portal traffic to deliver malware and steal credentials and tokens. The core idea is adversary-in-the-middle (AiTM) control at a place where users already expect to authenticate (hotel/airport Wi-Fi portals), which lets attackers intercept sign-ins and pivot into identity flows that are hard to spot in the moment.

A key callout for defenders is the abuse of Microsoft Entra ID device code authentication as a phishing and token theft path. Because device code flows are designed for constrained devices and “out-of-band” approval, they can be socially engineered when the user is already in a captive portal login mindset. The report also goes deep on payload tradecraft, including CornFlake RAT and the ChocoShell PowerShell infostealer.

For security teams, this is a practical hunting and hardening drop, not just a narrative writeup. Microsoft included Microsoft Defender XDR and Microsoft Sentinel hunting queries plus mitigation guidance and threat intelligence mapping, so you can translate indicators and behaviors into detections quickly (especially around device code abuse and suspicious portal-driven auth patterns).

Supply chain guardrails tighten across npm, Dependabot, and GitHub Actions

Building on last week's real-world AsyncAPI npm compromise and the platform-side push toward safer CI defaults, a cluster of updates this week landed squarely on the same goal: reduce how often automated tooling (tokens, workflows, bots) can be abused to publish malware or exfiltrate CI/CD secrets. The most immediate takeaway is that “headless” automation is being pushed toward stronger, auditable paths (OIDC trusted publishing, scoped permissions, approval gates) rather than long-lived credentials and silent execution.

npm restricts bypass-2FA granular access tokens

npm granular access tokens that were configured to bypass 2FA can no longer perform sensitive account, org, and package-management actions without an interactive 2FA challenge. This directly cuts down the blast radius of a leaked token, because an attacker cannot quietly change org settings, manage packages, or perform other high-impact actions without triggering an interactive step.

GitHub also signaled that direct publishing restrictions are getting stricter next: additional limitations on direct publishing with bypass-2FA tokens are planned for January 2027. If you still rely on automation that assumes “token alone is enough,” this is the week to start migrating to trusted publishing (OIDC) and staged publishing patterns so CI can publish without holding credentials that act like user sessions.

npm adds publish-time malware scanning and “dual-use” disclosures

In the same supply-chain risk window we highlighted last week (where a single compromised publish pipeline can poison downstream consumers), npm is now doing malware scanning at publish time, which means publishes can be delayed, held, or blocked based on scan results. That changes operational expectations for release automation: pipelines that assume “publish is instantaneous” may need retries, backoff, and clearer release comms when availability lags behind a tagged release.

This update also introduces “dual-use metadata” requirements: a contentPolicy field in package.json plus a required DISCLOSURE file for packages that can be used offensively. Dual-use packages must publish using 2FA-enforced methods, further nudging maintainers toward trusted publishing (OIDC) rather than ad-hoc token publishing.

GitHub Actions can hold suspicious workflows for approval (public repos)

Following last week's emphasis on CI misconfigurations (especially risky workflow triggers and permission scopes), GitHub Actions added a protection that automatically holds some workflow runs flagged as potentially malicious until someone with write access approves the run through an authenticated web session. This is targeted at a common CI/CD attack shape: get untrusted or newly introduced workflow content to execute, then steal secrets or abuse the runner environment.

Right now, the feature applies to public repositories on github.com and is not available on GitHub Enterprise Server. If you maintain public repos with a high volume of external contributions, this adds a practical speed bump that can prevent a single workflow run from turning into a credential compromise event.

Dependabot gets better at malware signaling, while maintainers can reduce update noise safely

Building on last week's Dependabot default 3-day cooldown (meant to slow adoption of freshly published compromised releases), Dependabot alerting is expanding its malware coverage because the GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository. If your org already has malware alerting enabled, the expanded ecosystem coverage rolls in automatically, which helps catch malicious packages that are not traditional “CVE-style” vulnerabilities.

On the workflow side, GitHub outlined ways to cut Dependabot pull request noise without slowing down security response. The guidance focuses on grouping version bumps, using a slower cadence (like monthly) for routine upgrades, and relying on fast, disclosure-driven security updates, including a configurable cooldown window to reduce risky rapid-fire upgrades.

Broader GitHub and npm supply chain hardening roundup

This broader roundup effectively ties together the same enforcement direction we covered last week across trusted publishing, workflow hardening, and slowing attack propagation: GitHub published a broader view of the recent changes aimed at disrupting common supply chain techniques across npm and GitHub Actions. The themes tie together: safer defaults in workflows, cache hardening, more trusted publishing options, slowing attack propagation (including Dependabot cooldown concepts), and stronger credential revocation capabilities when compromise is suspected.

If you run CI/CD at scale, the practical implication is that “secure by default” is shifting from guidance to enforced platform behavior. Teams should review which repos still rely on long-lived secrets, which packages still publish with user tokens, and where workflow approvals or restricted contexts should become standard.

Microsoft Security platform updates: identity, AI protections, and agentic SecOps

Building on last week's identity shift toward passkeys-by-default and the parallel push to govern AI tool access, Microsoft's July 2026 security updates continued to converge on two themes: strengthening identity defaults (passkeys, Entra changes) and adding security controls for AI-era workloads (prompt injection protection, cloud agent defenses). The monthly rollup also teased where Microsoft is taking security operations next, with agentic workflows intended to connect signals, triage, and remediation into more automated loops.

For practitioners, the value is in tracking which controls are becoming “default posture” vs optional add-ons. Entra identity changes like passkeys-by-default alter end-user authentication expectations, while Defender and Sentinel updates increasingly focus on protecting AI apps and agent behaviors, not only traditional endpoints and servers.

Agentic security and AI red teaming: MDASH, MAI-Cyber-1-Flash, and EXTRA

This week connected multiple dots between new security-focused models, agentic workflows, and broader safety validation, extending last week's theme that AI security is moving from “model choice” to end-to-end controls (identity, authorization, telemetry, and audit proof). Microsoft introduced a compact cyber-focused model used in MDASH and positioned it alongside Project Perception concepts, while also expanding external AI red teaming to stress-test frontier systems beyond internal evaluation.

MAI-Cyber-1-Flash inside MDASH and Project Perception workflows

Microsoft announced MAI-Cyber-1-Flash as a compact model used inside MDASH to handle many security tasks at lower token cost, escalating to larger models for harder cases. The framing is operational: pair model capacity with workflow design so vulnerability discovery and remediation tasks can run economically in more situations, not only as “big model” one-offs.

Alongside the model announcement, Microsoft highlighted Project Perception's “agentic SecOps” direction, focused on chaining real-world signals with workflows for simulation, triage/investigation, and remediation. The posts emphasize safety evaluation and enterprise deployment controls, which matters if you are considering letting agents take actions beyond summarization (for example opening tickets, proposing patches, or changing configurations).

Global AI red teaming expands via the External Red Team Alliance (EXTRA)

Microsoft also announced the External Red Team Alliance (EXTRA), an effort to broaden AI red teaming through academic funding and a distributed network of external specialists. The practical implication is more diverse testing of model failure modes and security risks, which is especially relevant for teams deploying frontier-model features where internal testing will miss real-world adversarial creativity.

If you build or deploy AI systems, this is a reminder to treat red teaming as an ongoing program rather than a one-time launch gate. External perspectives and repeatable evaluation pipelines are becoming a baseline expectation, especially when models are connected to tools, data, or production actions.

Azure and Fabric security controls: compliance, encryption, and data egress governance

As a continuation of last week's “policy to proof” governance thread (encode controls, enforce them, then prove via telemetry), a set of Azure and Fabric updates this week focused on making security posture more measurable (policy substates, benchmark auditing), more controllable (egress rules), and more enterprise-ready for regulated workloads (HIPAA controls, customer-managed keys on compute). For developers, these changes mostly land as new defaults, new limits, or new prerequisites that can affect deployment pipelines and architecture decisions.

Built-in CIS Benchmark auditing for Linux on Azure (GA)

Built-in CIS Benchmark auditing for Linux workloads is now generally available via Azure Policy with Machine Configuration, powered by the kompli engine. The announcement includes supported Linux distributions and specific CIS benchmark versions, and it applies to both Azure VMs and Azure Arc-enabled servers.

For platform teams, GA here matters because it turns CIS checks into policy-based assessments you can apply at scale and query centrally (including with Azure Resource Graph). That can simplify evidence collection for audits and provide a consistent baseline for “what good looks like” across mixed Linux fleets.

Azure Policy exemptions get a Compliance Substate

Azure Policy exemptions gained a new Compliance Substate field that tells you whether an exempt resource would be compliant or non-compliant if you removed the exemption. This helps teams distinguish “papered over but would pass” from “papered over and still failing,” which is critical when exemptions are used as temporary operational escape hatches.

The update includes portal UI guidance (enabling the column) and shows how to query the field across subscriptions using Azure Resource Graph. In practice, this enables better backlog prioritization: you can target exemptions that hide genuinely non-compliant resources, instead of treating all exemptions as equal.

HIPAA-focused hardening for Azure Databricks (CSP) with a deadline

Azure Databricks customers working under HIPAA requirements got a detailed guide for enabling the Compliance Security Profile (CSP). The walkthrough covers prerequisites like Azure VNet encryption, supported VM series, enablement tooling options (including Terraform), and validation steps for rollout.

The key operational detail is the September 1, 2026 deadline, and the note that CSP enablement is intended to be permanent. That combination means teams should treat this like a planned migration with change control and capacity testing, not a last-minute toggle.

Microsoft Fabric expands encryption and OneLake security

Fabric added customer-managed key (CMK) encryption for the Spark processing layer, extending key control beyond storage to data handled during Spark job execution on compute clusters. If you have compliance requirements that care about encryption boundaries during processing (not only at rest), this closes a common gap in lakehouse architectures.

OneLake security updates landed across SQL analytics endpoints and broader Fabric surfaces, including better nested Entra group resolution, more consistent column-level security (CLS) with group-based access, improved shortcut-backed table behavior for hub-and-spoke patterns, and expanded service principal support. There is also a broader OneLake security improvement post calling out Eventhouse and Fabric Graph coverage, a redesigned SQL Analytics Endpoint sync, performance improvements in the Secure tab, and OneLake security APIs moving to general availability.

Fabric Eventstream Outbound Access Protection controls data egress

This extends last week's outbound connectivity hardening story (where the emphasis was making egress explicit and auditable): Workspace Outbound Access Protection (OAP) now applies to Microsoft Fabric Eventstream, blocking outbound connections by default and requiring admins to explicitly approve external sources and cross-workspace destinations using data connection rules. This is a straightforward but meaningful shift: streaming pipelines often become accidental egress paths, and “deny by default” makes those paths explicit and reviewable.

If you operate Eventstream in environments with strict data residency or leakage concerns, plan for rule authoring as part of onboarding. Teams will likely need a lightweight process for approving destinations so security posture does not turn into operational friction.

Azure Network Security Perimeter updates its scale limits

Azure Network Security Perimeter updated its hard limits, including higher caps for perimeters and associated PaaS resources. At the same time, it introduces a stricter limit of 200 rule elements per profile, with a transition period running through 10/31/26.

For teams that modeled lots of fine-grained rules, this pushes you toward rule consolidation and design review before the transition window ends. It is worth inventorying current profiles now to avoid surprises when the stricter enforcement lands.

Securing AI agents and edges: governance for Copilot, APIM AI Gateway, MCP, and Front Door edge actions

Building on last week's focus on least privilege for agents and APIM-based AI gateway patterns, several updates this week were really about the same operational problem: how to govern “code that runs on your behalf,” whether that is a Copilot client, an AI agent calling tools via MCP, or programmable compute running at the edge. The consistent theme is tightening policy, isolation, and observability so you can adopt these capabilities without turning them into new uncontrolled execution surfaces.

GitHub Copilot adds more enterprise governance (managed settings and remote control)

GitHub extended enterprise managed settings coverage to the Copilot app and Copilot cloud agent, expanding where managed-settings.json can centrally enforce controls. This matters for organizations trying to standardize things like plugin/marketplace access, approval prompts, and default model selection behavior across multiple Copilot clients rather than managing each surface independently.

Separately, GitHub added an enterprise managed setting named remoteControl to restrict remote control to managed devices, with modes like requireSSO, disabled, or enabled. If you are concerned about remote control features becoming an unmonitored path into developer environments, this gives you a policy lever that aligns with device management and SSO posture.

Azure API Management AI Gateway tier (preview) for models and MCP servers

This is a direct continuation of last week's APIM-first governance approach (token limits, policy enforcement, and central telemetry): Azure API Management introduced an AI Gateway tier in public preview aimed at publishing and governing AI models and MCP servers. The positioning is practical: apply policy-card controls (JSON) to AI traffic, emit OpenTelemetry token metrics, and integrate with Azure Policy and common observability backends so AI usage is governable like any other API surface.

It supports multiple model providers, including Microsoft Foundry and external hosts, which is important for hybrid model strategies. If you are already using APIM as the front door for internal APIs, this preview suggests a path to bring AI endpoints under the same policy and telemetry regime.

MCP adoption in .NET and production agent deployment guidance

Following last week's MCP Enterprise-Managed Authorization (EMA) and least-privilege tool binding guidance, Microsoft Agent Framework for .NET added MCP-based Agent Skills so agents can discover and load skills from an MCP server on demand using the Microsoft.Agents.AI.Mcp package and the UseMcpSkills builder API. The security angle is explicit: the post calls out safety controls for archive-based skills, which is a real concern when “skills” can become a code distribution mechanism.

In parallel, guidance on deploying Microsoft Hosted Agents to Microsoft Teams walked through identity (Entra ID), observability (OpenTelemetry and Application Insights), and packaging (Adaptive Cards and a declarative agent package). Taken together, these posts underline that agent security is not only model choice, it is also authentication, tool boundaries, telemetry, and controlled distribution paths.

Azure Front Door edge actions architecture emphasizes isolation and resiliency

Building on last week's introduction of Azure Front Door edge actions in preview (and the idea that edge logic becomes a new policy surface), Azure Front Door edge actions got an architectural deep dive focused on how programmable edge execution can be inserted into the request path while preserving hyperscale performance. The post emphasizes tenant isolation via Hyperlight micro-VMs, plus resiliency patterns like fast-fail and fallback mechanisms (including circuit breakers and fail-open options).

For teams considering edge compute for security controls (request validation, routing decisions, lightweight auth logic), the details here matter because they define your failure modes. The mention of Game Days is a useful operational cue: you should test edge action behavior under fault conditions, not only happy-path latency.

Application and code security: CodeQL, Fetch Metadata headers, and Azure weekly notes

CodeQL 2.26.1 improves accuracy and framework coverage

This is a natural follow-on to last week's GitHub push to surface more security signals earlier in PRs (including AI detections and agentic autofix): CodeQL 2.26.1 shipped with improved framework modeling across Go, Java/Kotlin, and JavaScript/TypeScript, plus query updates designed to reduce false positives and expand detection coverage. Specific examples include Angular @HostListener message handler modeling, a Spring WebFlux WebClient SSRF sink, updates to a Rust hard-coded cryptographic value query, and improved Go log/slog modeling.

The release is automatically deployed for GitHub code scanning on github.com, with rollout to a future GitHub Enterprise Server version and manual upgrade options for older GHES installs. If you rely on custom query baselines or have noisy findings today, this is a good time to re-run scans and see whether accuracy improvements reduce triage load.

Fetch Metadata headers help harden CSRF defenses

A deep technical guide broke down Fetch Metadata request headers like Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User, explaining how servers can use them to spot suspicious cross-origin requests. The security value is that these headers let you build stronger CSRF defenses that go beyond relying on Origin/Referer and brittle allowlists.

For web app teams (especially APIs serving browsers), this is a practical hardening pattern: enforce expectations like “this endpoint should only be called from same-site navigations” and reject cross-site fetches early. The post also connects the ideas to .NET 11 context, which helps if you are implementing middleware-based enforcement.

John Savill's weekly Azure update included a grab bag of platform changes, with a few security-relevant items called out explicitly, such as Azure Enclave and Azure Key Vault symmetric keys. Even when the update spans multiple areas (AKS, networking, monitoring, data), it is a useful format for tracking “small” platform changes that can affect security posture and compliance planning.

If you manage Azure environments centrally, these weekly roundups can help you spot changes that deserve policy review, like networking behavior adjustments or new key management capabilities, before they quietly become assumptions in production environments.

Other Security News

A few additional items this week were more operational than threat-focused, but they still affect security outcomes because they touch identity bindings, state backends, and the reliability of security boundaries when projects move or dashboards get embedded.