Security researcher Aleksandr Krasnov has sounded a warning bell about a hidden threat lurking in cloud systems, where dormant nonhuman identities can create security blind spots. These “ghost credentials” – tokens, agents, and service accounts living outside traditional trust boundaries – can move laterally through the environment, escalating privileges to access sensitive systems.
Krasnov’s discovery came after investigating an anomaly involving an AI-enabled workflow agent that had been idle for 30 days before suddenly firing off API calls at unusual times. The investigation revealed a mesh of ghost credentials and nonhuman identities (NHIs) that were not accounted for in the organization’s trust models. This incident, while seemingly minor, exposed a larger problem: organizations have lost track of what and who they trust in heavily automated, AI-based environments.
The issue is particularly concerning because NHIs can quietly sit outside conventional trust models, often with elevated permissions. Krasnov notes that an attacker can choose between spending weeks creating a phishing campaign or just minutes hunting for exposed tokens. The latter path using ghost credentials is likely the preferred option.
To help organizations address this blind spot, Krasnov has developed an open source tool called NHI Hound. This tool ingests identity data from providers like Okta, GitHub, and cloud IAM platforms, exposing hidden trust links between human and nonhuman accounts. It also simulates worst-case abuse paths to show defenders which dormant credentials lead into production environments or identity-provider admin roles.
NHI Hound not only identifies NHIs but also collects an inventory of an organization’s full catalog of NHIs and human identities, classifying them by trust-severity levels. The tool suggests remediation steps for “critical” conditions where low-trust identities can perform the same actions as super-admin accounts due to implicit or inferred trust relationships.
Informal testing with small and midsize companies has shown promising results, but Krasnov notes that larger enterprises face a more severe problem. As organizations grow beyond 2,000 employees, their identity graphs become increasingly complex, making it difficult to track identities and prioritize remediation efforts.
While NHI Hound shows promise in tackling this issue, its limitations are evident. Smaller organizations can realistically clean up their NHI trust graph within six to nine months using the tool, but larger enterprises may struggle to address the problem due to the sheer scale of their identity graphs. Krasnov plans to improve the tool’s visualization and usability to make it more effective for larger organizations.
As a takeaway for security-aware readers, the discovery highlights the importance of regular trust reviews in heavily automated environments. Organizations should consider implementing tools like NHI Hound to identify and address hidden trust relationships between human and nonhuman identities. By doing so, they can reduce the risk of security blind spots and ensure that their cloud systems remain secure despite the growing complexity of their identity graphs.
Source: Dark Reading — 2026-07-28