Day 2Unvetted software on a managed endpoint

I installed OpenPaw on my work laptop last night

João, Finance Manager

Why this one is dangerous

Nobody assessed the vendor, because there is no vendor. The employee ran a single command and put an autonomous agent on a machine that holds company data, with the ability to read files, run commands and reach other systems on their behalf.

That agent keeps its credentials on the laptop. In the most heavily analysed case, plain text keys for third party AI and cloud accounts sat in one configuration file in the user's home directory. Anything that reaches the machine reaches the keys. Reference 8

The add on marketplace is the second problem. Extensions install with one line and run with the user's permissions. Bitdefender's analysis of one such registry found close to 900 malicious extensions, around a fifth of everything published, delivering information stealers, reverse shells and silent credential theft. Reference 9

The exposure is measurable. Censys counted 21,639 of these agents reachable from the open internet on 31 January 2026, a twenty one fold rise inside a week. Later analysis put the number above 42,000, most of them carrying authentication weaknesses. References 7, 10

What has already happened

• The agent's own network, 31 January 2026

  Researchers at Wiz found the database behind the agent's companion social platform running with row level security switched off, and its API key visible in the page source. 1.5 million authentication tokens, 35,000 email addresses and private messages between agents were exposed, some of those messages containing plain text keys for other AI accounts.

  Access allowed reading and writing, so any agent on the platform could be impersonated. The platform was taken offline and keys were reset.

  Wiz discovery404 Media independent verificationReference 8

• Corporate networks, February 2026

  Bitdefender documented four live attack campaigns against the same agent, reaching corporate machines through one line installs by employees. One used a fake operating system update prompt to open an encrypted tunnel. One established a persistent reverse shell giving an attacker live terminal access. One read the configuration file holding cloud and AI credentials and sent the contents out.

  Malicious extensions were being published to the public registry every few minutes.

  Bitdefender technical advisoryReference 9

No organisation has publicly identified itself as having suffered a breach because an employee installed this agent. That is not evidence that none has. It is also not evidence that one has. What is documented is the exposure, the exploitation and the route in.

How to combat it

• Allowlist applications on managed endpoints. Treat a one line installer as an unmanaged change, because that is what it is.
• Block outbound access to agent gateway ports and alert on any new listening service on a staff machine.
• Scan user home directories for credential files and rotate every key found in one.
• Run vendor due diligence before approval, covering data location, retention, training use and sub processors. A project with no counterparty can offer you none of these.
• Publish a sanctioned tool catalogue with a request route that answers in days. The one line install wins because it is the fastest route, not because it is the best one.