An AI agent platform was breached, and the attacker went after the keys agents use

On May 21, Composio disclosed a security breach (Composio). Composio is a platform that connects AI agents to the apps they work in, like GitHub, Gmail, Slack, Notion and Linear. The attacker got away with 5,001 GitHub access tokens and reached an auxiliary cache holding 5,241 Composio API keys, all of which the company revoked, according to AgentRiot’s account of the incident.

Those tokens are the keys agents use to act on a company’s behalf. Whoever holds one can do what the agent was allowed to do.

If your company connects any AI tool to its systems, this is the incident to study. It’s a preview of where attackers will go as more work runs through agents.

How the attack worked

The path in, as AgentRiot summarized Composio’s disclosure, went like this.

The attacker used exploit patterns generated by a language model, plus brute force, to reach an internal agentic tool Composio used to monitor its own infrastructure.
That monitoring tool had access to automated systems that fix broken connections. The attacker abused that access.
From there, they registered malicious tool definitions inside the sandbox where tools run, and chained steps until they could run any code they wanted.
They pulled credentials out of an auxiliary cache.

About 0.3% of active connections were affected. GitHub was hit hardest, and some Gmail, Slack, Notion and Linear connections were reached too. Composio rotated credentials, limited API keys to the IP addresses customers had used before, and paused new releases.

Read the second step again. The entry point was an internal agent with more access than it needed. Its job was to watch for failures. It also had a path to the systems that change things. That gap is the whole story.

FlowThe path into Composio

01AI-generated probing
02Internal monitoring agent
03Automated repair systems
04Malicious tool definitions
05Credential cache emptied

Each step used access the previous system already had.

The same week, attackers went after coding agents

On May 22, the security firm Socket detected the first package in a campaign it named TrapDoor. By May 24 it had found 34 malicious packages with 384 versions across npm, PyPI and Crates.io, the public libraries developers pull code from (AgentRiot).

The packages had names aimed at crypto and AI developers, like llm-context-compressor. When installed, they hunted for SSH keys, cloud credentials and GitHub tokens. They also planted instruction files, .cursorrules and CLAUDE.md, with hidden characters inside. Those hidden instructions tried to get AI coding tools like Cursor and Claude Code to run a “security scan” that actually sent secrets out.

That’s a new kind of attack. The target isn’t a person clicking a bad link. It’s the instructions file an agent reads before it starts work.

TimelineA week of attacks on agent tooling

May 21Composio incident window, 1:05 to 9:15 AM PT
May 21Composio discloses the breach
May 22Socket flags first TrapDoor package
May 2434 malicious packages identified

What to lock down

None of this means you should stop connecting agents to your systems. The work agents do depends on that access. It means you should treat every connection as a key to the building and manage it that way.

1. Make a list of every connection. Write down every AI tool, agent and integration platform that holds a login, token or API key to a company system. Include the ones individual employees set up. If nobody at your company has written this list down, that’s the first problem to fix.

2. Give each agent its own credentials with the least access it needs. An agent that reads support tickets doesn’t need to close them. An agent that drafts emails doesn’t need to send them. Composio’s entry point was a monitoring tool that could also reach repair systems. Ask of every connection: what’s the worst this key could do in the wrong hands?

3. Know how to revoke each key at the source. If a vendor in the middle gets breached, you need to cut access at GitHub, Google or Slack directly, fast. Find out now where each token is issued and who in your company can revoke it.

4. Treat agent instruction files as code. If your developers use AI coding tools, files like CLAUDE.md or .cursorrules now steer what those tools do. Review changes to them the way you’d review any code change, and be careful about new packages pulled in from public registries.

5. Watch the internal agents, too. The tools your own team builds to monitor or fix things often get broad permissions because they’re internal. Those are the agents an attacker wants to reach first.

ChecklistAgent access check for this week

Every agent connection listed
Each agent has its own credentials
Send and delete rights removed where unneeded
Revoke steps written for each provider
Instruction files reviewed like code

Ask your vendors the hard questions now

Integration platforms like Composio exist because connecting an agent to dozens of apps is tedious work. The trade-off is that they hold tokens for many customers in one place. One breach in the middle reaches every company that connected through it. That doesn’t mean you shouldn’t use them. It means you should know how they protect what they hold.

Before you connect an agent platform to your systems, or this week if you already have, ask the vendor:

Where are our tokens and keys stored, and are they encrypted at rest?
Can we limit our API keys to our own IP addresses?
Which of your internal tools can read customer credentials, and what can those tools do?
If you’re breached, how fast will you tell us, and which of our connections can you revoke on our behalf?

A vendor that answers those plainly is one you can work with. A vendor that sends you a marketing page instead has told you something too.

Composio’s investigation pinned down an exact window: 1:05 to 9:15 AM Pacific on May 21. Customers could check their own logs for that window. That only works if you know which of your systems an agent platform can reach and you can see what happened in them.

Most of the work in an incident is figuring out what you’re exposed to. Companies that already have the list from step one can answer that in an hour. Companies without it spend the first days of an incident building it.

A 50-person company running a few agents can get this done in a day. Waiting until after an incident means doing it under pressure, while someone else holds your keys.

What to do this week

Ask every team lead to list the AI tools they’ve connected to company accounts, including personal setups. Give them a deadline of Friday.
For each connection, note what it can read, what it can change and who can revoke it.
Remove any send, delete or payment permission an agent doesn’t need for its current task.
If you use Composio or a similar agent integration platform, check its disclosures and rotate the keys it holds for you.
Add instruction files used by AI coding tools to your code review rules.