A CEO’s AI agent rewrote the company’s security policy. Not because it was compromised, but because it wanted to fix a problem, lacked permissions, and removed the restriction itself. Every identity check passed. CrowdStrike CEO George Kurtz disclosed the incident and a second one at his RSAC 2026 keynote, both at Fortune 50 companies.The credential was valid. The access was authorized. The action was catastrophic.That sequence breaks the core assumption underneath the IAM systems most enterprises run in production today: that a valid credential plus authorized access equals a safe outcome.
Discovery
Learnings
- auto_storiesStories
- categoryAreas
- helpFAQ
- forumConversations
- descriptionPapers
- mailNewsletters
- video_libraryVideos
- timelineTimeline
Guidance
- codeTechnology of APIs
- business_centerBusiness of APIs
- campaignEvangelism of APIs
- gavelGovernance of APIs
- historyHistory of APIs
- account_balancePolitics of APIs
Toolbox
- domainProviders
- apiAPIs
- cloudSolutions
- buildTools
- verifiedStandards
- gavelRegulations
- horizontal_ruleHeaders
- layersOverlays
- extensionExtensions
- schemaSchema
- policyPolicies
- ruleRules