PERMISSION/PROTOCOL
Back to incident tracker

2026-05-21

HighVendor post

Composio Breached via LLM-Generated Attack Patterns — Agentic Monitoring Tool Pivoted to Automated Remediation Systems

Attacker brute-forced exploits using LLM-generated patterns to compromise Composio's internal agentic monitoring tool, escalating to remediation systems and stealing 5,001 GitHub tokens.

ComposioCredential exposureAgentic tool privilege escalation / credential exfiltrationComposio connector platform / internal agentic monitoring and remediation systems / GitHub OAuth tokens

What happened

Attacker compromised internal agentic monitoring tool via LLM-generated exploit brute-force, then registered malicious tool definitions to escalate to remediation systems and execute arbitrary code within the tool-execution sandbox.

Why it matters

5,001 GitHub OAuth tokens exfiltrated; credentials stolen across 26 connector types (Gmail, Slack, Notion, Jira, HubSpot, Render, Vercel, and more); all affected connections revoked; Composio paused all SDK/CLI releases pending investigation.

Missing authorization check

An authorization gate requiring a signed permission receipt before the agentic monitoring tool could invoke remediation actions or register tool definitions in the execution sandbox.

Would PP block it?

The attack succeeded in two stages: (1) initial foothold in the monitoring agent via infrastructure exploit — PP does not block network/application-layer exploits; (2) lateral escalation from monitoring agent to remediation systems and malicious tool registration — PP's Tool-Call Gate enforces that high-privilege agentic actions require receipts issued through an independent authority channel, not inherited from runtime context. Stage 2 is precisely what PP is designed to intercept. PP would not prevent the breach entry point but would sever the lateral escalation path that made it catastrophic.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-05-21

    Composio detects unauthorized access; incident response begins; initial bulletin published

  2. 2026-05-21

    Compromised toolkit list clarified in bulletin update; internal vs. external connection counts disclosed

  3. 2026-05-21

    All affected GitHub tokens revoked; impacted users contacted

  4. 2026-05-22

    Indicators of Compromise (IOCs) published; all SDK and CLI releases paused

  5. 2026-05-22

    External IR firm engaged; Zero Trust Proxy KMS roadmap announced

Technical breakdown

  • Attacker used LLM-generated attack patterns to systematically brute-force exploit combinations — AI-augmented offensive tooling accelerating vulnerability discovery at machine speed.
  • Initial foothold was an internal agentic monitoring tool with implicit elevated privileges to remediation systems — the agent's runtime trust was inherited rather than explicitly scoped.
  • Attacker registered malicious tool definitions inside Composio's sandboxed execution environment, demonstrating that sandbox trust boundaries can be violated if tool registration itself is unguarded.
  • Privilege escalation chain: monitoring tool → remediation systems → sandbox tool registration → arbitrary code execution — each step required no additional authorization receipt.
  • Attack surface extended across 26 connector types: 5,001 GitHub tokens plus Gmail, Slack, Render, Vercel, and others — the breadth reflects how deeply connector platforms aggregate third-party credentials.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Tool-Call Gate: any invocation by the monitoring agent of remediation system APIs or tool-definition registration endpoints would require a PP-signed receipt.
Still needs
The initial LLM-brute-force exploit against the infrastructure endpoint — PP does not provide application or network-layer vulnerability protection.
Receipt required for
Monitoring agent invoking automated remediation APIs; registering new tool definitions in the execution sandbox; accessing credential stores or OAuth token material.

PP's Tool-Call Gate and Credential Gate would have required an explicit signed authorization receipt before the monitoring agent could escalate to remediation systems or register new tool definitions. The initial foothold via LLM exploit brute-force is outside PP's scope, but the lateral escalation — the step that enabled credential exfiltration — hits exactly the enforcement boundary PP creates.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop