A leading blockchain analytics company has revealed details of a security breach involving an AI agent.
Chainalysis said in a post on October 30 that an external actor used “offensive agentic techniques” to gain unauthorized access to undisclosed internal systems and tools.
“Some non-sensitive customer data, such as user IDs, full names, email addresses and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users,” it continued.
“We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete.”
Read more on agentic attacks: AI Agent Carries Out Multi-Stage Data Theft Attack.
Chainalysis clarified that the incident is unrelated to the Binance heist last week. It also claimed to have no evidence that the threat actor was able to access investigation content like graphs, notes or cases, or transaction query results.
These sensitive pieces of data could allow an unauthorized third party to snoop on blockchain investigations carried out by Chainalysis customers. The firm has been busy this week helping the community to understand who carried out the Binance raid, for example.
The firm also said that it had no evidence that clear-text passwords, multifactor authentication (MFA) secrets or user session tokens had been accessed, meaning customer accounts should be safe.
A Warning for Customers
However, Chainalysis did warn customers about possible follow-on attacks.
“Chainalysis users should continue to be hyper-vigilant of unexpected password reset requests or authentication prompts,” it said.
“If your organization has not yet enabled two-factor authentication, we strongly recommend doing so. Your Chainalysis account manager can help you complete that process.”
The firm said it has been working “around the clock” to investigate the unauthorized activity, patch any affected vulnerabilities and harden its systems.
“We have engaged world-class third-party cybersecurity experts and are using sophisticated large language models to support a broader review of our platform’s security and strengthen our defenses,” it added.
“This work extends beyond the exploited vulnerabilities to enhance our security posture across the platform.”
Image credits: Wirestock Creators / Mamun_Sheikh / Shutterstock.com