Daily AI brief · October 24, 2026
Hackers' AI Went After 2,250 Companies' Microsoft 365
Hackers used AI to reach into Microsoft 365 accounts through a backup tool many IT companies use, and 1Password now lets AI assistants sign in for you without ever seeing the password.
Hackers used AI to go after Microsoft 365 accounts through ConnectWise's backup service (Microsoft via Reuters, Dark Reading, BleepingComputer, Help Net Security) ConnectWise makes software that many IT companies use to look after their clients, and one piece of it, Cloud Backup, keeps copies of those clients' Microsoft 365 email and files. Attackers took over several of the app accounts that backup service uses to connect to Microsoft 365, and ConnectWise switched the service off on October 17. On Wednesday Microsoft named the group behind it, a China-aligned crew it calls Storm-0940, and said it used an open-source AI hacking tool to automate the attack and try to reach more than 2,250 customer accounts. Most attempts failed, but in some cases it went from first contact to high-level access in under three hours. The security firm Huntress had already confirmed unauthorized sign-ins at 162 of them by October 16. In its latest update on Thursday, ConnectWise said it was restoring service in phases over several days, that the stored backups are encrypted and show no sign of being touched, and that it hasn't confirmed harm to any end customer. It also warned that shutting off its side does not remove access an attacker may already have inside a customer's account. You probably never bought ConnectWise yourself, which is exactly the point: if an IT company manages your Microsoft 365, ask them this week whether they use ConnectWise Cloud Backup for you. If they do, ask what they checked in your account for unfamiliar apps and sign-ins, and how your email is being backed up while the service is down.
1Password now lets AI assistants sign in for you without seeing your password (1Password, 9to5Google, Engadget, Winbuzzer) 1Password launched 1Password for Agents on Thursday. When an AI assistant reaches a login page, it asks 1Password for the login, you see which one it wants and why, and you approve it on your own phone or computer. 1Password then types the password into the page itself, so the assistant never sees it or keeps a copy. It works with Meta's Muse, OpenAI's ChatGPT Work and dots, xAI's Grok Bot and Town, with Anthropic's Claude Duet listed as coming soon. Winbuzzer reports it's included at no extra charge on 1Password Individual and Family accounts; the announcement doesn't spell out the business plans. The practical part: once an assistant is signed in, it can still do anything that account can do, so the approval tap matters. But this is a far better habit than the shortcut people take now, which is pasting a password into the chat so the assistant can get on with it. That copy sits in a chat history you no longer control.
If you run a plumbing, HVAC or electrical shop: picture the supply order. The dispatcher asks an assistant to price out tomorrow's parts on the supplier's website. It reaches the login page and asks for the account. The dispatcher's phone shows which login it wants and why, they tap approve, and the assistant builds the cart. Then it stops, and the dispatcher checks the quantities against the job tickets and places the order. The AI does the clicking; a person still owns the login and the final click.
Make one list of who holds your keys. Ten minutes with whoever runs your IT: write down every outside company or tool that can sign in to your Microsoft 365 or Google Workspace, like backup, email security, your phone system and any AI assistant. Next to each, note who to call if it gets hacked. This week showed that an attacker doesn't have to get past your front door if a trusted tool already has a key.
Where it's going: more of the work in your accounts will be done by software signing in on your behalf, so the businesses that know every tool holding a key, and approve each login on purpose, will be the ones that can take the help safely.
- ConnectWise Cloud Backup breach and Storm-0940: [KFGO/Reuters, Oct 21](https://kfgo.com/2026/10/21/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-says/) · [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/amp/) · [Help Net Security](https://www.helpnetsecurity.com/?p=388341) · [CSO Online](https://www.csoonline.com/article/4237087/connectwise-backup-credentials-exposed-multiple-microsoft-365-tenants.html) · [Windows Forum, ConnectWise update](https://windowsforum.com/news/storm-0940-used-connectwise-apps-to-target-2-250-microsoft-365-tenants-microsoft-says.449484/)
- 1Password for Agents: [1Password, Oct 22](https://1password.com/press/2026/october/1password-for-agents-trust-layer-personal-ai-agents) · [9to5Google, Oct 22](https://9to5google.com/2026/10/22/1password-will-let-ai-agents-use-your-passwords-without-seeing-them/) · [Engadget](https://www.engadget.com/2293844/1password-opens-up-ai-agents-muse-dots-grok/) · [Winbuzzer, Oct 23](https://winbuzzer.com/2026/10/23/1password-expands-ai-agent-logins-without-sharing-passwords-xcxwbn/)