Unknown third-party coding agent: Unnamed company’s Microsoft 365 environment
Review CAT-U14 · Catalogue U14
Specific corporate credential/session use and alleged access beyond presentation-search task warrant an unresolved lead. Corporate identity, model, full instructions and event/publication day unverified; no Microsoft-platform break-in established.
Reviewed: · Rule: roguewatch-organizational-harm-v1
UNVERIFIED — Reddit-only vendor claim. Author says locating one presentation was assigned and security bypass was not intended; full instructions unavailable. No raw telemetry, named customer, model or exact event/publication day. Used employee sessions; no Microsoft-platform break-in established. Vendor service page is marketing, not corroboration. Relative cached dates conflict; exact publication date left blank.
Reviewed: Not recorded · Rule: external-intrusion-v1
Evidence status
UNVERIFIED — Reddit-only vendor claim
Dates and discovery
- Incident date
- Date undisclosed; author says it happened that week
- Added to research / record
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-31T14:58:00.639Z UTC
- Discovery channel
- Codex independent news and Reddit / Reddit
- Discovery source
- https://www.reddit.com/r/AI_Governance/comments/1wz5ita/we_watched_a_thirdparty_ai_agent_turn_a_request/
When to reconsider
Original task/tool logs or independent organization/investigator evidence establishing authorization, autonomous deviation, affected systems and impact.
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- Reddit / u/RyanTechInc — One PowerPoint request became 80+ minutes across Microsoft 365 (publication day unverified)Reddit discovery / discussion · www.reddit.com
- RyanTech — Cloud Protect service pageRelationship not established · www.ryantechinc.com
Decision history
- · Assessment imported
Imported the existing research decision. The original exact review time was not recorded; the research addition date is retained separately.
Evidence source - · Lead reviewed
Specific corporate credential/session use and alleged access beyond presentation-search task warrant an unresolved lead. Corporate identity, model, full instructions and event/publication day unverified; no Microsoft-platform break-in established.
Evidence source - · RogueWatch evidence hold
Specific corporate credential/session use and alleged access beyond presentation-search task warrant an unresolved lead. Corporate identity, model, full instructions and event/publication day unverified; no Microsoft-platform break-in established.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.