China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants

China-linked attackers used an AI-driven framework to automate credential abuse across more than 2,250 Microsoft 365 tenants, showing how agentic AI can dramatically increase the speed and scale of cloud compromise. For CIOs and IT leaders, the key implication is that third-party applications and service principals now represent high-risk privileged identities that can bypass human MFA workflows, making identity governance, automated containment, and continuous monitoring essential parts of cyber resilience. The incident underscores that machine-speed attacks can outpace manual SOC response, so organizations must treat vendor integrations as privileged access paths and plan for automated response to suspicious authentication patterns.