The Compliance Brief for SOC 2 prep

Every Tuesday, the incidents from the past week that trace back to a control your SOC 2 auditor will test, and what to check on your side.

Last reviewed 2026-09-29Written by Jacob Masse, TrazTech Inc.

Readiness work is easier to prioritise when you can see which controls are failing at other companies this month. Most weeks the answer is the same short list: accounts nobody switched off, keys left in build output, access that outlived the person who needed it.

Below are the stories from recent issues that map onto that list, each with the short version of what happened and what to look at before your own audit window opens.

Latest on the controls a SOC 2 audit tests

• A stolen OAuth token from a former employee's laptop Issue 8, September 29, 2026
  CrowdSec confirmed that attackers took the contents of 170 private repositories from its GitHub organisation.
• Your AI agents are logging in as humans and SOC 2 cannot tell Issue 8, September 29, 2026
  A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed.
• A departed employee's GitHub account was still live, and 170 private repos walked Issue 7, September 22, 2026
  CrowdSec disclosed that an attacker copied roughly 170 of its private GitHub repositories in May using the account of an employee who had recently left the company.
• A regulator has now logged an AI agent as the attacker Issue 7, September 22, 2026
  The Spanish data protection agency received a breach report describing an attack carried out by an AI agent running on a known large language model.
• Exposed Vite dev servers are being scanned for cloud keys Issue 7, September 22, 2026
  F5 Labs described an automated mass-scanning campaign hunting internet-exposed Vite development servers.
• Passkey enrolment is the new phishing target Issue 6, September 15, 2026
  Microsoft detailed two campaigns abusing third-party email delivery infrastructure.
• JFrog Artifactory flaw lands in the KEV catalogue Issue 4, September 1, 2026
  CISA added three actively exploited vulnerabilities to the Known Exploited Vulnerabilities catalogue: an ownCloud authentication flaw, an unspecified Linux kernel issue, and a path traversal issue in JFrog Artifactory.
• Rust crates that ran malware at compile time Issue 3, August 25, 2026
  The Rust Project removed malicious versions of three widely used crates from crates.io after a compromised maintainer account published releases adding a typosquatted dependency.

Every issue on SOC2Prep

• Issue 8: A stolen OAuth token from a former employee's laptop September 29, 2026, 2 stories on the controls a SOC 2 audit tests
• Issue 7: A departed employee's GitHub account was still live, and 170 private repos walked September 22, 2026, 3 stories on the controls a SOC 2 audit tests
• Issue 6: Passkey enrolment is the new phishing target September 15, 2026, one story on the controls a SOC 2 audit tests
• Issue 4: JFrog Artifactory flaw lands in the KEV catalogue September 1, 2026, one story on the controls a SOC 2 audit tests
• Issue 3: Rust crates that ran malware at compile time August 25, 2026, 2 stories on the controls a SOC 2 audit tests
• Issue 2: The LiteLLM fallout is a CI credential problem, not an AI problem August 18, 2026, 2 stories on the controls a SOC 2 audit tests

Every issue in full, including the stories outside the controls a SOC 2 audit tests, is in the archive on traztech.ca. Issues with nothing on the controls a SOC 2 audit tests are listed there and not here.

Questions