A 214-day-old OAuth grant belonging to Mira Chen was refreshed from an unfamiliar network and used to assume svc-ledger-prod, which then read the payments signing key. Three hops are confirmed by telemetry; everything past the key is modelled, not observed.

Predicted next · Forge a signed request to the payments API to confirm the key is still accepted (72% · next 3–6 minutes) · confidence 87%

The finance agent's payment ceiling was raised to $50k yesterday and a vendor bank account was edited within the same window. Three drafts now target that vendor. Both changes are individually legitimate; together they remove the control that would normally stop a redirection.

Predicted next · Drafts clear the approval queue and enter the next settlement batch (57% · next 5–15 minutes) · confidence 74%

The support agent's retrieval and CRM query volume is nine times its median, and a knowledge-base document it consumes was edited by an unverified author. No exfiltration has been observed; this currently reads as scope creep or prompt influence rather than confirmed compromise.

Predicted next · Continue widening customer queries beyond assigned tickets (66% · next 5–10 minutes) · confidence 61%