AIDEFEND in Action AIA-0005 Validated Research Published: Apr 18, 2026

Bain Pyxis: Exposed Frontend Credentials and SQL Injection Reach Data and Identity Operations

CodeWall found working credentials in a public Pyxis JavaScript bundle and established a session in 18 minutes. A subsequent SQL-injection path ran under a broadly privileged database account; a separate GraphQL path allowed identity-directory operations. These are distinct authentication and authorization boundaries. CodeWall reported remediation by March 19, 2026, and verification-only testing, not malicious exploitation.

Credential TheftData ExfiltrationIdentity & AccessEnterprise AIAgentic AI
3 applicable AIDEFEND defenses
Source: How We Hacked Bain's Competitive Intelligence Platform 
Author: Paul Price (CodeWall)
Original article: Apr 13, 2026

Threat Analysis

  • Initial access. Public frontend credentials enabled platform login; CodeWall inferred an AI service-account role from the redacted identity.
  • Database boundary. SQL injection reached 11 databases under an overprivileged backend account. Reachable data does not establish wholesale exfiltration.
  • Separate escalation surfaces. The report identifies GraphQL identity writes, logged JWTs, exports and database cloning. The system prompt was exposed through conversation metadata, not a demonstrated prompt table.
  • Response. CodeWall reported all findings remediated before publication.

Applicable AIDEFEND Defenses (3)

AID-H-004.002
Service & API Authentication
High
Use a dedicated backend machine identity with verified issuer, audience and fresh credentials kept outside frontend artifacts and logs. Independently test every database and GraphQL authentication path. Authentication identifies the caller; it does not reject a stolen valid credential by itself. H-018.002 separately restricts database, prompt-metadata and Okta operations, and exposed credentials require revocation.
AID-H-018.002
Policy-Based Access Control
High
At every AI database, export and administrative adapter, resolve the verified caller and exact resource from authoritative records and default-deny operations outside the approved task. Check data class, destination and tenant before effects, including access to system prompts through conversation metadata. Remove raw-SQL and direct API paths that bypass the decision; valid authentication does not confer blanket database or identity-directory authority.
AID-H-017.002
Least-Privilege Tool Architecture
High
Pyxis exposed raw SQL and bulk-export primitives behind the AI platform. Replacing catch-all database tools with narrow, single-purpose functions for approved questions, schemas, and export paths would reduce the blast radius even if one service credential leaks.

What Defenders Should Do Now

  • Revoke exposed credential objects at their issuers and separately assess already-issued tokens, sessions and any accounts created through the identity-write path. Removing a frontend copy or rotating a root password does not prove those objects are unusable.
  • Constrain database, export and identity operations by exact task, resource and destination; remove generic SQL or direct-API bypasses.
  • Test secret detectors against actual frontend bytes and relevant credential formats before publication and on deployed bundles.
  • Run authorized regression and red-team tests and record scope, prerequisites and reproducible results.

2 additional considerations

Frontend build secret detection as a release gate

Scan the exact frontend bytes before CDN publication and test that the organization's detector recognizes the relevant credential formats. Repeat against deployed artifacts; secret scanners can miss unknown formats and a passing scan is not proof of absence. The public bundle in this research exposed a credential, while effective authorization still determined its reach.
Recommendation: Wire a gitleaks / trufflehog-style scanner into the frontend CI pipeline with builds blocked on any high-confidence credential match; pair it with a weekly sweep of already-deployed bundles and a standing incident playbook for any hit found in production.

Autonomous offensive testing as a routine operational control

CodeWall reported that its agent found this chain. The publication supplies no independent matched comparison establishing that autonomous testing is generally superior to human testing. Add authorized, bounded regression and red-team tests that exercise authentication, SQL construction, identity writes and secret exposure, and record their coverage.
Recommendation: Use autonomous tests alongside other AppSec methods and independently reproduce findings; passing a test suite is not proof that all vulnerabilities were found.

Conclusion

Pyxis shows why exposed credentials and excessive backend authority must be addressed together. Keep machine credentials outside browser artifacts, enforce exact object and action authorization, and reduce tool authority. Protecting prompt metadata is an access-control requirement; structural instruction/data separation does not provide prompt confidentiality. AIDEFEND  mappings identify controls a team can implement and verify, rather than certify that the affected platform already has them.

Last updated: