Databricks defender Solomon Boyd and four colleagues mapped a familiar break-in. A remote attacker signs in with a stolen token or cookie and works inside the Data + AI Platform with no exploit.
The Databricks detection guide walks through six stages of that intrusion and how to spot the behavior shift in verbose audit logs with Genie. Boyd, Alexis Merritt, Arun Pamulapati, Sam Pezzino and David Veuve wrote it as operators, not theorists.
Having a key does not mean you know the building.
Their running example is a data engineer whose personal access token leaks from a misconfigured CI/CD log. Databricks says the token is reused within minutes from a new IP to list secret scopes, catalogs and repos the engineer never touched, then to read a secret holding a service-principal credential. An hour later that second identity creates a function, joins an admin group and exports init scripts, which means a search scoped only to the engineer misses the payload.
The tell is what happens after accounts.tokenLogin, the authors warn. They flag token logins in a burst from an unfamiliar client followed by reuse from a new IP, service-principal OAuth minted with an unexpected user agent, and five or more distinct discovery APIs in one minute such as secrets.listScopes, unityCatalog.listCatalogs and repos.listRepos. They treat secrets.listScopes alone as noise, but listScopes followed by listSecrets then getSecret across scopes as harvesting, and they urge teams to keep failed IpAccessDenied events because replay from a blocked network is often the first record.
That focus on valid logins fits wider numbers. Stolen credentials started 22% of breaches in the 2025 DBIR data and appear in 39% of breaches in 2026 tracking, with average breach cost at $4.99M, per DeepStrike compilation of the data. Separate Databricks hardening guidance says MCP servers and AI agents that query Databricks act through a token or service principal like any integration and should get their own service principal with narrow Unity Catalog grants. It is a useful pairing with Databricks bets its HQ on agents that remember, since memory makes agent identities worth isolating.
For response, Databricks says follow both identities after a secret read, tie reads to new tokenLogin or generateTemporaryTableCredential calls, and rotate every credential the suspect identity could have reached. The limit is stated plainly. Login alone rarely warrants an alert, and query text in commandSubmit only appears when verbose logging is on, so shops without it keep less evidence and face more tuning.
The authors never said how many live intrusions Genie has linked end to end, or what the false positive rate looks like when data teams list and read secrets as part of normal automation.
