Our miner found a slick cloud token-theft attack chain. We killed it.
Here is a finding that did not survive — and why publishing the ones that fail is as useful as publishing the ones that work.
The discovery engine's link-prediction miner proposed a clean, phase-ordered cloud-identity kill chain:
AiTM / OAuth consent phishing → session cookie/token theft → pass-the-cookie / token replay → cloud session hijack → OAuth-grant / role persistence
It came with the kind of numbers that get a hypothesis promoted: an Adamic–Adar score of 0.94, a Jaccard of 0.58, drawn over a 228-attack enriched subgraph. It reads like a real adversary playbook. It mapped cleanly onto cookie-theft and friends. It was tempting.
Why we refused it
The validation harness runs every candidate past four gates — coverage artifact, statistical soundness, prior art, and an adversarial critique. This one failed three of them.
It was technique near-duplication, not sequencing. Every precedes edge the miner drew sat between two records that share an ATT&CK (sub)technique id. So the similarity scores were measuring how alike the techniques are, not whether one actually precedes another in an attack. The graph was admiring its own reflection.
It failed its own falsification test. We required a real chain to be phase-monotone — each step no earlier in the kill chain than the last. The full seven-node minimum-phase sequence came out 6, 11, 11, 13, 13, 6, 5. That goes backwards. By the criterion we set before looking, it is not a chain.
One link was invented. The "token replay → console hijack" step that made the narrative feel complete was never a mined edge at all — it was stitched in to tell a better story. That is exactly the kind of plausible-sounding glue a language model adds and a gate has to catch.
And it was already published. The real chain — cookie theft to business email compromise — is well documented (Microsoft's 2022 write-up; the 2024–2025 AiTM / pass-the-cookie research) and maps to known techniques (T1528, T1550.001/.004, T1098.003) with existing mitigations. Even if the graph had held up, there was no new defensive knowledge to add.
Why this is the point
It would have been easy to ship a confident post about an "emerging cloud identity kill chain." The numbers supported it and it was on-trend. It was also wrong, and a defender who built detection around our invented token replay → console hijack edge would have wasted their time.
Of the two dozen hypotheses in the engine's first full pass, most did not survive — and we record every one, refuted included. A research system you can trust is one that tells you what it threw away.
Grounded in discovery record attack-chain-debb49f055bb (status: refuted). See the research section for the full discovery pass and its gate verdicts.