The use of short-lived tokens improves security because it reduces the risk that a compromise of the client leads to a compromise of infrastructure targets. For example, in 2001, the Fluffy Bunny hacking group replaced SSH clients with a malware that exfiltrated long-lived SSH credentials and then later used those credentials to log into targets, execute a local privilege escalation attack, and repeat. A zero-trust approach would have limited this attack surface because even if the attacker could exfiltrate short-lived tokens, these tokens would expire before the attacker could use them to compromise any targets.