Independent researcher Aridio Silva published the fourth article in the SGAEIA research series, arguing that authenticated identity between autonomous AI agents does not by itself confer operational a…
Permit.io published a practical checklist mapping SOC 2 CC6/CC7 and ISO 27001 Annex A access controls to AI agents, arguing that existing compliance evidence models assume human users with provisioned…
WorkOS published a 2026 AI agent permissions checklist for SaaS apps, organized by lifecycle stage from design to revocation, with eight core controls including giving every agent its own identity sep…
The official Model Context Protocol TypeScript SDK released version 2.1.0, adding DPoP sender-constrained access tokens (RFC 9449, shipped as SEP-1932) and request-time OAuth scope challenges from the…
A developer has published a credential-isolation pattern for MCP servers that places a trusted gateway between an AI agent and the MCP servers it calls, so the agent process never holds the API keys o…
Microsoft said Tuesday it led an industry-wide disruption of EvilTokens, a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts belonging to 10,000 organiza…
Okta posted an on-site Senior Software Engineer role for its Agent Gateway team in Toronto, Ontario, paying CAD 136,000–187,000 per year plus equity and requiring 4+ years of production backend experi…
A developer scanned the official MCP registry's 32,380 unique servers and found that of the 2,967 advertising OAuth, only 8% meet all of the July 2026 authorization spec requirements. While older OAut…
A developer built a demo app using Kinde webhooks and a pre-action authorization check to revoke a Claude agent's access when its user is offboarded mid-task. Testing showed that suspending a user in …
A developer analyzed 35 days of Claude Code MCP connection logs covering 27,257 connections and found that OAuth token refreshes inside the connection window make sessions 5.8× slower (3,170 ms median…
Know Your Agent (KYA) uses a machine-readable, transaction-scoped credential to prove an autonomous agent's identity and authorization, complementing OAuth, API keys, machine identity, and traditional…
A developer outlined a layered architecture for AI agent authentication, arguing that no single protocol suffices and that discovery, workload identity, request authentication, and delegated authoriza…
Agent identity for AI agents depends on four distinct layers — KYA (Know Your Agent), authentication, authorization, and payment authorization — with payment authorization remaining the least-solved l…
The Model Context Protocol (MCP) specification offers two client registration options for remote MCP servers: pre-registration, akin to a dinner party where clients are known in advance, and automated…
An engineer argues that OAuth tokens alone do not provide an operational identity for AI agents, and that systems need a governed identity model that tracks an agent's lifecycle, authority, and purpos…
METR, an AI model evaluation nonprofit, disclosed that a fail-open authentication flaw in a researcher's personal AWS-hosted AI agent orchestration dashboard allowed an attacker to steal API keys, est…
A developer building an AI avatar live streaming system on Twitch encountered several integration pitfalls, including Twitch silently accepting invalid stream keys and OAuth authorization codes expiri…
A security researcher discovered a server-side request forgery vulnerability in an AI SDK's OAuth metadata discovery process. The SDK, which handles authentication for MCP servers, failed to validate …
A developer compared direct database connections with brokered connections using the Model Context Protocol (MCP) for AI assistants, highlighting security and workflow trade-offs. The analysis shows t…
An engineer argues that the Model Context Protocol (MCP) solves tool interoperability but does not address business authorization, using an employee-offboarding example to show that a valid tool call …