OIDF publishes threat model for cross-boundary AI agents #
Published October 12, 2026
Organizations are rolling out AI agents faster than they are building the systems needed to identify those agents and control what they are allowed to do.
One of the key points at which this becomes a problem is when an agent crosses a security boundary. For example, an agent hosted with one provider may need to call tools or services hosted by another. Each side has its own rules for identity, trust, and permissions.
This is where gaps appear and where engineers may take shortcuts. It is within those shortcuts that security can break down.
To help address this, the OpenID Foundation's Artificial Intelligence Identity Management Community Group (AIIM CG) has published a new paper: A Protocol-Agnostic Threat Classification for Cross-Boundary AI Agent Authorization.
Sarah Cecchetti, Director of Product Management for Semperis and Chair of the AI Threat Modeling Group (a subgroup of the AIIM CG), said: “Organizations will always need to connect AI agents across platforms. This paper sets out what can go wrong when agents cross from one platform to another. It is a threat model, not a solution. We wanted to give architects, security teams, platform providers, and standards bodies a shared starting point. By naming these threats clearly, we hope to give the industry a common reason to work toward interoperability. This is a baseline, and we plan to build on it with further work on authentication, authorization, and mitigation guidance.”
The paper argues that no single gateway will ever control all agent traffic. Each major provider runs its own gateway, on its own assumptions, and none will hand that role to a competitor. The threats the paper identifies come from crossing these boundaries, whatever protocol or specification is used. It covers:
Many of these threats are familiar from user federation, but agents run them at machine speed. The paper argues that treating an agent as if it were a human user is the common root of all of them.
Architects should map every trust boundary their agents cross. They should confirm what each identifier, scope, and token means on both sides. Security owners should invest in authorization-time controls rather than relying on detection after the fact. Standards bodies and providers should treat interoperability as a security control.
The OpenID Foundation thanks the members of the AIIM CG for their work on this paper, and in particular the Threat Modelling and Taxonomy Subgroups. It gives the community a clear, shared basis for the next stage of work on agent identity and authorization.
The full paper can be found here. The OpenID Foundation (OIDF) is a global open standards body committed to building trusted identity ecosystems. Our mission is to lead the global community in identity standards that are secure, interoperable, and privacy respecting. Founded in 2007, we are a community of technical experts. The Foundation's OpenID Connect standard is now used by billions of people across millions of applications. More recently, the FAPI security profile - built on OAuth 2.0 - has become the standard of choice for interoperable Open Banking and Open Data implementations, while OpenID for Verifiable Credentials specifications are underpinning a new generation of digital wallets. Today, the OpenID Foundation's standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling "networks of networks" to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.