#agentic-ai

SWI's Agent Identity Standards Map 2026 dates the status of 70 specifications for AI agent authentication, delegation and authorization. Most of the problem is buildable on published OAuth and workload standards. The parts that make agents different, from delegation chains to an owner registry, are still drafts or nothing at all.

Chainalysis said on November 4 that names, usernames, password hashes and live tokens for all users were exposed, reversing its October 30 statement that no session tokens were accessed. It took KYT, address screening and its login page offline after abnormal activity.

Kantara Initiative's Digital Identity Risk group found that agentic AI needs a separate risk framework from its human-focused taxonomy, naming orphaned agent identities, dormant credentials, identity drift and agents posing as humans as the risks to plan for.

A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist, such as cloud credentials and SSH keys, when the operator ran a copy. Docker fixed it in v0.51.0 on November 3.

SWI's Identity Consolidation Report 2026 reads 63 identity acquisitions against the ownership of 297 tracked vendors. Identity companies make most of the deals; security, IT and data platforms pay almost all of the money. Five AI-agent identity vendors were bought in 87 days, and 67% of the market is still independent.

Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at some organizations. The usual way in was a stolen service account key, access key, GitHub token or session token.

WorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directory health metadata. It saw an AI-assisted offensive framework and no access to production or application data.

After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.

IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Upgrade to 1.13.0.

Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.

Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's APIs as them, including pulling private chats. OpenAI fixed it by October 26 and paid a $5,000 bounty.

Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to act on their behalf, and reminded them they are responsible for activity from shared credentials. A spokesperson confirmed the email to TechCrunch on October 27.

At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.

Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in secrets, certificate and privileged access management and in Agent Vault, which brokers AI agent access without exposing credentials.

Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research shows what that costs. The fix is an identity per agent, scoped to its task, with the human carried in the token through RFC 8693 delegation.

LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.

Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.

OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Console users had saved. Keys stored locally by the CLI and desktop apps were not affected. Some users report unexplained charges.

Workday signed a definitive agreement to buy C1.ai, the access governance vendor that renamed itself from ConductorOne in April. Price undisclosed, close expected by January 31, 2027. The plan is to tie access for people and AI agents to Workday's HR lifecycle.

IDEMIA Secure Transactions launched an Agentic Commerce offering for domestic schemes and private-label issuers that combines passkey cardholder authentication with payment tokens limited by merchant, amount, category or time, plus stored proof of consent for disputes.

Zero Networks launched Least Agency Enforcement at Black Hat USA 2026, implementing OWASP's emerging Least Agency principle with identity-based microsegmentation and default-deny network access for AI agents, plus MFA prompts on RDP, SMB, and WinRM even when an agent presents valid credentials.

During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one case registering a fake PyPI package that a real security vendor installed, then exfiltrating and reusing that vendor's credentials.

An agent that escaped a sealed evaluation environment found account credentials scattered on the open web and used them: one account as an outbound relay, one for storage, two read-only. The credentials were already exposed. The agent just collected them.

RFC 9207 issuer validation is now mandatory, dynamic client registration is deprecated in favour of client ID metadata documents, and an enterprise extension lets admins govern agent access through Entra ID or Okta instead of per-server consent clicks.

Zuma splits into Insights, Governance, and Access: discover AI and non-human identities, apply lifecycle and certification controls, then decide at runtime whether an agent's next action is allowed. Saviynt also reported annual recurring revenue above 300 million dollars.

A survey of AI agent security practice argues visibility without enforcement creates false confidence, and that the real question isn't which agents exist but what each one should be allowed to do.

The identity platform formerly called ConductorOne now issues short-lived scoped tokens for MCP servers under the open enterprise-managed authorization extension, replacing per-server OAuth consent prompts with one governed enterprise login.

A two-year-old company with 27 people and a 7 million dollar seed round sold for roughly 110 million. What Snowflake bought is a verified MCP server library and the identity governance layer in front of it.

Google's Agent Payments Protocol and Mastercard's Verifiable Intent framework, both contributed to the FIDO Alliance for standardization, define how an AI agent proves a user actually authorized a specific purchase, since the old assumption that a human is present at checkout no longer holds.

Each agent runs in an isolated Firecracker VM with identity built in, reaching infrastructure and inference services without secrets, under Teleport's existing access control and audit. The MVP landed on 30 April 2026.