#ai-agents

SWI's Identity Funding Report 2026 records 101 identity-security funding rounds from January 2025 to October 2026. 49 of 99 equity rounds targeted AI agents or non-human identities, yet agent-focused seeds and Series A rounds are the same size as everyone else's. What the dataset is and how to use it.

SWI's Agent Identity Standards Map 2026 dates the status of 70 specifications for AI agent authentication, delegation and authorization. Most of the problem is buildable on published OAuth and workload standards. The parts that make agents different, from delegation chains to an owner registry, are still drafts or nothing at all.

Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research shows what that costs. The fix is an identity per agent, scoped to its task, with the human carried in the token through RFC 8693 delegation.

A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, and two coding agents talked into handing over credentials. In October 2026 the credentials that mattered were publishing tokens, CI secrets and agent roles, not user passwords.

Zenity Labs showed a prompt could make an Amazon Bedrock AgentCore agent fetch its execution role credentials from the instance metadata service. The default role could invoke other agents, read their conversations, plant memories and read Secrets Manager. AWS has since narrowed it.

Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with encrypted instructions. GitHub validated the report but does not consider it a vulnerability.

GSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.gov the authentication service and commits to no central citizen database. Transactions arrive in 2027, and the identity rules for them are still to be written.

Microsoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.

Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stolen GitHub OAuth tokens and the Shai-Hulud worm in roughly 100 internal repositories.