#authorization

DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 and July 2, 2026. Most were contact details; a small minority included driver's licenses, passports or utility bills. Certificates were not affected.

Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to act on their behalf, and reminded them they are responsible for activity from shared credentials. A spokesperson confirmed the email to TechCrunch on October 27.

Tailscale published four security bulletins on October 26, fixed in 1.104.4. The worst, TS-2026-014, let an authenticated Tailscale SSH peer allowed to forward ports reach root-only sockets such as Docker or the tailscaled local API.

Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research shows what that costs. The fix is an identity per agent, scoped to its task, with the human carried in the token through RFC 8693 delegation.

CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owner, without consent. An attacker could mint a token, convert, name a victim, and push to the victim's repositories. Docker found no exploitation.

UpGuard found over 16,000 Supabase databases exposing readable tables with personal data, plaintext passwords and authentication tokens, caused by missing or ineffective row-level security and misused keys. Many appear to have been built with AI coding agents.

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.

General availability for non-human identity lifecycle management plus runtime authorization for agents, with one enforcement model that combines the invoking user, the agent, the tool, and the target resource.

The deal that opened 2026's consolidation wave. SGNL brings CAEP-based continuous access evaluation and just-in-time authorization to a Falcon identity business already past 435 million dollars in annual recurring revenue.