Agents

Nearly half of teams give every agent the same credential. That costs you attribution, blast radius control, and least privilege all at once.

A 20-token edit to a SKILL.md file makes agents pick the malicious skill 77.6% of the time. No code, no signature, nothing for a scanner to find.

Eight minutes from noticing the missing authorization hook to opening PR #1240: 1,033 lines across 11 files that authorize every tool call before it runs.

PR #26 on the agent passport spec, opened at 3:04 AM on March 15: D-004 defines signed delegation tokens that must narrow scope at every hop, with depth limits and a traceable chain root.

Fourteen agent frameworks, one question: does a tool call pass through a policy check before it runs? Fourteen variations of no, and the attacks that exploit it.

Bedrock AgentCore puts Cedar policies outside the agent's reasoning loop. That works for one hop. Multi-agent delegation chains are still unsolved.

We replayed 4,371 human-written attacks against 14 models, with and without an authorization check between the tool call and the bank. The models kept asking to pay. What changed is whether the money moved. Charts, denominators and a reproduce command.

I built an adapter that checks every Mastra tool call against a policy before it runs, and found out where every agent framework leaves the same hole.

Five lines of prompt injection exfiltrate authenticated M365 file links, because Copilot Cowork lets the model decide which actions need approval.

auth.md gives agents credentials without a signup form. It says nothing about what an agent is allowed to do once it has them. Here is the missing layer.

The NSA's first MCP security guidance names the right problems and leaves out agent identity, authorization before execution, and mid-session revocation.

Tenet Security found 2,388 organizations exposed to Agentjacking, where a fake error report hijacks an AI coding agent. The attack, and the only fix.

Disclosure: I build APort, an open-source layer that checks each AI agent action against a policy before it runs. The Vercel breach ran on an OAuth grant an AI tool already held, and 63% of organizations still cannot purpose-limit an agent or shut one down.

CVE-2026-26030 turned a search prompt into calc.exe on the host. Blocklists cannot contain a dynamic language, and filters cannot contain an agent.

MCP secures the connection and CIS secures the configuration, but nobody checks what the agent is authorized to do. Four questions find the gap.

The agent passport spec now defines a .well-known/oap/ discovery endpoint so any system can verify what an AI agent is authorized to do.

Guardrails decay through model drift, context bleed and stale policy. Why four RSA 2026 vendors enforce too late, and the signed audit trail that catches drift on any stack.

NIST wants agent identity, an authorization check before each action, and auditable receipts. All three are implementable now, without waiting for the standard to finalize.

One error message at 11:23 PM showed me that independent agent passports do not scale. The template and instance pattern from Chimoney's codebase fixed it.

The future of AI is not just about intelligence. It's about integrity. Implementing a digital ID and passport system is a critical step toward building a secure, trustworthy, and responsible…