Tag
The tweet points out that CAPTCHA mechanisms originally designed for humans have become meaningless for AI agents, suggesting that traditional anti-automation verification methods need to be reconsidered as agents become more widespread.
Security researchers disclosed a complete bypass of eMudhra's one-factor OTP-based login system, allowing unauthorized account access without the one-time password.
1Password 推出「1Password for Agents」，让用户在不向 AI 代理暴露密码的前提下，授权代理代为登录个人账户。该平台通过数字密钥与用户确认机制实现凭证托管，已支持 Claude Duet、OpenAI Dots/ChatGPT Work、Grok Bot 等多种代理。
Major US banks report discovering unauthorized AI agents operating inside customer accounts, typically using the customer's own login credentials, raising concerns that current password-based authentication cannot distinguish between a user and an authorized or rogue agent. The situation prompts debate over whether agents should use their own scoped credentials rather than sharing customer logins.
Muse 与 1Password 官方合作，将 1Password 直接集成进 Muse，用户可逐次批准登录并让密码保留在自己的保险库中；同时 1Password 宣布推出面向 AI 代理的 '1Password for Agents' 平台，与 Claude、Grok、OpenAI、Perplexity 等多家公司合作。
作者探讨构建会操作真实账户的 AI agent 时的授权边界：读取类操作允许常驻访问，而发送、消费、删除或发布类操作每次都需人工确认，并询问社区如何在大规模运行 agent 时处理写权限凭证。
Veritas 宣布其防伪芯片升级至第二版，可适用于金属和玻璃表面，支持珠宝、奖杯和香水瓶等更多品类，并与 ATHLOS 合作在其冠军皇冠中嵌入芯片。
Kent C. Dodds argues developers just want quick API key access, ideally via OAuth, and minimal UI friction in developer products.
Josh King (CTO at &above) argues AI agent identity is really two separate questions — whether the identity is borrowed from a human or native to the agent, and how broadly that identity is scoped — and critiques recent moves by Okta, 1Password, WorkOS, and Anthropic's Claude Tag for largely ignoring least-privilege scoping.
Scott Helme 推翻了《Passkeys Are a Trap》一文的论点，解释了同步式 passkey 并不会向网站提供证明信息（attestation），且证明机制并不会暴露操作系统或浏览器信息，TOTP 反而是更容易被钓鱼的倒退方案。
AgentKit by Scalekit is an MCP gateway designed for production agents that act on a user's behalf, handling the infrastructure layer for agent tool access.
Epherem 是一款免费的源代码安全扫描工具，专为 AI 构建的应用设计，可检测认证、数据库访问、API 密钥泄露和依赖漏洞等问题，并支持导出报告给 Claude Code、Cursor 等 AI 编码助手。
一篇评论文章批评 passkeys 是一种「陷阱」，认为它们削弱了用户对自身登录凭证的控制权，并指出 FIDO Alliance 由大科技公司、政府和银行等利益方主导，缺乏消费者权益代表。
ANP 社区创始人 Gaowei Chang 对 Meta 新发布的 PAP（个人智能体协议）规范进行深度解读，解释其核心设计，并对比 MCP、A2A 与 ANP 在个人智能体与企业交互场景下的差异与互补关系。
A developer's blog rant about common API design frustrations encountered while automating Vori's onboarding flow, including gated documentation, missing OpenAPI specs, lack of self-serve credential issuance, and poor credential identity handling.
AgentMail introduces AgentID, a "Sign in with Google" for AI agents that gives each agent a verified inbox linked to a real human owner, solving the problem of agents borrowing user logins or being blocked at sign-up.
An article on how rising consumer AI agents like Meta's Muse, OpenAI's dots, and Instinct will increasingly need to prove agent identity and human authorization, proposing World ID's privacy-preserving Proof of Human — delegated via zero-knowledge proofs — as the mechanism for verifying human-backed agents for access, rate limiting, and purchases.
Firezone details why it abandoned the leading directory sync standard to build its own custom engine, covering how users, groups, and members are synced from identity providers like Entra, Okta, and Google. The post explains the design challenges of keeping app-side copies of an organization's directory fast and consistent.
Sam Altman endorses the idea that users should be able to use their AI subscription anywhere, highlighting OpenAI's rationale behind the 'Sign in with ChatGPT' (SIWC) feature as explained by Vignesh.
The OpenID Foundation released a 2025 white paper on Identity Management for Agentic AI, outlining the authentication, authorization, and credential models needed as autonomous AI agents increasingly act on behalf of users across systems.