6 min read
Storm-3358 Now Runs an Autonomous AI Against Bank Identity Systems 24 Hours a Day
Storm-3358 is using an AI agent framework to autonomously probe bank identity systems for credential leaks, OAuth misconfigurations, and MFA gaps, around…
Identity & Security
4 min read
Agents Are Scraping GitHub for OAuth Secrets. I Hunted Mine That Morning.
A secret committed to a public repo used to have a grace period measured in days. Microsoft just documented threat actors using…
6 min read
The Shared Service Account Is Dead. Your Agents Get Their Own client_id Now.
One leaked secret, forty compromised agents. That's the reality of shared service account auth, and Auth0's new CIMD support finally gives you…
7 min read
Your MFA Held. The Service Principal Walked Right In.
Microsoft reports that Storm-0940 used agentic AI to turn a single vendor compromise into access across hundreds of M365 tenants, not by…
4 min read
Three Ways App A Calls App B Badly, and Why ID-JAG Kills Two of Them
When your frontend needs to call a backend microservice on behalf of a user, the usual OAuth patterns either leak credentials, train…
6 min read
I Gave an Agent a Service Principal. Token Lifetime Is the Revocation Problem.
Microsoft's Project Perception promises to monitor AI agents at machine speed. But when I rotated credentials mid-week, the already-issued token kept working…
7 min read
RFC 8693 Is the Only Token Swap You Can Take With You When You Switch Vendors
Your middle-tier API has a user token and needs to call a downstream service as that user. On-Behalf-Of is the pattern. RFC…
4 min read
Google OAuth Refresh Tokens Now Die Without Their Private Key
Bearer tokens are passwords you can copy. Google just turned its refresh tokens into locks you have to physically own, binding each…
6 min read
You Wrote the Login Twice. Kotlin Multiplatform Says You Don’t Have To.
Auth0 just released an SDK that lets you write mobile authentication once in Kotlin and run it on both iOS and Android.…
8 min read
Auth0 TanStack Start SDK Protects Routes With One Middleware, Zero React Server Components
TanStack Start doesn't have React Server Components, despite what Auth0's marketing suggests. That makes the authentication story simpler, not harder, if you…