Trust & Security
WorkOS Four SAML SSO Bypasses Trace to a Dual-View XML Parsing Gap
A commercial SaaS identity provider parsed SAML responses with two different XML views. The ninth trust-through-defaults incident on this desk.
◆ Heath Callahan
Format
Analysis
-
-
Policy
The Digital Omnibus: Recalibrating Compliance for Agentic AI
A 16-month extension for stand-alone high-risk AI systems creates a strategic window—and a structural loophole—that will shape how autonomous agents enter the European market.
◆ Priya Nair
-
Trust & Security
Microsoft Is Blocking Every Third-Party Script from Its Entra Sign-In Page — and It Hits Mid-October
Content Security Policy enforcement on login.microsoftonline.com will stop browser extensions from injecting code during authentication. No workaround. No exceptions.
◆ Heath Callahan
-
Policy
Taiwan Moves to Criminalize AI Chip Smuggling to China Under Foreign Trade Act
A proposed amendment would create the first specific criminal offense for unauthorized AI hardware exports, fulfilling commitments under the US-Taiwan trade deal – but no implementation timeline has been set.
◆ Priya Nair
-
Models
NVIDIA RTX Spark Ships a Petaflop to the Desktop. The Compute Landlord Extends the Lease.
At $2,599 across major OEMs, NVIDIA is engineering the hardware layer that turns open-weight models from downloadable weights into locally deployable agents – while earning from silicon, not models.
◆ Lena Park
-
Commerce
Harbor Insurance: $10M Seed to Insure the Risks AI Agents Create
Traditional carriers are excluding AI from their policies. Harbor wants to measure the risk, block the bad decisions, and insure what remains.
◆ Tessa Vaughn
-
Policy
The Dual Voids: SEC Reg CA and the AI Agent Liability Gap
As the comment period for the SEC's proposed crypto framework closes Tuesday, the industry faces two distinct but equally pressing regulatory silences.
◆ Priya Nair
-
Policy
Colorado Builds the Agent-Obligation Playbook While Federal Enforcement Stays on the Shelf
A formal hearing October 26 and rules effective January 1 would make the state's ADMT framework the first to impose binding developer and deployer duties on AI agents in consequential decisions, with the AG holding exclusive enforcement and indemnification clauses that shield violators voided by statute.
◆ Priya Nair
-
Infrastructure
Six Vendors Are Shipping Agent Identity Products. The IETF Has Not Finished the Standard.
Okta, Descope, ServiceNow, Cequence, Postman, and Microsoft are each filling the identity vacuum with different architectures, different standards references, and different bets on what sticks. The divergence is the story.
◆ Blair Hayes
-
Trust & Security
The OAuth/SAML Authentication Bypass Wave: Seven Months, Eight Vendors, One Structural Failure
Every authentication bypass this desk has covered since September shares the same root cause. The enterprise auth stack was not built to catch it.
◆ Heath Callahan
