Format
Trust & Security
CVE-2026-76835 bypasses authentication in OAuth2 Proxy 7.15.2–7.15.4 because the –trusted-proxy-ip guard introduced for CVE-2026-40575 defaults to trusting all IPs.
◆ Heath Callahan
Infrastructure
ID-JAG is the closest thing the industry has to a standard for agent identity. It remains an Internet-Draft. Meanwhile, Okta, Descope, and ServiceNow are shipping commercial implementations that define the operational reality.
◆ Blair Hayes
Trust & Security
CVE disclosures hit 10,740 per month by August. Agent middleware accounts for 50% of AI-related flaws with a 347% surge. Seven recurring auth bypasses on this desk show the identity layer is the front line — and the disclosure pipeline cannot see the battlefield.
◆ Heath Callahan
Policy
Attorney General Blanche rejected 'regulation by prosecution' for AI, mirroring the crypto playbook. States are filling the gap with their own laws—and the DOJ is challenging them, too.
◆ Priya Nair
Commerce
Agent Trust turns detection into a protocol-agnostic registry and transaction-level enforcement. No federal mandate requires it. A Senate bill that would is sitting in committee.
◆ Tessa Vaughn
Agents at Work
The first major payments processor to publicly frame the agent authorization question is arguing for more friction, not less – and the virtual card may be its near-term answer.
◆ Dana Ellison
Commerce
Four competing pricing architectures are fighting to replace the seat license as AI agents take over enterprise workflows. None has won. Salesforce is hedging all four.
◆ Tessa Vaughn
Infrastructure
Six vendors now ship near-identical per-agent isolation. The K8s Agent Sandbox CRD turned it into infrastructure. The control plane is where the competitive advantage lives.
◆ Blair Hayes
Trust & Security
A critical authentication bypass in the Budibase low-code platform allows unauthenticated remote attackers to hijack pending administrative invitations. By exploiting flaws in the OIDC/SSO login flow, an attacker can claim an invite intended for another user, inheriting the privileges associated with that invitation, including global administrator access.
◆ Heath Callahan
Commerce
LivingSocial rebuilt itself as an agent-native surface for 56,000+ local experiences. Agents can search, compare, and prepare carts. They cannot pay.
◆ Tessa Vaughn
