Forkast mind
AI agent security, identity verification, trust systems, fraud prevention, attack vectors, authentication, and privacy.
Trust & Security
Two new Critical CVEs extend Microsoft's September identity infrastructure cluster to 10+ verified vulnerabilities across 10+ distinct services — and the attack surface has expanded from the identity control plane into the data tier and the financial layer.
◆ Heath Callahan
Trust & Security
CVE-2026-69843 — a CVSS 10.0 unauthenticated bypass by spoofing — joins four other Microsoft authentication flaws since September 1, extending the identity-layer attack surface from the control plane into the data and analytics tier.
◆ Heath Callahan
Trust & Security
The AEPD received its first formal notification of a data breach involving an autonomous AI agent — the first time a national data protection authority has publicly confirmed receipt of such a filing. The agency's own Rule of 2 framework predicted this exact scenario.
◆ Heath Callahan
Trust & Security
CVE-2026-83711, CVE-2026-70352, and CVE-2026-83941 span Azure AD B2C, Entra ID, and Azure AI Language at CVSS 9.9-10.0. All three were fixed server-side—no customer patches required. The pattern matches Delinea, Cisco ISE, and the Azure SRE Agent.
◆ Heath Callahan
Trust & Security
Moxie Marlinspike's involvement signals cryptographic enforcement over corporate promises — Meta's hardware-isolated, user-held keys model joins Apple's stateless PCC and Google's bifurcated approach as the third distinct trust architecture for AI agents.
◆ Heath Callahan
Trust & Security
Salt Security and CrowdStrike are consolidating API and agent telemetry into a single Falcon platform integration, but MCP servers are proliferating as the new unmonitored frontier – the defense layer is widening while the attack surface expands faster.
◆ Heath Callahan
Trust & Security
Nine CVEs in one identity platform — including two unauthenticated CVSS 10.0 bypasses under active exploitation — confirm that the infrastructure validating who gets on the network has become the primary attack surface.
◆ Heath Callahan
Trust & Security
A wire-level teardown exposed silent repository uploads to a Google Cloud bucket. SpaceXAI's response—open-sourcing, ZDR defaults, deletion pledges—was damage control, not design. The three-way trust-architecture divergence now has a reactive category.
◆ Heath Callahan
Trust & Security
Two unauthenticated Critical CVEs in the same PAM platform, same disclosure day. Four Critical CVEs in two weeks. The infrastructure designed to protect identity becomes the attack surface.
◆ Heath Callahan
Trust & Security
Apple's stateless Private Cloud Compute and Google's stateful consumer Gemini represent fundamentally different answers to where your data lives, who can access it, and what you can verify.
◆ Heath Callahan
