The Tuesday Deadline Tuesday, October 20, marks the close of the comment period for the Securities and Exchange Commission’s proposed Regulation Crypto Assets (Release No. 33-11434, Docket S7-2026-27). The proposal, published in the Federal Register on August 21, creates a tailored offering regime with a startup exemption for up to $5 million over four years…
Colorado’s interim redline rules for the Automated Decision-Making Technology Act lay out the most detailed framework yet for holding AI agent builders and deployers accountable. Released by the Colorado Department of Law on October 6, the draft fills a gap that federal agencies have left open. A formal rulemaking hearing is scheduled for October 26…
Six vendors are now shipping agent identity products. The IETF has not finished writing the standard any of them would need. Our coverage of the IETF standardization gap mapped the structural problem: ID-JAG remains an Internet-Draft (-04, expires November 22, 2026), the agentproto Working Group has a contested charter, and the WIMSE and DAWN efforts…
Eight authentication bypasses in three weeks. Between September 26 and October 17, 2026, the enterprise landscape suffered a cascade of failures that, while reported as isolated incidents, reveal a singular, systemic rot: federation and proxy layers operating on a ‘trust-by-default’ basis, blindly accepting client-supplied assertions without binding them to the local security context. The Keycloak…
An unauthenticated remote attacker can bypass authentication in OAuth2 Proxy versions 7.15.2 through 7.15.4 by manipulating the X-Forwarded-Uri header. The vulnerability, tracked as CVE-2026-76835, carries a CVSS score of 9.1 and is classified under CWE-290: Authentication Bypass by Spoofing. The mechanism is straightforward: an attacker sends a request to a protected upstream path while setting…
The rapid proliferation of autonomous agents has created a significant governance vacuum. As organizations prepare to manage an estimated 150,000 agents by 2028, the technical infrastructure required to secure these entities is being built in real-time. While the Internet Engineering Task Force (IETF) works to formalize the necessary identity layers, the market is not waiting…
CVE disclosures hit 10,740/month by August 2026. Agent middleware: 50% of AI flaws, +347%. Seven trust-through-defaults auth bypasses show the identity layer is the front line.
Attorney General Todd Blanche has drawn a sharp line around the Department of Justice’s role in artificial intelligence: the DOJ will prosecute crimes that happen to involve AI, but it will not regulate the technology itself. That distinction—between enforcement and oversight—has created a structural gap that is reshaping who answers when autonomous systems cause harm.…
Agent Trust turns detection into a protocol-agnostic registry and transaction-level enforcement. No federal mandate requires it.
The plumbing for agentic commerce is settling into place. Following the Chain of Trust demonstration and Stripe’s claim that activity went vertical in September, the checkout map has matured. The pipes exist to move value between autonomous entities. Yet the monetization map — how vendors extract value when software agents replace human seats — remains…