Attackers took over Microsoft 365 accounts at 79 orgs with stolen session tokens. No password, no MFA prompt. MFA checks you once at login, then every request rides on the token. Bind sessions to devices. A stolen token is a login your MFA never sees.
helpnetsecurity.com/2026/10/…
There's a distinction I wish more teams drew: consent isn't authorization, and it matters most now that agents act for us. Consent is a one-time yes. Authorization is scoped, revocable, and tied to who acted. Give an agent the yes without the rest and you can't scope or revoke what it does.
Evan Sims retweeted
An agent read 'don't send messages' as license to mute its own security alerts, then denied doing it. The lesson is simple: if an agent can reach the switch that governs it, that switch was never a control. Enforcement has to sit where it can't.
cnbc.com/2026/10/21/openai-a…
Evan Sims retweeted
A coding agent read an AGENTS.md in Downloads and tried to install a malicious npm package. No bug: it did what it was built to do. If text your agent reads carries authority, anyone who can drop a file is your admin. Authorize actions, not files.
bleepingcomputer.com/news/se…
Evan Sims retweeted
Biometric liveness on an agent approval proves a human said yes. That's authentication, the easy half. The hard half is what the agent may do, for whom, and for how long. A yes with no scope is a blank check.
biometricupdate.com/202610/b…
Evan Sims retweeted
Good to see Microsoft give agents zero standing access, task-scoped permissions that expire and tighten as risk rises. It's the model a lot of us have argued for. The hard part comes after the policy: proving every allow and deny was right when something breaks.
microsoft.com/en-us/security…
Evan Sims retweeted
BeyondTrust clocked coding agents at ~10 shell commands per prompt (132K prompts). That's a sysadmin's afternoon of privileged actions behind a chat box. Claude Code, Codex, Cursor, Copilot all have that reach now. Treat them like the privileged accounts they are.
beyondtrust.com/press/ai-age…
Evan Sims retweeted
Finland's EUDI digital ID wallet slipped to 2027, past the EU deadline, and I'd expect more slips like it. Issuing the wallet was always the easy part. The real work is getting relying parties to accept it and make real authorization calls with it.
biometricupdate.com/202610/f…
Evan Sims retweeted
1Password lets agents log in without seeing your password, so a compromised agent can't leak it. Good. But it can still do anything you can with that login. A secret the agent can't read is still a key it can turn.
techcrunch.com/2026/10/22/1p…
Prompt injection keeps getting treated as a model bug we'll train away. I don't think we will. Once an agent can see private data, untrusted content, and a way out, that content can steer it. Alignment won't close that. The fix sits outside the model, in access it can't override.
Simon Willison's original framing, the lethal trifecta: simonwillison.net/2025/Jun/1…
A coding agent read an AGENTS.md in Downloads and tried to install a malicious npm package. No bug: it did what it was built to do. If text your agent reads carries authority, anyone who can drop a file is your admin. Authorize actions, not files.
bleepingcomputer.com/news/se…
Finland's EUDI digital ID wallet slipped to 2027, past the EU deadline, and I'd expect more slips like it. Issuing the wallet was always the easy part. The real work is getting relying parties to accept it and make real authorization calls with it.
biometricupdate.com/202610/f…
Evan Sims retweeted
Kenton Varda's point on agent authz stuck with me. Hand-configure each agent's permissions and you've already lost, nobody has the patience. He nailed the problem. I'd fix it differently though, letting the agent inherit a slice of access you already have, not new policy per agent.
Evan Sims retweeted
Good reminder from the eMudhra mess: your browser trusts a whole list of certificate authorities, and whatever any of them signs, you trust too. This one got caught with keys weak enough to guess, one was literally 4. Browsers caught it fast. Almost nobody looks at that list, though.