30
50
30
AI agent authorization risks remain a gap in new NIST-CISA token security guidance
NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.
NIST, with CISA support, published 'Protecting Tokens and Assertions from Forgery, Theft, and Misuse' (NIST IR 8587), recommending continuous monitoring and tighter token lifecycle controls for SSO and API access. The guidance does not yet fully address AI agent identity, delegation chains, or prompt injection steering agents with valid tokens, and NIST says new or expanded standards are needed. Experts recommend treating AI agents as low-trust non-human identities, maintaining agent inventories, expiring credentials after task completion, and requiring human approval for high-risk actions. The report references shared-signal mechanisms like CAEP and RISC, and follows a May incident where a CISA contractor GitHub repository exposed AWS and GitHub tokens.
48
30
30
30
42
55
60
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.
Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.
45
60
30
60
42
60
42
30
30
CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse
CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.
NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.
35
30
55
60
55
55
60
55
30
55
30
57
42
57
30
30
57
30
30
55
60