Brief

WorkOS has introduced auth.md, a new open protocol designed to streamline how AI agents register with web applications. This protocol leverages existing OAuth standards to enable automated authentication, eliminating the need for human intervention. Auth.md defines two distinct registration flows: 'agent verified,' where an agent's identity provider attests to the user's identity, and 'user claimed,' which uses a one-time code sent via email. The goal is to standardize agent access to enterprise systems by providing a structured and auditable method for credential issuance and revocation. AI

The Model Context Protocol (MCP) has updated its authorization flow to align with RFC 9207, enhancing security against OAuth mix-up attacks. This change mandates that authorization servers include an `iss` parameter in their responses, which clients must then validate against the originally recorded issuer. This structural defense prevents attackers from tricking clients into using authorization codes with the wrong identity provider, a vulnerability that previous session-based methods could not fully address. AI

The FBI has issued a warning about the Kali365 phishing kit, which is effectively stealing Microsoft OAuth tokens at scale. This sophisticated tool bypasses multi-factor authentication by tricking users into providing their credentials. The phishing kit targets Microsoft 365 accounts, granting attackers broad access. AI