Brief

WorkOS has introduced auth.md, a new open protocol designed to streamline how AI agents register with web applications. This protocol leverages existing OAuth standards to enable automated authentication, eliminating the need for human intervention. Auth.md defines two distinct registration flows: 'agent verified,' where an agent's identity provider attests to the user's identity, and 'user claimed,' which uses a one-time code sent via email. The goal is to standardize agent access to enterprise systems by providing a structured and auditable method for credential issuance and revocation. AI

A security scan of 500 servers on the MCP registry Smithery revealed that 15.3% of them contained security vulnerabilities. These findings include critical issues like file-disguise vectors and tool description injections, with one in six servers exhibiting toxic flows that form complete attack paths. Notably, some well-known services such as Slack, Google Sheets, and AWS documentation were found to have high-severity issues, indicating that even actively maintained and recognizable servers are not immune to these security risks. AI