June 2025 Summaries

A recent discovery by security researchers revealed a massive breach involving over 16 billion stolen credentials, highlighting the vulnerability of traditional password-based authentication systems. The breach, dubbed the "Mother of All Breaches," emphasizes that passwords are frequently reused, phished, guessed, and leaked, making them a significant liability for both users and businesses. As an alternative, passkeys and the WebAuthn standard present a more secure method of authentication by utilizing cryptographic credentials stored on user devices, which are resistant to phishing and can be synchronized across multiple platforms. Companies like Ory are facilitating the transition to passwordless authentication by providing support for WebAuthn and passkeys, ensuring a flexible and secure system that eliminates the need for passwords while enhancing user experience and reducing credential-related security risks. This shift not only improves authentication speed and decreases support tickets but also significantly reduces the attack surface for credential-related threats, making the adoption of passwordless systems an urgent priority for modern organizations.

This guide provides a detailed walkthrough on integrating Ory Hydra with the Model Context Protocol (MCP) to establish secure and standardized interactions between AI agents and services. By opting for Ory Hydra, users benefit from an open-source solution that offers transparency, customization, and control over their security infrastructure, without the constraints of vendor lock-in. The tutorial leads users through setting up a local OAuth 2.1 server using Docker, integrating it with an MCP server for secure authentication, and gaining hands-on experience with MCP Inspector for testing. It emphasizes the advantages of Ory Hydra, such as its community-driven development, modular design, and compliance with OAuth 2.1 and OpenID Connect standards. The guide also highlights the flexibility and scalability of Ory Hydra in comparison to proprietary alternatives, allowing organizations to maintain control over their deployments while benefiting from enterprise-grade security.

Large Language Models (LLMs) have revolutionized rapid code generation, enabling the swift development of complex software systems like Cloudflare's workers-oauth-provider. However, this speed introduces significant security risks, as evidenced by the examination of security-critical code which reveals fundamental design flaws and vulnerabilities. The text highlights issues such as inadequate client secret handling, where simple SHA-256 hashing and equality checks expose the system to offline cracking and timing attacks, and the problematic use of a static wrapping key, which undermines data protection. Furthermore, deviations from OAuth 2.1 guidelines for token lifecycle management and challenges with data model scalability underscore the intricacies of ensuring robust security. While LLMs provide impressive capabilities, the text argues for the necessity of expert oversight in securing code, suggesting reliance on rigorously audited and community-supported open-source solutions like Ory Hydra and node-oidc-provider for foundational security infrastructure, emphasizing the importance of proven, expert-designed systems in maintaining security integrity.

AI agents are increasingly integral to business operations, with many mid-size enterprises already utilizing AI in various forms. The Pax8 2025 Research Report highlights the emergence of autonomous AI agents acting as "digital emissaries" capable of browsing, transacting, and making online decisions, ushering in a new agentic economy. This economy requires a robust identity and payments infrastructure, elevating AI agents to first-class digital citizens. The partnership between Ory and Skyfire addresses this need by integrating Skyfire's AI-native payments and identity verification with Ory Hydra's OAuth2/OpenID Connect authentication server. Through the Know Your Agent (KYA) framework, AI agents can establish verified digital identities, facilitating secure and compliant transactions. The Ory Hydra system ensures machine-scale authentication and real-time token management, enabling AI agents to operate within existing identity access management systems. Skyfire provides programmable digital wallets to automate payments, allowing agents to conduct transactions much like human users. This collaboration opens new revenue streams by allowing businesses to engage AI-powered purchasers, while maintaining security and compliance through open standards like OAuth2.1, OIDC, and MCP, thus fostering a secure, agent-driven digital marketplace.

In the late 1990s, Napster revolutionized the music industry by allowing users to access music freely, bypassing traditional distribution and payment systems, which led to a legal and economic upheaval. Similarly, today's advanced AI agents, capable of performing numerous tasks, face a critical challenge due to their lack of identity, which prevents them from securely interacting with digital content, especially paywalled or proprietary material. This lack of accountability and monetization is reminiscent of the early 2000s music industry crisis. The proposed solution is to develop an infrastructure that provides AI agents with identity and monetization capabilities, akin to how Spotify and Apple Music transformed music distribution. This involves creating systems for identity verification, consent-based access, and real-time billing, supported by new identity protocols and digital wallets for AI agents, to ensure fair compensation for content providers. Companies like Ory are pioneering this transformation by developing identity infrastructure that can authenticate AI agents, thereby establishing the foundation for a reliable digital economy where AI can function as accountable entities, potentially preventing another Napster-like disruption.

In 2024, bots surpassed humans in web traffic, accounting for 51% of online activity, with a portion being malicious. This shift underscores the necessity for advanced identity and access management systems capable of handling both human and machine identities, as highlighted by Imperva's 2025 Bad Bot Report. Ory's partnership with Cockroach Labs is pivotal in developing infrastructure to manage AI agents at scale, exemplified by OpenAI's use of Ory's identity architecture and CockroachDB for ChatGPT's authentication needs. The collaboration aims to address the challenges of AI agents, which operate with significant autonomy, requiring robust OAuth solutions to ensure security and compliance. The introduction of protocols like the Model Context Protocol (MCP) and Google's Agent-to-Agent (A2A) protocol marks a transformative era in identity management, focusing on secure, scalable, and accountable interactions between AI agents. This evolution positions AI agents as integral participants in the digital economy, demanding innovative approaches to authentication, authorization, and auditability to prevent security breaches and ensure trust.

On June 11, 2025, Apple made an unannounced change to its OpenID Connect (OIDC) discovery endpoint, causing disruptions in the "Sign in with Apple" feature for many apps that adhered to OIDC standards, due to a mismatch between the issuer in Apple's ID tokens and the discovery metadata. The change, which was partially reversed within 24 hours, highlighted the fragile nature of identity infrastructure when providers alter behavior unexpectedly. Despite Apple's rollback, the ecosystem remains inconsistent, with no official guidance from Apple on managing the transition, leaving compliant clients struggling with token validation. This incident underscores the benefits of using established, open-source identity platforms like Ory, which help manage the complexities of authentication infrastructure and prevent similar disruptions, as demonstrated by companies like OpenAI who rely on Ory for scalable and reliable identity management.

In April 2025, OpenAI.com and ChatGPT.com are ranked amongst the most visited websites globally, with ChatGPT surpassing popular platforms like Twitter, Reddit, and Amazon by securing the 5th spot. OpenAI also ranks highly, placed 44th by Similarweb and 28th by Semrush, while Fandom.com is noted as the 37th most visited site according to Similarweb. These sites, each attracting millions of users consistently, face significant challenges in managing authentication and authorization due to their immense user base, which traditional IAM solutions struggle to handle. As a result, OpenAI/ChatGPT, Fandom, and Axel Springer have become customers of Ory, a company specializing in scalable and customizable IAM solutions, to address issues of user delays and disruptions during peak traffic times and to support their ambitious growth plans.

Account linking enhances user experience by allowing multiple login methods, such as email/password, Google Sign-In, or Apple Sign-In, to connect to a single user account. The article evaluates three primary methods of account linking—manual, link-on-login, and automatic—highlighting their security risks and user experience implications. Manual linking, while highly secure due to its user-driven nature, can be inconvenient and underutilized. Link-on-login strikes a balance by prompting users to confirm account ownership when duplicate emails are detected, offering good security and moderate convenience. In contrast, automatic linking is the most seamless but poses significant security risks by relying on external identity provider (IdP) claims, which could lead to account hijacking if not handled safely. The article stresses the importance of verifying email claims, understanding IdP practices, and using stable identifiers for linking to mitigate risks such as domain spoofing, email reuse, and unverified claims. Recommendations for developers, security architects, and product managers are provided to ensure secure implementation, emphasizing a trust-but-verify approach with clear user communication and control over linked accounts.