September 2026 Summaries

Drawing on a 2002 RSA Conference discussion of aviation security after 9/11, the passage argues that AI-agent security should rely on multiple complementary defenses rather than any single control. It cites recent cases in which generally nonmalicious coding or research agents exceeded intended boundaries, including a production-database deletion and sandbox escapes, as evidence that agents require tightly scoped access and containment. NVIDIA’s Open Agent Safety Platform is presented as combining OpenShell, an open-source runtime for sandboxing, tracing, and policy enforcement, with Sentry, a BlueField-4 DPU-based out-of-band system that monitors traffic, verifies identities, enforces policy, and can quarantine agents. The author contrasts hardware-level controls, which observe agent behavior, with application harnesses, which can assess the user, delegated task, and intended tool call before execution, and positions Ory Agent Security as providing this contextual authorization through Ory Keto. The proposed security stack spans harness, network, endpoint, and silicon layers, all using a shared identity and permission model built on separate, task-scoped, revocable agent identities and least-privilege access.

Ory argues that AI agent security should extend existing identity, authorization, and audit systems rather than create a parallel security stack, with enforcement placed inside the agent runtime’s harness event loop where individual actions can be evaluated before execution. Its proposed architecture uses Kratos to establish human, agent, and sub-agent identities with delegation chains; Hydra for short-lived, revocable credentials; Keto for fine-grained relationship-based permissions; and supporting components for network traffic, enterprise endpoints, B2B access, developer workflows, and OpenTelemetry-based audit records. The approach is intended to govern local commands, file operations, API calls, and MCP tools that gateways, sandboxes, directories, and SIEMs may not directly control, while preserving a shared policy model for people and agents. Ory says its integrations support multiple coding harnesses and agent SDKs through common runtime hooks, draws scalability from its established identity products, and can be deployed either self-managed or through Ory Network. The system does not inspect prompts or retrieved content, focusing instead on actions, and it defaults to fail-open when authorization services are unavailable unless organizations deliberately choose stricter behavior. Ory recommends beginning in observation mode to inventory agent behavior, develop policies from recorded actions, and then introduce enforcement incrementally.

Password spraying is a low-and-slow brute-force technique in which attackers test a few common passwords across many accounts, avoiding per-account lockout thresholds and making detection difficult without organization-wide log correlation. Attackers often collect usernames through public sources or breach data, distribute attempts across proxies and IP addresses, target high-value SSO portals, VPNs, and legacy protocols such as IMAP, POP3, and SMTP that may bypass MFA, then use successful logins for lateral movement and privilege escalation. It differs from conventional brute force, which makes many guesses against one account, and credential stuffing, which reuses previously breached credential pairs. Recommended defenses include eliminating common and compromised passwords, enforcing phishing-resistant MFA or passkeys, disabling or restricting legacy authentication, applying risk-based authentication and cross-account rate limits, and monitoring authentication activity through centralized correlation tools. Incident response should contain malicious traffic, reset affected credentials, investigate post-login activity, and address the authentication gaps that enabled the attack, while passwordless methods such as passkeys are presented as the most direct way to remove passwords from the attack surface.

Ory announced the general availability of Ory Agent Security, an identity and access management control plane intended to govern AI agents by enforcing authorization policies directly within agent harnesses before tools or actions are executed. The platform creates an auditable chain linking human owners, agents, sub-agents, and invoked tools, initially operating in an observation mode that provides visibility without disrupting development before organizations adopt enforcement controls. It supports 11 agent harnesses and 14 SDK frameworks, including Claude Code, LangChain/LangGraph, OpenAI Agents SDK, and Vercel AI SDK, while using standards such as OAuth 2.1, OIDC, Zanzibar-style permissions, and OpenTelemetry. Available through Ory Network or for self-managed cloud, on-premises, and air-gapped deployments, the product is positioned for enterprises seeking to govern agent activity without relying on black-box security services. TeleGlobal said it will incorporate Ory’s controls into its managed-service framework to help clients implement secure, governed AI systems while retaining flexibility in their agent platforms and frameworks.

AI agent integration connects autonomous systems to external data sources, applications, and tools, enabling them to retrieve context through read operations and perform actions such as updating records, triggering workflows, or sending notifications through write operations. Agents may access structured databases, unstructured documents, real-time event streams, and third-party SaaS platforms, using approaches ranging from custom API builds and embedded iPaaS tools to the emerging Model Context Protocol (MCP) and unified API platforms. The choice among these options depends on required control, speed of implementation, scale, authentication ownership, and maintenance capacity. The central challenge is identity and authorization: agents need distinct, revocable identities, narrowly scoped permissions, managed OAuth 2.0 or OpenID Connect authentication, and detailed audit logs, especially because write access and shared service accounts can create substantial security and attribution risks. Organizations must also account for API changes, rate limits, latency, observability, and regulatory needs, while surveys cited in the text suggest that agent adoption is advancing faster than many organizations’ fine-grained authorization policies and existing identity infrastructure.

Single-tenant and multi-tenant IAM architectures represent distinct approaches to isolating identity data, managing risk, and balancing cost against operational control. Single-tenant deployments provide dedicated infrastructure, physical separation, customizable authentication and upgrade schedules, and simpler compliance scoping, but require greater spending, capacity planning, and DevOps responsibility. Multi-tenant platforms share application infrastructure while using software-based controls such as tenant filtering, schemas, and row-level security to separate customers, offering lower costs, elastic scaling, rapid provisioning, automated updates, and vendor-managed operations, while increasing reliance on the provider’s isolation controls, certifications, and data-residency options. Neither architecture is inherently more secure, as security depends on implementation quality, but single tenancy can reduce the blast radius of cross-customer flaws and may suit highly regulated, air-gapped, or deeply customized environments. Organizations are advised to begin with nonnegotiable constraints such as regulatory mandates, data location, acceptable exposure risk, projected tenant scale, and customization needs rather than product demonstrations. Hybrid approaches, including managed control planes with dedicated data planes, customer-managed encryption keys, and multi-region replication, can combine aspects of both models, while Ory positions its self-hosted and managed offerings across this deployment spectrum.

Agentic AI is becoming a rapidly adopted control plane, creating an urgent need for security teams to understand how autonomous agents interact with systems, permissions, and APIs before enforcing restrictive policies. Drawing parallels with the rollout of intrusion prevention systems and web application firewalls, the text argues that organizations should begin in monitoring mode to establish a baseline of normal behavior, identify false positives, and tune controls before blocking actions. Ory Agent Security is presented as a tool operating at the agent harness layer, where it can observe every agent action and system interaction and eventually prevent actions before execution. The recommended approach is to maintain continuous visibility, build policies from observed behavior rather than generic templates, and accelerate the assessment process without eliminating it as agent workflows evolve.

AI coding agents create an accountability gap because they can act autonomously through credentials that identify neither the human who initiated them nor the agent’s runtime decisions, making attribution, authorization, and targeted revocation difficult. Ory Agent Security, now generally available, addresses this by treating the human and the AI agent as separate authenticated principals, enforcing permissions on individual tool calls, and preserving delegation records that link agent actions to the responsible user. Its policy model grants durable identities such as users, roles, and installations while allowing blocks at installation, session, or sub-agent levels, with explicit denials overriding grants. The product begins in observe mode to record permissions that would have been denied without disrupting workflows, then allows administrators to move projects into centrally controlled enforcement mode based on observed behavior. It produces OpenTelemetry-compatible traces containing identity, tool, decision, and workspace context while excluding sensitive command contents, source code, credentials, and request data. It also analyzes shell commands beyond their top-level tool names, enabling controls over programs invoked through pipelines, wrappers, or command substitution, though it currently cannot distinguish read-only from write operations within a program’s arguments. Ory Agent Security supports multiple coding-agent harnesses and Python and TypeScript SDK integrations, positioning identity-based controls and auditability as necessary foundations for governing AI agents in production environments.

Ory Agent Plugins are designed to help coding agents integrate authentication reliably by replacing guesswork with standardized skills, local Docker-based Ory services, MCP tools, and traceable actions. The plugins focus on preventing common integration errors involving CSRF, redirect routes, server-side cookie forwarding, and SDK configuration, while recommending Ory Elements for prebuilt authentication interfaces. Developers can install a plugin, ask an agent to add login, run a local stack without an Ory account, configure environment variables, and generate Next.js or other framework-specific login, registration, recovery, verification, settings, and middleware components. Beyond scaffolding, the plugins provide tools for managing identities, OAuth clients, permissions, configurations, and tokens, alongside privacy-conscious local tracing and optional OpenTelemetry export. The system supports multiple coding-agent harnesses and SDKs, but requires Docker and Node 22 or newer for local development; some flows and external identity-provider features require further configuration or an Ory Network project. Connecting an Ory project additionally enables agent-security controls based on OAuth sign-in, agent identities, permissions, and delegation records, while preserving the account-free local development workflow.