December 2025 Summaries

In exploring the distinct roles of authentication and authorization, the text highlights the architectural challenges that arise when these two processes are conflated. Authentication, which establishes identity through standards like SAML, OIDC, and LDAP, is focused on verifying who a user is, while authorization determines what actions that user can perform within a system. This differentiation is crucial as authentication is standardized and centered on interoperability, whereas authorization is inherently flexible and tailored to specific business logic and resource relationships. The text argues that using Identity Providers (IdPs) for authorization can lead to inefficiencies and complexity due to their inability to handle fine-grained, dynamic permissions required by modern applications. Instead, it suggests decoupling the two processes, advocating for an Authorization as a Service (AaaS) model that allows for independent policy management, better testability, and domain-specific logic, ensuring that access control remains adaptable and effective as systems evolve.

Agents Gone Rogue is a dynamic resource designed to track and analyze failures, exploits, and defenses of AI agents, which are rapidly advancing from prototypes to production and often outpacing security measures. The register categorizes agent failures into three main types: Uncontrolled Agents, which act unpredictably; Tricked Agents, susceptible to manipulation through malicious prompts; and Weaponized Agents, designed for targeted attacks. By consolidating real-world incidents from diverse sources, the platform provides a comprehensive view into how AI agents can compromise security, offering insights into the patterns of agentic failures. This resource serves as a vital tool for security, engineering, and product teams, enabling them to understand vulnerabilities, improve design architectures, and mitigate compliance risks. The community is encouraged to contribute by submitting new incidents, helping to expand the knowledge base and accelerate the development of effective defenses.