October 2026 Summaries

Broken access control, including broken object-level authorization (BOLA) and insecure direct object references (IDOR), remains a leading application security risk because authenticated users may access resources belonging to other users or tenants when ownership checks are omitted. The text argues that AI coding agents can readily generate such flaws because authorization requirements often depend on product-specific rules—such as organizational ownership, user roles, and intended tenant boundaries—that are not evident in a prompt or individual source file. While static application security testing can detect structurally recognizable issues within the broader access-control category, it generally cannot determine whether a particular object-level ownership check is required or correctly implemented. Effective detection therefore requires an application-wide model incorporating architecture, data flows, schemas, classifications, trust boundaries, and runtime behavior, combined with independent validation and testing. Recommended practices include inventorying endpoints that accept object identifiers, documenting resource ownership rules, explicitly reviewing authorization in agent-authored changes, adding cross-tenant functional tests that return indistinguishable not-found responses for unauthorized resources, and using contextual analysis and runtime testing alongside deterministic scans.