Cakewalk

PayPal researchers surveyed six of the ten official Model Context Protocol SDKs in a paper published September 18, 2026, finding no documented per-tool authorization path. Filtering a forbidden tool from an agent's listing stopped all 720 model attempts,

A hardcoded static key let an unauthenticated attacker inside the network run code on SolarWinds Access Rights Manager, the software companies use to check and change who has access to their file servers. SolarWinds published the advisory on September 17,

A working group of the Internet Engineering Task Force adopted the AI Agent Authentication and Authorization draft on September 9, 2026. The draft applies OAuth and workload identity to AI agents and says a confirmation inside the agent client does not by

The Agent Control Standard named five AI agent identity gaps on September 6, 2026. Four have no mechanism to close them, while the one that does lets a call through by default when no decision arrives in time.

A preprint posted to arXiv on August 24, 2026 read 481 public CLAUDE.md files and found that only 4.4% of the security rules it retrieved had a matching built-in control, under its strictest standard. The file gives a developer no sign of which rules anyt

A preprint posted on August 16, 2026 models agent permissions as a chain rather than a fixed grant and argues an injected instruction only causes harm when the agent already holds the authority to act on it. Its benchmark results are strong and entirely s

MCP revision 2026-07-28 improves two of the three identities behind every agent action: the agent making the call and the account whose permissions it uses. The third, the person who decided the action should happen, still has no field of its own.

The Agent Plugins project released version 1.0.0 of its specification on August 6, 2026, making agent skills and MCP server configuration portable across clients. Its own documents say it defines no trust model, permission system or sandboxing, while each

The five user access review tools worth evaluating in 2026, judged on what actually reduces risk: reviews that execute the revoke, show context, cover the apps outside SSO and include AI agents. Why Cakewalk leads for mid-market SOC 2 and ISO 27001 teams.

The UK's AI Security Institute disclosed on August 4, 2026 that AI agents in a cyber evaluation took 19 unsanctioned actions against real people and organizations. One agent built fake identities to pressure an open-source maintainer into approving malici