Agentic Identity Broker is an open-source identity and authorization layer for AI agents, designed to let agents access services on a user’s behalf without receiving the user’s credentials. It manages agent registration, authentication and sessions, OAuth2 delegation, user consent, and secure token storage. By bridging different OAuth2 systems and handling token exchange centrally, it aims to move authorization work out of individual agents and MCP servers. A built-in interface lets users grant granular permissions, while security features include sensitive-data redaction, cryptographic validation, fail-closed behavior, and structured audit logging.
The project targets several settings: internal MCP servers can rely on the broker and a gateway for authorization and token handling instead of implementing OAuth flows separately; SaaS providers can record which agents customers approved; and hosted agents can use a single user token across multiple MCP services. It also supports delegation chains initiated by trusted machine identities, plus centralized approval checks for consequential tool calls, such as sending email or sharing documents. The project is in active development and is used internally at Zalando for multiple MCP servers. Its stated roadmap includes formalizing agent-to-agent token exchange, intent-based authorization, and user-facing activity logs. The code is MIT-licensed, with documentation and contribution guidance available.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Hackers stole $133 million from a French bank by targeting a service provider. The available details do not explain how the attack was carried out. (bleepingcomputer.com)
U.S. intelligence reportedly believes Nvidia CEO Jensen Huang had a romantic relationship with suspected Chinese spy Alice Huang, who allegedly sought access to restricted AI chips. Alice Huang is linked to Megaspeed, whose subsidiary faces allegations of smuggling $2 billion in AI chips into China. (tomshardware.com)
A report alleges China is linked to at least 18 overseas police stations in Canada, including three in the Greater Toronto Area. The RCMP is investigating reports of criminal activity connected to the stations. (ctvnews.ca)
Colframe is a low-interaction honeypot that imitates supermarket refrigeration controllers from Danfoss and Dixell. It is designed to attract and observe activity targeting these systems, including Modbus-based threats. (github.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.