Analysis

A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, and two coding agents talked into handing over credentials. In October 2026 the credentials that mattered were publishing tokens, CI secrets and agent roles, not user passwords.

Just over half of the identity podcasts we track are made by vendors, and most of the rest have a commercial tie somewhere. That does not make them bad. It does mean you should know who is paying before you take the advice. Five questions to ask of any show, and how we label them.

A spraying campaign that only worked on functional accounts, a service principal secret in a GitHub issue, an email address that commits code, a public database key with no authorization behind it, and a leaver's token kept alive on purpose. None needed a new exploit. All of them were credentials no person was accountable for.

Cisco FMC, Cisco ISE, N-able N-central and an unnamed security product at Bitget were all exploited in September 2026. Each one held credentials or authority that other systems trust. Patching them is necessary; treating the compromise as an identity incident is what actually ends it.

Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and the new federal front door runs on Login.gov. Here is how to plan the move off SMS without creating a new weak point in recovery.

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.

Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.

Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open source tool for dormant non-human identity trust paths, and insider risk getting AI-native and funded.

We catalogued 86 national digital ID schemes across 51 countries. The patterns that emerge, mobile-first, bank-led, biometric, and wallet-bound, tell you where identity is going and what to build for.

Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat biometric identifiers as a special category. Here is what changed and what to do.

Not every national ID is equally trustworthy or equally easy to verify. A practical seven-point checklist for evaluating a country's digital ID before you wire it into onboarding, with the references to do it fast.

Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.

AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.