#machine-identity

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

A data-security company is paying roughly 1 billion dollars, about 700 million of it in cash, for a four-year-old non-human identity startup. The price says more about where the category is heading than any product announcement this year.

Ahead of a Black Hat USA 2026 release, researcher Aleksandr Krasnov built NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud IAM to expose which dormant, ownerless service accounts, ghost credentials, actually lead into production or IdP admin roles.

A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.

Instead of stealing an existing service account, attackers are fabricating new ones that blend real environmental attributes with fake ones, inheriting legitimate naming conventions so nothing looks stolen because nothing was.

npm 12 stops running dependency lifecycle scripts unless you allow them. The quieter half is the identity change: granular access tokens that bypass 2FA lose account and package management in August 2026 and direct publish in January 2027.

Two weeks from announcement to close. Entro brings discovery and lifecycle management for more than 1,200 kinds of secret, token, and certificate into SailPoint's Agentic Fabric, aimed at the machine identities that outnumber staff by an order of magnitude.

AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.

Astrix goes into Duo, Splunk, and Cisco Identity Intelligence. The pitch is extending zero-trust principles to an agentic workforce, which in practice means governing the OAuth tokens and service accounts nobody owns.