Every fortnight, we cover:

THIS NEWSLETTER IS POWERED BY CLUTCH

Welcome to The Identity Briefing, a new fortnightly newsletter from Clutch, the team behind the IAM Summits in Sydney, Melbourne and New York, and the Identity Leaders Network.

We think there is a gap for regular, useful reporting focused specifically on IAM, access and digital identity. Our aim is to give you clear analysis, practical insights and industry updates that help you do your job better.

You are receiving this as a past attendee of one of our events or a member of the Identity Leaders Network. We hope you find it useful, and if you would like to be interviewed or contribute to a future edition, please get in touch.

Microsoft has announced that passkeys will become the default authentication method for the Entra ID enterprise identity service starting September 2026.

AWS and Google both support passkeys already. The question is whether either follows Microsoft in making them the default rather than the recommendation.

Either way, this shows a clear direction. Passkeys are moving from an optional security upgrade towards something that will increasingly be required as standard.

Despite this move, Okta research revealed threat actors are already exploiting passkey enrolment to get into Microsoft accounts.

A threat actor known as O-UNC-066 has deployed a panel-controlled phishing kit that specifically targets Microsoft 365 users.

They register domains containing the word “passkey” and then call users to try to persuade them to register a new passkey.

Users are then directed to a phishing kit that closely copies Microsoft’s passkey enrolment process. While they think they are registering a new passkey, the threat actor simultaneously registers its own passkey to the user’s real Microsoft account, giving it continued access.

This shows that identity teams always need to be aware of the risks around enrolment and recovery when designing phishing-resistant authentication systems around passkeys.

The attack leaves identity teams with four questions they need to have documented and answered:

Strong passkey authentication systems can still be undone by weak processes around them, and this latest Okta research showcases that more than anything.

A new Internet-Draft submitted this month proposes an AI Agent Authorization Integration Framework that brings together existing identity standards and mechanisms to support AI agents operating across different systems.

It focuses on four basic questions:

The framework aims to use existing identity systems and standards, including OAuth, workload identity, access policies, token exchange and consent records.

The user and agent are treated as separate identities, with a record of who approved the agent and which agent carried out the task. This is particularly important when one agent passes a task to another.

Each agent would only receive the access it needs and would not be able to give the next agent more access than it had itself. Proof of user consent is maintained throughout, so organisations can always answer the four basic questions above.

It also proposes that systems tell an agent what access it needs rather than simply blocking it, allowing the agent to return to the user for the required permission or approval instead of the workflow ending.

There are still a lot of unanswered questions.

The draft does not fully resolve how consent records containing sensitive information should be managed, how trust would work between different systems, or the internal risk of users approving actions they should not because of approval fatigue.

What is positive is that frameworks like this give companies something they can use internally to start developing their own policies.

AI agent adoption is growing, and organisations are going to need clearer standards over the next few years.

The most important part of the draft is the separation between the user and the agent. There should always be a record of who approved the action, which agent carried it out and what access it was given.

That has a direct implication for identity teams. If an AI agent is simply operating through a shared service account, with no clear link back to the user or approval behind the action, the identity model is already missing something important.

This is an individual Internet-Draft, not an approved IETF standard or working group document. It may change substantially or never progress further through the standards process.

Read the full draft here.

The University of Missouri-Kansas City’s ASSET Research Group has released further information on the Ghostcommit technique.

This technique hides prompt-injection instructions inside an image committed to a software repository. The image is ignored by automated code-review tools but interpreted by an AI coding agent, and the hidden instructions can be malicious, for example instructing the agent to read secrets from the repository and expose them.

CodeRabbit excludes image files from reviews by default, while Bugbot returned no findings when the researchers tested the technique.

While this seems like an AppSec problem, it is also a vital thing for identity teams to be aware of, as agents are given credentials, repository access and the ability to take actions.

Read more about the Ghostcommit technique.

At least two threat actors have reportedly used OAuth client ID spoofing to enumerate Microsoft Entra accounts and check whether stolen credentials are valid while avoiding parts of the expected telemetry.

The practical lesson is that attackers are learning how to make hostile authentication activity resemble traffic from legitimate applications.

It also shows that detections based on application names or individual client IDs can be unreliable, as the attackers are spreading attempts across fictional applications.

Read more about the OAuth client ID spoofing attacks

Microsoft has mapped three attack paths ShinyHunters has been using over the past year to target Salesforce environments.

They broke them down into three paths:

Microsoft has worked with Salesforce to release new detection and governance tooling to help companies identify this activity.

The attackers did not exploit a flaw in Salesforce. Instead, the attacks show the importance of third-party trust and delegated access, as both can be exploited when they are left over-permissioned or are no longer being monitored.

Read more about the three Salesforce attack paths

OpenAI has announced that members of its Trusted Access for Cyber program will need to use a physical security key to continue accessing its most capable cyber models from 1 September 2026.

Users will need to switch on OpenAI’s Advanced Account Security feature using a hardware-backed passkey. The key can be tapped against a phone or plugged into a laptop.

Yubico will be providing the keys, including a USB-C YubiKey and a low-profile key designed to remain plugged into a laptop.

This is an interesting example of identity being used to control access to a capability rather than just data. OpenAI has decided the risk attached to these models is high enough that access should depend on a credential that cannot easily be phished or copied.

Read more about OpenAI’s physical security key requirement

A new group known as Helix has emerged using identity-focused attacks to steal data from Microsoft 365 SharePoint environments.

According to research released by ReliaQuest, the group uses a combination of vishing calls, device-code phishing and MFA abuse to gain access to user accounts.

Once inside, they quickly register their own authenticator app before searching SharePoint and extracting files for ransom.

This is the second story in this issue where one of the attacker’s first moves is to register a credential they control. It shows why enrolment and recovery processes need to be protected just as carefully as the authentication method itself.

ReliaQuest noted overlaps with the ShinyHunters and BlackFile data-extortion groups based on the techniques and infrastructure used, although researchers did not find a definitive connection.

Read more about the Helix SharePoint attacks

The OpenID Foundation has released several standards for review:

OpenID Connect Ephemeral Subject Identifier 1.0
Now at final specification review, this is designed to stop a user’s subject identifier being linked across multiple visits, making it harder for a relying party to track the same person between sessions. The review runs until 15 September. More information here.

OpenID Connect Key Binding
Now at implementer’s draft review, this aims to bind identity claims more closely to a cryptographic key, making it harder for a stolen token or credential to be reused. This connects directly to the passkey story above: stronger binding helps stop a valid credential being replayed somewhere it should not be. The review runs until 23 August. More information here.

OpenID Federation Extensions
Also at implementer’s draft review, these cover how changes involving subordinate entities are shared and how organisations can retrieve large lists of entities within a federation. The review runs until 19 August. More information here.

The Cloud Security Alliance has also published implementation guidance for its AI Controls Matrix v1.1, which was released in late June. The framework contains 247 controls across 18 security domains and maps to standards including ISO 42001, the NIST AI Risk Management Framework and the EU AI Act. View the full matrix here.

For organisations wondering where to begin with the AI Controls Matrix, CSA has also published the implementation timeline below.

Identity at the Center’s recent episodes recapping the Identiverse event are worth a listen and can be found here.

The Identity Jedi Show released an episode with the President of onboard.id on building an agentic AI identity security architecture. It connects directly to the agent standards covered in this issue, looking at why agents need their own identities, permissions and controls rather than operating through shared human or service accounts. Listen to the episode here.

Clutch Events’ Melbourne Identity, Authentication and Access Management Summit is coming up on 16 September. The event is run by the publisher of Identity Briefing, and registration is free for identity practitioners. Register for the Melbourne Summit here.

FIDO has released the program for Authenticate U.S. 2026, taking place from 19–21 October at the Omni La Costa Resort in Carlsbad, California. View the full program here.

A question the Identity Leaders Network WhatsApp group has been grappling with is:

Is anyone governing AI agent identities in production today?

We want to hear from you if you are open to talking about this issue.

It does not need to be a complete program. We are interested in what teams are actually doing now, rather than what appears in the strategy deck.

Share what is working and where the gaps remain. We will bring the patterns together anonymously under Chatham House Rule for Issue #2.

Get in touch at [email protected] if you would be interested in sharing some insights for the next newsletter.

Identity Briefing is published fortnightly by Clutch Group, which runs the Identity Leaders Network, Identity Briefing and the Global Identity Summit series.

Know someone who should be reading it? Forward this on.

The Identity Leaders Network is a free, global and vendor-neutral identity community.

The group comes together for virtual roundtable discussions, peer-matching meetings, dinners and through the community WhatsApp channel.