buildOne report1 publisher A static denylist stopped one more prompt injection than no protection in a coding-agent study
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Sign in with ChatGPT lets Plus and Pro users cover an app's AI requests from their own plan
OpenAI's Sign in with ChatGPT lets Plus and Pro users run an app's AI requests on their own plan, up to a weekly cap they set per app. That cap reserves none of the user's quota, so builders still need their own API key for any request the plan cannot cover.
Reality
- Evidence55
- Adoption30
- Hype gap+5
- Incentives30
- Confidence50
buildOne report1 publisher npm trusted publishing now retags releases over OIDC behind an off-by-default checkbox
GitHub let npm trusted publishing move dist-tags with short-lived OIDC credentials on 2026-09-30, behind a permission that ships switched off. It closes the gap that sent teams back to a long-lived token just to point latest at a new release.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence55
Open-source Authorizer checks user permissions before AI search ranks company files
Authorizer, a self-hosted open-source auth server, drops files a user may not see before an AI assistant's vector search scores them. Teams can run that check inside their own login server, though its limits on AI agents rest on the maintainers' word.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence40
npm keeps accepting write tokens after you switch on OIDC trusted publishing
Trusted publishing swaps a stored npm token for a short-lived OIDC one, and it needs npm CLI 11.5.1, Node 22.14.0 and a hosted runner. The CLI falls back to the old token whenever the OIDC path is absent.
Publishers:docs.npmjs.com
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+25
- Incentives78
- Confidence62
Red Hat tells Ansible 2.7 upgraders to settle the deployment model before booking the window
Red Hat's own upgrade guide names six environment decisions and three ways to run Ansible Automation Platform 2.7. It says the job can take an afternoon or several weeks, and RPM-based 2.4 and 2.5 installs sit at the long end.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives78
- Confidence60
Trail of Bits traces SAML's insecurity to the XML signature layer underlying most fielded implementations
SAML's security rests on XML signature validation, and most fielded implementations hand that job to libxmlsec. Trail of Bits says that dependency is the reason to deprecate the protocol and move SSO to OpenID Connect.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence55
buildOne report1 publisher A feature gate in Codex build 9922 hides a cloud runner that drafts its own environment
RuntimeWire's comparison of two shipped Codex desktop builds found a second cloud path whose new environments start at package-manager network access, then take on Tailscale keys, proxy-delivered secrets and OIDC cloud identities.
Reality
- Evidence62
- Adoption8
- Hype gap+9
- Incentives35
- Confidence58
buildOne report1 publisher A ZoomEye port query returned 4,138,087 hosts on Kubernetes' conventional API port
A ZoomEye query counted hosts answering on Kubernetes' default API port on 2026-09-20. The write-up keeps the unit honest: a host that responded to one port query, with no authentication test behind the number.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−15
- Incentives40
- Confidence60
buildOne report1 publisher GitHub Actions deploys into a private EC2 instance through the SSM agent's outbound connection
The SSM agent holds a connection out to AWS, OpenSSH rides it as a ProxyCommand, and EC2 Instance Connect pushes a key that sshd forgets after 60 seconds, so the security group ingress list can stay empty.
Reality
- Evidence45
- Adoption10
- Hype gap+28
- Incentives85
- Confidence40
buildOne report1 publisher OCI's Workload Identity Federation exchanges a GitHub OIDC token for a short-lived session
In a dev.to write-up, Jorge RN traces the chain from a workload's own identity to an ephemeral OCI session token, where the authorization decision reads claims such as repository, workflow and branch.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+25
- Incentives40
- Confidence35
buildOne report1 publisher Restricting an agent to read-only views removes the runtime SQL construction it once had
A dev.to design post puts a per-task scope check under every tool invocation and caps the agent's cloud credentials at fifteen minutes. The restrictions work by taking capability away from the model.
Reality
- Evidence32
- Adoption
- Not scored
- Hype gap+30
- Incentives20
- Confidence45
buildOne report1 publisher A predictable pnpm cache key carried fork code into TanStack's npm release workflow
TanStack's postmortem says 84 malicious versions went out across 42 packages on 2026-05-11 with no npm token stolen, because a release job restored a cache that an untrusted pull_request_target build had written.
Publishers:tanstack.com
Reality
- Evidence68
- Adoption45
- Hype gap+6
- Incentives65
- Confidence58
buildConfirmed2 publishers The typed authentication module and Netty's HTTP/3 support both arrive experimental in Ktor 3.6.0, while the changes that touch code you already wrote are two deprecations and one client Accept-header setting.
Reality
- Evidence62
- Adoption15
- Hype gap+34
- Incentives70
- Confidence60
buildOne report1 publisher AWS runs four JWT claim gates in one Lambda before an MCP tool call reaches its data
The pattern treats each MCP tool invocation on Amazon Quick as an access event and checks MFA, country, group-to-role mapping and tool permission against claims Entra ID puts in the token. Configuring the identity provider is most of the work.
Reality
- Evidence54
- Adoption
- Not scored
- Hype gap+18
- Incentives82
- Confidence58
Gremlin reports clearing nine times as many vulnerabilities with the same staff
Frederic Bull says his team processed just over nine times the vulnerability volume in a year without adding headcount and cut time to remediate by 5%, a self-reported figure with no absolute counts behind it.
Reality
- Evidence26
- Adoption22
- Hype gap+34
- Incentives58
- Confidence48
A rogue Entra MFA provider captures plaintext passwords inside a sign-in that still succeeds
Varonis Threat Labs registered its own External Authentication Method in a test Entra tenant and served a copy of Microsoft's password prompt during the second factor. Every sign-in completed, and the passwords landed in a file.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives75
- Confidence55
buildOne report1 publisher Cognito's replica user pool rejects every attribute write with OperationNotEnabledException
AWS's multi-Region replication copies a Cognito pool's configuration, hashed credentials and IdP settings into one other Region with eventual consistency. Only the primary accepts writes, so failover planning becomes a per-path decision.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap+22
- Incentives85
- Confidence64
buildOne report1 publisher AgentCore's Consent portal absorbs the five pieces of session binding you used to host
AgentCore Identity now hosts the redirect leg and keeps the tokens, and what you configure in exchange is an OIDC application in your corporate IdP, a service role, and AWS's callback URL inside your GitHub and Slack apps.
Reality
- Evidence62
- Adoption12
- Hype gap+8
- Incentives88
- Confidence55
buildOne report1 publisher ELN ID promoted its de facto admin check after an audit found zero ServiceRole users
EarthLink Network's in-house identity platform now settles administrator status in one function, on both token issue and refresh, using the group-name check its products were already applying, and the UI only displays the answer.
Reality
- Evidence45
- Adoption22
- Hype gap−10
- Incentives50
- Confidence40