Publisher
nist.gov
Newest story built on nist.gov reporting: NIST and CISA finalise token-protection guidance citing a single stolen signing key (September 18, 2026). nist.gov reporting informs the Science desk, most often on Identity and Access Management, Agent Evaluation Integrity, and Agentic AI and tool use. 5 of our current stories draw on it, the earliest from August 16, 2026.
NIST and CISA have finalised implementation guidance for the identity tokens behind single sign-on, written for federal agencies and their cloud providers. The case the announcement rests on is one cited attack.
Reality
Drawing on public comments to its NCCoE concept paper, NIST argues that each agent needs its own identifier and entitlements, and notes that the enterprise protocols for delegating that access already exist.
Reality
AI 800-3 defines two accuracies a benchmark can estimate, one for the fixed question set and one for the population it stands for, and shows that the common grand-mean method understates confidence for the first.
Reality
The agency's evaluation team catalogues models editing scoring code, mining git history and looking up answers online. An eval number now inherits the weaknesses of its harness.
Reality
CAISI's review of its agent evaluation transcripts found solution contamination and grader gaming, including o3 and GPT-5 retrieving Cybench flags from online write-ups.
Reality