41 stories
Per-connection prices are easy to compare and rarely the number that decides your bill. Here's a worksheet for estimating enterprise auth costs at 5, 25 and 100 customers.
Real request bodies from the two directories most enterprise customers use, where they part ways with RFC 7644 and the new interoperability profiles, and how to handle each one without leaving a leaver active.
Pingvin Share X, Better Auth and AshAuthentication each attached a stranger's OAuth sign-in to someone else's account. Here's how each check failed and what a safe linking decision looks like.
On-behalf-of tokens (Databricks), live ACL re-checks (AWS), and parent-level fine-grained authorization: how each keeps an AI assistant from showing users data they can't access, and when to use which.
Box CEO Aaron Levie at WorkOS init() on why engineering adopted agents first, what a bank must settle before an agent sends a wire, and why he backs FDE roles.
Braelyn put DOOM on her init() badge. Others built a Tamagotchi, voice assistants and a flight tracker. Here's the ESP32 badge and how 500 got ready in time.
How I use ChatGPT tasks to organize persistent Pi sessions, connect MCP tools, bridge gaps with computer use, and deliver work without losing context.
WorkOS init() 2026 at SFJAZZ Center: live previews of Airlock, Atlas and Passport, plus talks from Aaron Levie, Nikita Shamgunov, Claire Vo, swyx and more.
Map WorkOS organizations to your customers, keep workspaces in your own database, and handle org switching, cross-tenant guests and internal admins in a Next.js app.
Take a Vite and React app from localhost to production with httpOnly cookie refresh, a custom Authentication API domain, preview deployments, and a Node API that verifies every request.
AI coding agents put internal screenshots from more than 300 organizations on public GitHub. No model broke. The agents used permissions nobody meant to give them, to finish a task nobody thought was risky.
Citrix has patched an actively exploited memory overflow in the SAML handling of NetScaler ADC and Gateway. It is the fourth NetScaler SAML vulnerability this year, and the pattern says a lot about where authentication code breaks.
More than 100 security vendors now plug into the Claude Compliance API. Here's what it teaches any AI product selling to enterprises about audit logs: what to record, who can export it and where it goes.
igma's remote MCP server admits clients by the client_name they send during dynamic client registration. Why that check proves nothing, what CIMD fixes and what it doesn't, and what to gate on instead.
Fairwind's rules read like an authorization spec for capability. Background checks, phishing-resistant MFA, security-team-only access and usage tracking map one to one onto identity primitives.
The MCP Python SDK, the Rust SDK (rmcp), and LiteLLM each accepted authentication input that nobody verified. Here is what broke, who is affected, and the checklist that closes the gap.
A new study found that coding agents in seven of eight popular harnesses deleted their own session traces when asked. If a record of what an agent did matters, it has to live somewhere the agent can't reach.
Microsoft says the actor behind JADEPUFFER, the first documented agentic ransomware operation, used two compromised Azure service principals to map a tenant and then delete storage accounts, a Key Vault, and app resources in about seven minutes.
Showing 18 of 41 stories
Load more storiesGet the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
