Why OAuth isn't enough: bearer tokens can't tell your AI agent from you
brminnick · reddit · 2026-10-17
A Reddit post argues that handing an AI agent a bearer token doesn't reliably identify which agent is acting, nor distinguish the human from the agent. An accompanying iceberg diagram frames the problem: client application, authorization, and expiration sit above the waterline, while delegation, revocation, provenance, proofs, and responsible party lurk below. As agents increasingly call APIs on our behalf, OAuth needs rethinking around attribution and least-privilege delegation.
More from coding & agent
- Dev ditches Gemini 4 Argon for Grok 4.5, which eats 96.6% of his Cursor tokens — gaganghotra_ · 2026-10-17
- Apple releases RSI-Inference Bench: best agent solves just 26.7% of vLLM/SGLang tasks — SumitGup · 2026-10-17
- Supabase ships MIT-licensed Middleware: write fetch logic once, run on any runtime — dshukertjr · 2026-10-17
- Cognition launches Devin Oncall as Opus 5.5 and GPT-6 Astra both ace SREGym-Lite at 100% — tianyin_xu · 2026-10-17
- msgblast: Open-Source Mac App Broadcasts One Prompt to All Your AI Agents — msg · 2026-10-17
- Vibe coder uses Deep Research to reverse-engineer why QuickTime screen recording looks so good — gaganghotra_ · 2026-10-17