Controls › C-A1
Actor identity verification
Identity established by credential and binding, not by role, name, or convention.
Actor layerMissing or failed in 4 cases (1 ended in harm)Worked in 0Machines: 1Software agents: 3
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| Kia dealer portal 2024 | Machines | Dealer identity verification | failed | Caught first by researchers |
| Agent-run intrusion campaign 2025 | Software agents | The operators told the model, in prompts, that they were employees of legitimate cybersecurity firms doing defensive testing, and the model went along with it; no source describes any check of who the operators were or whether they were authorised to test the targets. The vendor describes the bypass as role-play combined with splitting the attack into tasks that looked legitimate on their own (per the vendor) | absent | Ended in harm |
| Claude Code [bot] trust 2026 | Software agents | In agent mode any GitHub App passed the write-permission check regardless of its actual permissions; the allowed_bots allow-list (in the action since August 2025) and the actor-type check were enforced in tag mode but not in agent mode until the 16 January 2026 fix | failed | Caught first by researchers |
| Pydantic AI: a web page can make a… | Software agents | Request origin not verified (no content-type validation) | failed | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| TSA Security Directive Pipeline-2021-02 series: cybersecurity of pipeline and LNG control systems (draft mapping) | Required by the text | access control measures that keep unauthorized users out of critical cyber systems | United States (designated pipeline and LNG operators) |
| UN Regulation No. 155: cyber security and cyber security management system (draft mapping) | Implied | authentication of remote commands to the vehicle (Kia dealer portal) | Contracting parties to the 1958 Agreement (not the United States) |
| FAA Remote Identification of Unmanned Aircraft (14 CFR part 89) (draft mapping) | Implied | a serial number registered to the operator is bound to the broadcast identity | United States |
| NERC Critical Infrastructure Protection standards (CIP-005, CIP-007, CIP-013, CIP-015), approved by FERC (draft mapping) | Implied | CIP-004 and CIP-007 access management and authentication for control systems | United States (bulk electric system) |
| FAA proposed rule: normalizing beyond visual line of sight drone operations (proposed 14 CFR part 108) (draft mapping) | Proposed | command and control links and systems must resist unauthorized access and interference | United States |
| NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (2022) (draft mapping) | Recommended | authentication and access control for diagnostic, service, and remote interfaces | United States (voluntary) |
| Careful Adoption of Agentic Artificial Intelligence (AI) Services (ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK joint guidance, 1 May 2026) (draft mapping) | Recommended | Designing secure agents, Identity management (p. 15): 'construct each agent as a distinct principal'. | United States (voluntary), jointly with Australia, Canada, New Zealand and the United Kingdom |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-27 | CVE-2026-115413: AWS API Model Context Protocol (MCP) server, missing token audience check The Common Vulnerabilities and Exposures (CVE) record, assigned by Amazon, says that missing token audience validation in the OAuth authentication mode of the Amazon Web Services (AWS) API Model Context Protocol (MCP) server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials using an access token issued to another application by the same identity provider; fixed in 1.6.0. Source ↗ | vulnerability |
| 2026-10-22 | CVE-2026-114612: LiteLLM proxy The National Vulnerability Database (NVD) record says that in the LiteLLM proxy (an artificial intelligence (AI) gateway) from 1.87.0, an authenticated internal user can get a forged administrator credential encrypted by the application programming interface (API) key flow and replay it as a bearer token, gaining administrative access and arbitrary commands through the Model Context Protocol (MCP) standard input/output (stdio) endpoint; versions after 1.91.0 are exploitable in the default configuration, and the record lists fixes in 1.100.4, 1.101.3, 1.102.2, 1.103.1 and 1.104.0-rc.2. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109442: piflow 2.0.0 through 2.0.1 The National Vulnerability Database (NVD) record says piflow 2.0.0 through 2.0.1 lets unauthenticated callers of its chat endpoints make the DeepAgents chat agent run shell commands through exec_shell, with no human approval or allow-list. Source ↗ | vulnerability |
| 2026-10-19 | CVE-2026-102503: Google OSS Agent Mesh (SAM) /libp2p-http ingress The National Vulnerability Database (NVD) record says that in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through alpha.2 the /libp2p-http ingress routes requests to backend services, including command-backed Model Context Protocol (MCP) servers, Agent-to-Agent (A2A) and inference endpoints, without checking a Biscuit token or mesh enrollment, so an unauthenticated peer can invoke them; fixed in 0.1.0-alpha.3. Source ↗ | vulnerability |
| 2026-10-15 | CVE-2026-111322: Archon 0.2.13 through 0.11.1 The National Vulnerability Database (NVD) records that Archon 0.2.13 through 0.11.1 exposes its /api/* control API without authentication, bound to 0.0.0.0 by default, so anyone with network access can send messages to its AI coding agent, which runs with bypassPermissions, and have it execute commands on the host. Source ↗ | vulnerability |
| 2026-10-14 | CVE-2026-110616: NullHub The National Vulnerability Database (NVD) records that NullHub through 2026.5.29 leaves its /api/* management API unauthenticated on non-loopback listeners, letting a caller control agent instances, rewrite provider credentials, and manage cron jobs and Model Context Protocol (MCP) servers. Source ↗ | vulnerability |
| 2026-10-06 | CVE-2026-104850: MCP TypeScript SDK The National Vulnerability Database (NVD) record says that starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the software development kit's OAuth client support let the Model Context Protocol (MCP) server a client connected to decide which authorization server received the client's OAuth credentials. Source ↗ | vulnerability |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.