Controls › C-A2
Authority binding
An actor's authority is bound to the specific principals and assets it serves.
Actor layerMissing or failed in 3 cases (1 ended in harm)Worked in 0Software agents: 1Machines: 1Software acting on machines: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| OpenAI agent, Medicare portal 2026 | Software agents | Portal access control against persistence | failed | Ended in harm |
| Kia dealer portal 2024 | Machines | Dealer-to-vehicle authority binding | failed | Caught first by researchers |
| Gemini calendar invite 2025 | Software acting on machines | Binding of device authority to the current user intent | absent | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| SEC Regulation S-P amendments: incident response and customer notification (2024) (draft mapping) | Implied | oversight of service providers that handle customer information on the firm's behalf | United States (broker-dealers, investment advisers, funds, transfer agents) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-30 | CVE-2026-62863: MoLing, a computer-use and browser-use Model Context Protocol (MCP) server, accepts unauthenticated tool calls that a malicious web page can send in Server-Sent Events (SSE) mode The National Vulnerability Database (NVD) record says that before 0.5.0, MoLing's SSE-mode endpoints do not authenticate requests, so a malicious web page a user visits can obtain a session identifier and send unauthorized MCP tool calls that, depending on the configured tools, can read or write local files or execute commands; fixed in 0.5.0. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-77932: DB-GPT The National Vulnerability Database (NVD) record says DB-GPT through 0.8.2 lets unauthenticated callers reach the /api/v1/chat/react-agent endpoint, whose user check grants every caller the admin role, and send prompts that make the ReAct agent's unsandboxed code and shell tools run arbitrary Python or bash as root in the webserver container. Source ↗ | vulnerability |
| 2026-10-19 | CVE-2026-109437: CognicellAI Cognition The National Vulnerability Database (NVD) record says CognicellAI's Cognition before 0.13.0 defaults its agent sandbox backend to local execution and has no authentication on its REST/SSE (Representational State Transfer and server-sent events) API, so anyone can create a session and post a message that makes the Deep Agents ReAct loop run attacker-directed shell commands as the server process. Source ↗ | vulnerability |
| 2026-10-19 | CVE-2026-102503: Google OSS Agent Mesh (SAM) /libp2p-http ingress The National Vulnerability Database (NVD) record says that in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through alpha.2 the /libp2p-http ingress routes requests to backend services, including command-backed Model Context Protocol (MCP) servers, Agent-to-Agent (A2A) and inference endpoints, without checking a Biscuit token or mesh enrollment, so an unauthenticated peer can invoke them; fixed in 0.1.0-alpha.3. Source ↗ | vulnerability |
| 2026-10-15 | CVE-2026-57496: NetLicensing MCP Server The National Vulnerability Database (NVD) record says the NetLicensing Model Context Protocol (MCP) Server before 0.1.8 does not check a product-number argument for path segments, so an MCP client holding a non-administrative API key can reach the token endpoint and read plaintext token values, and a recovered administrative token can give read, write and delete access to the NetLicensing account; fixed in 0.1.8. Source ↗ | vulnerability |
| 2026-10-15 | CVE-2026-76066: IntentKit The National Vulnerability Database (NVD) records that IntentKit through 2.6.3 checks tool calls against its full tool registry, so owner-only tools such as wallet transfer can run for public callers without an approval step. Source ↗ | vulnerability |
| 2026-10-14 | CVE-2026-55786: Flyto2 Core The National Vulnerability Database (NVD) records that from 2.26.2 until 2.26.4 Flyto2 Core's HTTP Model Context Protocol (MCP) route accepted unauthenticated tools/call requests that could reach its shell-execution module and run operating-system commands; fixed in 2.26.4. Source ↗ | vulnerability |
| 2026-10-14 | CVE-2026-110616: NullHub The National Vulnerability Database (NVD) records that NullHub through 2026.5.29 leaves its /api/* management API unauthenticated on non-loopback listeners, letting a caller control agent instances, rewrite provider credentials, and manage cron jobs and Model Context Protocol (MCP) servers. Source ↗ | vulnerability |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.