AI did not defeat auth, single-factor login did

At a glance

What this is: Stytch argues that AI has not broken modern authentication, but has made single-factor login the weak point by exploiting isolated credentials, lone biometrics, and thin session signals.

Why it matters: For IAM teams, the implication is that stronger authentication now has to combine proof-of-possession, device trust, and risk scoring for humans and delegated AI clients alike.

Context

Single-factor authentication is a governance gap, not an AI inevitability. If one signal is expected to prove identity on its own, cloning, replay, credential stuffing, and delegated access abuse all become easier to operationalise at scale. The article frames that failure in human identity terms first, then extends it to AI agents that inherit access.

The practical problem is that many programmes still treat a password, a selfie, or a one-time login event as sufficient proof. That model breaks when fraud can borrow realistic media, automate retries, and chain into downstream integrations. The same trust weakness also appears in delegated access models where a human owner controls an AI client or integration.

Key questions

Q: What breaks when identity still depends on passwords, OTPs, and security questions under AI fraud?

A: Those controls break because they assume a human can reliably detect deception and protect a secret. AI makes phishing, relay attacks, and synthetic impersonation cheap enough that the attacker can capture or replay the factor at scale. In practice, the control no longer proves the user is present, only that a secret was exposed.

Q: Why do passkeys reduce phishing risk compared with passwords?

A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret. That means a fake site cannot harvest a password and replay it later. The phishing benefit is real, but it only holds if the organisation also limits weak fallback methods that attackers can abuse instead.

Q: How should security teams handle delegated access when AI agents act on behalf of customers?

A: Security teams should treat delegated access as a separate governance layer, not as a normal login session. Define what the agent can do, how much value it can move, which approvals are required, and how delegation is revoked. Without those boundaries, the agent inherits more authority than the customer intended and fraud risk expands quickly.

Q: When should organisations step up authentication during a session?

A: Step up authentication when risk changes enough that the original trust decision is no longer reliable. Common triggers include unusual location, disabled endpoint protections, new device context, privileged action requests, or unexpected behaviour from an NHI or agent. The goal is to interrupt risky activity before it becomes lateral movement or data exposure.

Technical breakdown

Why single-factor login fails under AI-enabled fraud

Single-factor login fails because it creates a one-step trust decision. If the authenticator is only a password, a face capture, or a voice sample, attackers need to defeat just one control path to obtain session access. AI changes the economics by making identity mimicry cheap and scalable, but the underlying weakness is the same: one signal cannot prove presence, possession, and legitimacy at once. Effective auth needs layered evidence, not a lone assertion. That is why device-bound credentials, risk scoring, and step-up challenges matter more than ever in high-risk environments.

Practical implication: stop treating a single credential or biometric as sufficient session proof in high-risk flows.

How device-bound passkeys change the authentication model

Passkeys shift authentication from shared secrets to proof-of-possession. With WebAuthn and FIDO2, the private key stays on the device and is released only through local user verification such as Face ID, Touch ID, or a PIN. That means phishing a reusable secret is no longer the primary attack path. The control is not magic, though. It only works when the credential is hardware-rooted, the device is trusted, and the user experience discourages fallback to weaker methods.

Practical implication: make passkeys the default and reduce password fallback to a tightly controlled exception.

How AI agents inherit identity risk through delegated access

AI agents are not human users, but they often operate under human authority and use the same application or API trust fabric. That makes delegated identity the real issue: who owns the agent, what it can do, and which proofs are required before it acts. If an agent can call tools without scoped permissions or risk checks, fraud can move from session compromise to programmatic abuse. Treating agents as first-class identities forces the programme to manage ownership, least privilege, and auditable access paths.

Practical implication: scope delegated AI access explicitly and apply the same session risk logic used for human users.

Threat narrative

Attacker objective: The attacker aims to obtain a trusted session that can be used for fraud, account abuse, or programmatic access without triggering step-up controls.

1. Entry begins when an attacker exploits a single weak factor such as a password, uncloaked biometric, or weak fallback path to start a fraudulent session.
2. Escalation occurs when the session is accepted without additional proof of device trust, network context, or behavioural risk, allowing the attacker to operate as a legitimate user.
3. Impact follows when the compromised session is used to move money, access tools, or trigger delegated actions through connected systems.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Single-factor trust is the failure mode, not AI itself: The article is right to reject the idea that modern authentication has been defeated wholesale. What has failed is the assumption that one factor can represent both identity and intent under fraud pressure. That assumption breaks as soon as cloned media, replayable secrets, or automated abuse enter the picture. Practitioners should read this as a governance warning about over-trusting isolated signals, not as an argument against authentication controls.

Device-bound proof now matters more than possession alone: Passwords, one-time selfies, and cloud-tethered biometrics all collapse when the attacker can imitate the signal instead of stealing the user. Hardware-rooted credentials change the problem because the proof lives on the device and is released locally. That is why phishing-resistant auth belongs at the centre of modern identity architecture, especially where fraud has direct financial or operational impact.

Delegated AI access turns auth into an identity chain problem: Once an AI client acts for a human, the question is no longer only who logged in, but who authorised the agent, what it may do, and how its actions are bounded. This is a classic delegation problem with a machine identity layer attached. The implication is that auth design must cover the owner, the delegate, and the session context together, or the programme will lose visibility at the point of action.

Continuous risk signals are becoming part of the credential, not a separate control: The article’s session scoring logic is sound because most fraudulent activity leaves device, network, and navigation traces even when the front-door factor looks valid. That shifts the programme from static login checks to pre-session and in-session confidence building. For IAM leaders, the strategic change is to treat trust as something assembled from context, not declared at the point of entry.

What this signals

Single-factor login is now a programme liability: Identity teams should assume that passwords, isolated biometrics, and fallback channels will be targeted first by AI-enabled abuse. The operational shift is to make trust cumulative, with proof-of-possession and device confidence established before the session starts.

Delegated access needs the same governance model as direct login: Once an AI client can act for a human, the identity programme has to govern owner binding, scoped permissions, and session confidence together. If those controls are split across teams, accountability will fragment at the exact point where abuse becomes hardest to distinguish from legitimate automation.

For practitioners

• Make passkeys the default credential Prioritise phishing-resistant authentication for primary user journeys and reserve passwords only for tightly managed exceptions and recovery paths.
• Bind biometrics to hardware Require local device verification and secure enclave-backed keys rather than trusting cloud-hosted biometric templates or standalone selfie checks.
• Score sessions before acceptance Use browser, OS, network, and device relationship signals to evaluate risk before a session is granted full trust.
• Apply scoped trust to AI agents Treat delegated AI clients as first-class identities with explicit owner binding, least privilege, and auditable action scope.
• Reduce weak fallback paths Hide password fallback behind deliberate user action and monitor where weaker authentication paths are still required for business continuity.

Key takeaways

• AI-era fraud exposes the weakness of isolated login signals rather than proving that authentication itself has failed.
• The practical control shift is toward phishing-resistant credentials, device-rooted verification, and early session risk scoring.
• Delegated AI clients should be governed as scoped identities, because programmatic access can amplify the same trust gaps that affect human sessions.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Proof-of-Possession: Proof-of-possession binds a token or credential to a specific key so possession of the token alone is not enough to use it. For AI agents, it reduces replay risk and helps ensure that an intercepted credential cannot be reused by a different actor.
• Delegated Identity: Delegated identity is when one actor acts on behalf of another with explicit permission and bounded authority. In AI-assisted commerce, it requires clear consent, limited scope, and traceable records so the retailer can distinguish authorised delegation from unauthorised automation.
• Pre-Session Risk Scoring: The practice of evaluating device, network, and behavioural signals before a session is accepted as trustworthy. It is not a replacement for strong authentication, but a companion control that helps decide whether to allow, challenge, or step up access when fraud likelihood is elevated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.