Notifications
Clear all
Topic starter
18/08/2026 2:39 pm
TL;DR: Static API keys are a security antipattern for AI agents, and Ory argues that OAuth’s delegated, scoped, revocable tokens are the right baseline because agents generate new intent at runtime, but coarse-grained delegation still needs fine-grained authorization and runtime checks for prompt injection resistance.
NHIMG editorial — based on content published by Ory: OAuth for AI Agents: How Authorization Actually Works
By the numbers:
- Internal repositories are 6x more likely to contain secrets than public ones, with 32.2% versus 5.6%, contradicting the assumption that private repos are safe.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: How should security teams govern AI agents that use OAuth access?
A: Security teams should inventory each agent, limit scopes to the minimum required, assign an owner, and monitor its behaviour continuously.
Q: Why do service accounts and AI agents create different identity risk than employees?
A: Service accounts and AI agents create different risk because they are not managed through HR lifecycle events, yet they often hold broad technical permissions and can act at machine speed.
Q: What breaks when AI agents rely on static OAuth scopes for MCP access?
A: Static OAuth scopes break because they describe delegated permission at the moment of issuance, not the live intent behind each agent action.
Practitioner guidance
- Replace static agent secrets with delegated tokens Move AI agents off long-lived API keys and onto short-lived OAuth tokens wherever the workflow allows.
- Bind each token to one resource audience Set aud claims so a token issued for one MCP server or API cannot be replayed against another service.
- Require agent and task claims in every token Add agent_id, task_id, and session_id claims so every downstream action can be traced to a specific actor and purpose.
What's in the full article
Ory's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of which OAuth flow fits each agent pattern, including user-delegated, autonomous, on-behalf-of, and headless scenarios.
- Implementation guidance for scopes, claims, audience binding, and revocation in agentic architectures.
- The article’s view of how OAuth fits alongside fine-grained authorisation for runtime policy decisions.
- Additional context on MCP server authorisation patterns and token exchange in agent-to-agent calls.
👉 Read Ory's analysis of OAuth for AI agents and delegated access →
AI agent OAuth: are static keys and broad scopes still acceptable?
Explore further
18/08/2026 3:23 pm
Static API keys are the wrong baseline for AI agents: they assume the identity subject is predictable, re-usable, and safe to expose as a long-lived secret. AI agents generate new intent at runtime, so a key that never expires gives an attacker or compromised prompt a durable execution path. The implication is that agent identity governance has to move away from shared secrets as a default pattern.
A few things that frame the scale:
- DeepSeek alone generated 113,000 new exposed API keys in 2025, illustrating how new AI providers create credential exposure before security guardrails catch up, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
A question worth separating out:
Q: Who is accountable when an AI agent uses delegated access incorrectly?
A: Accountability should follow the delegated authority chain, not stop at the agent label. The relevant owners are the teams responsible for the human identity, the service identity, the workflow, and the policy that allowed the action path. If those responsibilities are not explicit, incident review will be incomplete and remediation will focus on the wrong layer.
👉 Read our full editorial: OAuth for AI agents exposes the limits of static API keys
