GitHub added public-preview server-to-server authentication for Copilot SDK services through organization-installed GitHub Apps. Agents use short-lived installation tokens, inherit organization model and spending policies, and expose app-attributed usage for review and revocation.
Why it matters: Moving from a developer's credential to a workload-owned identity makes unattended agents easier to operate and audit at scale. It also creates a new organization-level principal whose repository reach, model use, budget and revocation path must be governed…
Meta says its Muse personal agent is coming to AI glasses in the coming months with visual context, long-running voice interaction, an agent email address and additional commerce, payment and work connectors including PayPal, Notion, GitHub and Box. Expedia is separately described as coming soon.
Why it matters: A wearable agent that sees the user's environment and can communicate or transact through connectors creates a much wider permission and identity boundary than a chat-only assistant.
NIST finalized IR 8587 on protecting cloud identity and access tokens, emphasizing outcome-based key protection, revocation and token-sharing signals. The final document adds high-level AI-agent and post-quantum considerations while explicitly stopping short of a comprehensive agent-security toolkit.
Why it matters: Agents increasingly carry delegated tokens across services. The guidance makes token theft, proof of possession, revocation and telemetry concrete architecture questions rather than relying on model-level safeguards.
Cloudflare introduced programmatically created, time-limited accounts for background agents to deploy and test resources without a human dashboard signup or permanent API token.
Why it matters: Ephemeral accounts reduce the blast radius and cleanup burden of agents that need real cloud infrastructure for a bounded task.
Microsoft previewed Scout, an always-on agent built on OpenClaw with Entra identity and organizational controls, alongside an alpha OpenClaw-on-Windows environment using OpenShell sandboxing.
Why it matters: Persistent agents create an identity and governance problem as much as a model problem; Microsoft is making enterprise identity part of the agent architecture.