Dependencies are not the core problem; our broken identity and access models combined with bad isolation makes this supply chain attack so potent. Keys on disk in the same user space as the compromised package took this attack from bad to devastating. Even if every tool was home built and verified you’d still be at risk of model poisoning and other attack vectors. Agent security starts with identity and access - and we’re fixing this @KeycardLabs

This is such a wild & reactionary take on what's going on here from @garrytan - for someone who is usually so well-spoken, rational, and technology-forward, I'm shocked. Determining the identity of an agent, service, machine, computer, or other entity is a fundamental problem that needs to be addressed. The standard that @Cloudflare and friends are working on is critical to enabling a truly agentic economy - in the same way that standards like SSL/TLS paved the way for the proliferation of internet commerce in the late 90s/00s. No one here is trying to create some kind of locked-in web experience (e.g. bullshit DRM) - they're trying to help resource owners (websites, stores, platforms) identify and discern between "good actors" and "bad actors" in a way that helps them _enable agentic workflows_ to proliferate, to enable agents to interoperate, and enable humans to be able to delegate to trusted agents in the same manner. This is about levelling up our bot/agent abuse detection from Layer 3/4 (transport/tcp&ip) behaviour to Layer 5 (app), so when an agent on Vercel gets blocked by an ISP in Spain, they don't have to block all Vercel traffic; instead, they can be discerning about exactly which agent or app to prevent the abuse. The work @Cloudflare is doing here is really good and coming from a good place - it's built upon existing practices (e.g., using .well-known for advertising key data) and leverages work that has been ideated for years to address issues surrounding webhooks and machine-to-machine authentication challenges. I'm excited by the work being done here and happy to see @browserbase & @pk_iv realize how this helps them solve real challenges for their customers. This isn't some scary thing; it's just the next piece of protocol being proposed to unlock real end-user value in the same way that Cookies & TLS unlocked the trillion-dollar economy we have today on the internet.

Agents break the fundamentals of traditional IAM systems - overtime, if you build them, as you did a traditional service, they will end up with god-mode privileges -- access to everything, for every user that interacts -- like katamari damacy. Ultimately, we need IAM systems that are highly dynamic, ephemeral, and only give agents access to systems on a per-task, user-specified basis that are deeply integrated into the agentic loop and provide active, run-time guarantees. If a user can't access something, an agent shouldn't be able too either, and, the user should have the ultimate control over what those agents can do on _their behalf_. The foundations of agentic security come back to the basics: how do you control what they can access, on behalf of whom, and what actions they perform with whose authority. This is why we're rebuilding IAM from the ground-up for the agentic era at @KeycardLabs.