Blog — Field notes on identity security

The blog 01

Field notes from the identity frontier.

Breach teardowns, threat research and product dispatches from the team stopping identity attacks in production — written for the people who get paged.

Latest dispatch

Security·Nov 12, 2026

Identity in the Time of AI Agents: Inside GTG-20006

Anthropic's September 2026 threat report shows how AI lets attackers do more with fewer people. GTG-20006, consistent with Midnight Blizzard, used AI at every stage of the kill chain — from device code phishing to rebuilding its own malware until it evaded detection. A recompile changes the binary and its hash, but not the identity relationship. We walk the identity path from phished device code to bulk mailbox export, and map where identity controls interrupt the chain.

SlashID Team
Threat Intelligence

Read the analysis →

// security · Nov 12, 2026

69 dispatches

Field notes from the identity frontier.

Identity in the Time of AI Agents: Inside GTG-20006

Storm-0940 and ARTEX: Agentic OAuth Abuse in the ConnectWise Compromise

JadePuffer (Storm-3168): An AI Agent Wiped 100+ Azure Storage Accounts in Seven Minutes

Test-driving Jev on a security task: identity resolution

Breaking MCP at the Identity Layer

When the MCP Server Is the Payload: Attacking MCP at the Implementation Layer

The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave

The Illicit Consent Grant Part 1: Understanding Modern OAuth Consent Phishing

Analysis of the 2026 Stryker Breach: Weaponizing Cloud Endpoint Management

Vercel April 2026 Security Incident: How a Compromised OAuth App Led to a Major Breach

Deepfake Impersonation Attacks (Part 2): Defending with SlashID Mutual TOTP

Deepfake Impersonation Attacks (Part 1): Anatomy of Modern Deepfakes

NYDFS 2026 Vishing Advisory: Detection and Defense with SlashID

Scattered Spider Tradecraft: Identity Abuse, Attack Flow, and Defense

Microsoft Actor Token Forgery

Access tokens strike again, the Salesloft Drift breach

Illicit Consent-Granting & App Backdooring – Obtaining persistence in Entra

Achieving Least Privilege: Unused Entitlement Removal

Protecting against malicious OAuth 2.0 applications

Navigating PCI DSS 4.0: The Challenge of Non-Human Identities

Identity Security: The problem(s) with federation

Non-Human Identities Security: Breaking down the problem

Detecting Man-in-the-Middle Attacks with SlashID

A deep dive in the AWS credential leaks reported by Palo Alto Networks

SlashID RBAC: Globally-available role-based access control

Protecting against Snowflake breaches

Introducing the SlashID Local Deployment

ODPR: A Framework for Securing Non-Human Identities

Credential Tokenization: Protecting third-party API credentials

Secure API and M2M Access with OAuth2 Client Credentials and SlashID's sidecar

Introducing Organization Attributes

Introducing Anonymous Users: Balancing First-Party Data Collection and User Experience

SlashID SDK for PHP and Laravel authentication

Adding custom claims to identity tokens

SlashID: Building a globally distributed Identity Platform

Passkeys Adoption Trends: Survey from Large Deployments

Single Sign-On implementation: Safely retrieving the email claim

Single Sign-On implementation: Security Issues and Best Practices

Introducing the SlashID Remix SDK: Authentication made easy

Firebase Authentication and Google Identity Platform User Enumeration Vulnerability

GDPR Compliance: Consent Management

OAuth 2.0 Fine-Grained API Authorization with Gate and OpenAPI

Rate Limiting for Large-scale, Distributed Applications and APIs Using GCRA

Context-aware authentication: fight identity fraud and qualify your users

Backend Authentication and Authorization Patterns: Benefits and Pitfalls of Each

JWT Implementation Pitfalls, Security Threats, and Our Approach to Mitigate Them

No-code anti-phishing protection of internal apps with Passkeys

Firewalling OpenAI APIs: Data loss prevention and identity access control

Ditch your organizations table

Protecting Exposed APIs: Avoid Data Leaks with SlashID Gate and OPA

Docusaurus - Authentication and authorization with SlashID

Authenticate your Shopify customers with SlashID

Synchronous Webhooks

Building a React Login Page Template

SlashID Analytics Webhooks

Passkeys - Threat modeling and implementation considerations

Authentication flows with SlashID

Using Google Tink to sign JWTs with ECDSA

React SDK support for <Groups>

Sign-in and Sign-up React component release

Fetching Google Groups with SlashID SSO

In-browser HSM-backed Encryption with Tink and Wasm

Official React SDK release

Adding Identity to Docusaurus

Introducing Data Vault - Secure HSM-backed PII storage directly from the frontend

Social logins in 5 minutes or less

App-layer cryptographic primitives for secure storage of user data

The good, the bad and the ugly of Apple Passkeys

The Security and Regulatory Compliance Benefits of WebAuthn

Phishing Attacks – WebAuthn to the rescue

Get the dispatch in your inbox.