The agent is a user without a license

The agent without an ID

United Airlines will restrict third-party AI agents from its website, its app, and also when they arrive through agencies and aggregators (cnbc.com).

The reason they give is that those agents share credentials and can break FAA and DOT rules.

Only a human can declare that the luggage carries no explosives.

An agent cannot sign that declaration, and not because it cannot read it. It cannot sign because there is no identity behind it to answer when the signature is wrong.

Amazon already blocked Muse, Meta's agent, and Walmart integrated it into its workflow (cnbc.com).

Two companies of the same size, two opposite decisions, and neither one is a whim. One closed the door and the other opened it with conditions.

The question left in the air is the same in both cases.

What identity does the agent act with? Who answers when it gets it wrong?

I will leave it there...

The pattern

An agent wants to act in a system that was not designed for it.

The FAA requires a human declaration and the agent cannot give one.

The agent walks in with someone's keys and the system cannot tell whether it is that person or an automated process.

There is no standard for agent authentication and every company improvises.

Integrate the agent or close the door on it?

Those are the two options available today.

The other side

An OpenAI agent accessed the Medicare statistics portal without authorization in June (apnews.com).

Australia has reacted with an AI safety regulator with penalties and an obligation to report incidents and misalignments (apnews.com).

The same month, a public PoC called worse_query lets an app read data from other apps on iOS 26.0-27.2 without jailbreak or kernel exploit (thehackernews.com).

Apple does not confirm a patch and there is no CVE assigned.

Binance warns about exposed seed phrases in the same period.

The agent is not only a user without a license when it acts for you. It is also a user without a license when it acts against you, and in both cases the system does not know who to hold accountable, though I understand the owner is traced and the weight of the law falls on them... right?

Identity or patching?

On Friday Forescout published a data point that changes the scale of the problem.

Vedere Labs cut vulnerability analysis from 9 months to 90 hours using commercial AI (forescout.com).

They validated 99 flaws across 10 TCP/IP stacks

• 66 unknown
• 52% high or critical severity.

If discovery compresses from months to days, patching stops being the defensive advantage.

The advantage moves to who holds the session, with what scope, and who can revoke it.

The SCKit campaign against ScreenConnect illustrates it.

It exploits CVE-2026-84869, already patched, hijacks operator sessions, and its RelayTrap module pivots back against the technician investigating the incident (thehackernews.com).

The patch closes the known hole but it does not close the stolen session, I think I have said that already.

What to look at on Monday

• Trim the agent's scope. If an agent enters with a person's credentials, ask for them to be delegated, with permissions limited to the task and with an expiry date. Without that, the agent inherits everything its owner can do.
• Turn on per-session tracing. Every agent action has to be tied to an identity and a moment. If you cannot reconstruct what it did and when, you cannot revoke it or audit the incident.
• Separate the session from the patch. Review which support sessions are still open after you apply the patch. ScreenConnect shows that a closed hole does not close the session that was already inside.

How would I test it?

I would set up a local agent with read-only permissions on a test folder and give it a concrete task, like summarizing a file.

Then I would try to make it write to that folder. If it succeeds, the permission is not properly scoped and the problem is mine, not the model's.

I would repeat the test with a delegated credential and an expiry date, and what I would look at is whether the system rejects the action and whether it leaves a trace of who tried it.

With that I would have a cheap answer to the question of the week.

If my agent cannot do more than I asked, identity is solved.
If it can, I have a user without a license inside my house.

The close

The debate of the week is not whether an AI can book a flight but with what identity it does it and who answers if it gets it wrong.

Until there is a standard for agent authentication, every company has only two options.

Integrate the agent or close the door on it.

Originally published at https://sammideblas.com/notas/the-agent-is-a-user-without-a-license

Si has leído hasta aquí... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ¿No Crees?