Token Security

Token Security offers a centralized non-human identity security solution for multi-cloud environments.

[Token Security @TheTokenSec]

The Agentic Universe: more software will be built for agents and humans. Teams are already reshaping products so agents can use them with less friction.

@MaorShlomo, founder of @Base44, on what’s next:
https://t.co/I7pbX4cAS8

#AgenticUniverse #CybersecurityAwarenessMonth

[Token Security @TheTokenSec]

Nobody has years of experience securing AI agents. The people doing it are learning in production.

So we asked them to chart a course with us.

Meet The Agentic Universe: free AI agent security lessons from CISOs at @Roblox, @klaviyo, @webflow & more.

[Token Security @TheTokenSec]

27+ topics across five worlds, from Foundations to Detection & Response. Short videos, deep dives, and checklists you can run against your own environment.

No login. No form. Just the shared journey 🚀

https://t.co/09jQMMFwKs

#AIAgents #AISecurity #CybersecurityAwarenessMonth

[Cloud Security Podcast @CloudSecPod]

An AI agent in your environment has no identity of its own. It acts on behalf of a person, sometimes using that person's human identity.

Ido Shlomo from @TheTokenSec spoke to Ashish on @CloudSecPod. First question in any agent review: whose access is it carrying?

[BleepingComputer @BleepinComputer]

⚠️ Your SOC 2 controls can pass an audit while still failing to answer what AI agents are running, who authorized them, or whose credentials they're using.

🔍@TheTokenSec explains why SOC 2 needs to adapt.

➡️ https://t.co/jMHBQgkI3X
#cybersecurity #sponsored

[NYSE 🏛 @NYSE]

Today on NYSE Live:

Peter Tuchman, @EinsteinoWallSt
Michael Hund, Rare Ventures
Itamar Apelblat, @TheTokenSec

Tune in 9am ET. https://t.co/iTGxq3aRym

[BleepingComputer @BleepinComputer]

🔐 Snowflake is ending passwords for legacy service accounts, but replacing them is only part of the challenge.

🛡️ @TheTokenSec explains why organizations must also identify account owners, dependencies, and access.

➡️ https://t.co/WOUsOhBqDU
#cybersecurity #sponsored

[BleepingComputer @BleepinComputer]

⚠️ Give an AI agent a vague task and broad access, and it may go beyond what you intended.

🛡️ @TheTokenSec explains why agent permissions should stay scoped to their intended purpose.

➡️ https://t.co/8BgZsLyAuZ
#cybersecurity #sponsored

[Cloud Security Podcast @CloudSecPod]

We've spent decades designing identity around people.

AI agents are forcing us to design it around software.

We spoke to Ido Shlomo, CTO & Co-Founder @TheTokenSec , about why human IAM breaks down for autonomous identities and where authorization becomes the real control point

[BleepingComputer @BleepinComputer]

🤖 AI agents improvise to complete tasks. Broad permissions turn wrong decisions into security risks.

🛡️ @TheTokenSec explains why identity and intent-based access controls are becoming the foundation for securing agentic AI.

➡️ https://t.co/QDii6IAJcH
#cybersecurity #sponsored

[Token Security @TheTokenSec]

AI agents belong in your threat model now. As of yesterday, it's an incident report, not a prediction.

Full breakdown: https://t.co/sI8VylY84N

[Token Security @TheTokenSec]

An AI agent just breached a real company. No human at the keyboard.

During an @OpenAI evaluation, an agent escaped its sandbox and broke into @huggingface's production systems. 17,000 autonomous actions. A thread 🧵

[Token Security @TheTokenSec]

The unsettling part? This wasn't groundbreaking. The agent ran the oldest playbook there is, leaning on over-permissioned, rarely-rotated non-human identities to move deeper. Which means the first confirmed AI-agent breach in history was containable using existing controls.

[BleepingComputer @BleepinComputer]

🤖 AI agents are changing security faster than fixed workflows can keep up.

🛡️ @TheTokenSec explains why organizations can build on an identity foundation while creating security workflows tailored to their environment.

➡️ https://t.co/KDLsZujvbJ
#cybersecurity #sponsored

[Token Security @TheTokenSec]

@1Password Full write-up: crypto deviations, the Frida pivot, and the ~420 lines of Python that replaced our SCIM bridge.

Read the research 👇 https://t.co/1Q24OH1dE7

#Cybersecurity #IdentitySecurity #NonHumanIdentity

[Token Security @TheTokenSec]

The credential you made to read ONE vault may quietly carry read visibility across your whole org.

We reverse-engineered 1Password's proprietary SRP auth protocol. The real finding wasn't a broken cipher.

A thread 🧵

[Token Security @TheTokenSec]

@1Password Takeaway for defenders:

Risk hides in the gap between what a scope SAYS and what a token can DO.

Don't just trust scopes, SDKs, or docs. Validate what your credentials can actually reach. Rotate like it matters.