--- title: AI agent authorization risks remain a gap in new... description: New NIST guidance (NIST IR 8587), developed with CISA, addresses securing digitally signed tokens and assertions used in single sign-on and API access,... canonical: https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI agent authorization risks remain a gap in new NIST-CISA token security guidance | daily.dev og:description: New NIST guidance (NIST IR 8587), developed with CISA, addresses securing digitally signed tokens and assertions used in single sign-on and API access,... og:url: https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus og:image: https://api.daily.dev/og/posts/oFV5r2YUs.png og:image:alt: AI agent authorization risks remain a gap in new NIST-CISA token security guidance og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI agent authorization risks remain a gap in new NIST-CISA token security guidance **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary New NIST guidance (NIST IR 8587), developed with CISA, addresses securing digitally signed tokens and assertions used in single sign-on and API access, recommending continuous monitoring, shorter-lived tokens, audience restrictions, and cryptographic binding to reduce the impact of token compromise. However, the guidance explicitly excludes AI agent actions and API keys from its scope, leaving significant gaps as agentic systems complicate identity boundaries through delegation chains and prompt injection risks. Security experts interviewed recommend treating AI agents as low-trust non-human identities with task-scoped, expiring credentials, separate agent inventories, and human approval for higher-risk actions. The piece also ties in a May incident where a CISA contractor's public GitHub repo exposed AWS and GitHub tokens, illustrating how credential exposure can occur outside formal IAM controls via source code, CI/CD pipelines, and logs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does NIST IR 8587 recommend for securing authentication tokens and assertions? NIST IR 8587, published with help from CISA, recommends continuous monitoring, shorter-lived tokens, audience restrictions limiting where a stolen token is accepted, and cryptographically binding tokens to the client holding the corresponding private key to make replay attacks harder. It also points organizations toward shared-signal mechanisms like CAEP and RISC to help systems respond when token conditions change. The guidance covers asymmetrically signed tokens but explicitly excludes API keys from its scope. _Teams rolling out token hardening controls can track evolving IAM guidance like this via daily.dev._ ### Does NIST IR 8587 cover AI agent authorization risks? No, actions taken by AI agents are explicitly out of scope for NIST IR 8587. NIST recommends applying the same token-security guidelines to AI agents as to humans but acknowledges that AI and AI agents create additional identity and access management challenges requiring further guidelines and possibly new or expanded standards and protocols, which NIST and CISA are still developing. _Anyone securing agentic AI systems can follow guidance gaps like this as they close on daily.dev._ ### Why can a valid authentication token still represent a security risk? A valid token can still be dangerous because verifying that a token is authentic does not confirm that the activity associated with it is legitimate. Prompt injection can steer an AI agent holding a valid token toward actions the user never requested, and token verification alone won't catch this since the token remains technically legitimate. Token revocation may also be impossible due to architectural limitations, so organizations need to correlate context like unusual location or timing across security domains. _Developers hardening token-based auth flows can keep up with these edge cases via daily.dev._ ## Similar posts on daily.dev - [AI Agents Authentication: How Autonomous Systems Prove Identity](https://daily.dev/posts/ai-agents-authentication-how-autonomous-systems-prove-identity-ynnf7lwlb) · GitGuardian · 0 upvotes · 0 comments - [Why Token Handling Must Evolve for AI Agents](https://daily.dev/posts/why-token-handling-must-evolve-for-ai-agents-aok3emrfd) · Nordic APIs · 0 upvotes · 0 comments - [What CISOs need to get right as identity enters the agentic era](https://daily.dev/posts/what-cisos-need-to-get-right-as-identity-enters-the-agentic-era-b6wyytcb7) · CSO Online · 0 upvotes · 0 comments - [Top API Authorization Risks With AI Agents](https://daily.dev/posts/top-api-authorization-risks-with-ai-agents-kdxvk5joh) · Nordic APIs · 1 upvotes · 0 comments - [Security agencies draw red lines around agentic AI deployments](https://daily.dev/posts/security-agencies-draw-red-lines-around-agentic-ai-deployments-iv9yoiejd) · CSO Online · 1 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#ai-agents](https://daily.dev/tags/ai-agents), [#appsec](https://daily.dev/tags/appsec) [View this post on daily.dev](https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI agent authorization risks remain a gap in new NIST-CISA token security guidance","url":"https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus"},"datePublished":"2026-09-16T15:42:53.742Z","dateModified":"2026-09-16T16:44:04.440Z","description":"New NIST guidance (NIST IR 8587), developed with CISA, addresses securing digitally signed tokens and assertions used in single sign-on and API access,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/258ac365ce8a5572b7f221c3cfa83f8c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/258ac365ce8a5572b7f221c3cfa83f8c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,ai-agents,appsec","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"AI agent authorization risks remain a gap in new NIST-CISA token security guidance"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus#faq","mainEntity":[{"@type":"Question","name":"What does NIST IR 8587 recommend for securing authentication tokens and assertions?","acceptedAnswer":{"@type":"Answer","text":"NIST IR 8587, published with help from CISA, recommends continuous monitoring, shorter-lived tokens, audience restrictions limiting where a stolen token is accepted, and cryptographically binding tokens to the client holding the corresponding private key to make replay attacks harder. It also points organizations toward shared-signal mechanisms like CAEP and RISC to help systems respond when token conditions change. The guidance covers asymmetrically signed tokens but explicitly excludes API keys from its scope. Teams rolling out token hardening controls can track evolving IAM guidance like this via daily.dev."}},{"@type":"Question","name":"Does NIST IR 8587 cover AI agent authorization risks?","acceptedAnswer":{"@type":"Answer","text":"No, actions taken by AI agents are explicitly out of scope for NIST IR 8587. NIST recommends applying the same token-security guidelines to AI agents as to humans but acknowledges that AI and AI agents create additional identity and access management challenges requiring further guidelines and possibly new or expanded standards and protocols, which NIST and CISA are still developing. Anyone securing agentic AI systems can follow guidance gaps like this as they close on daily.dev."}},{"@type":"Question","name":"Why can a valid authentication token still represent a security risk?","acceptedAnswer":{"@type":"Answer","text":"A valid token can still be dangerous because verifying that a token is authentic does not confirm that the activity associated with it is legitimate. Prompt injection can steer an AI agent holding a valid token toward actions the user never requested, and token verification alone won't catch this since the token remains technically legitimate. Token revocation may also be impossible due to architectural limitations, so organizations need to correlate context like unusual location or timing across security domains. Developers hardening token-based auth flows can keep up with these edge cases via daily.dev."}}]} ```