AI Briefing#oauth
The latest AI and developer news about #oauth, with the original source and a short summary.
The latest AI and developer news about #oauth, with the original source and a short summary.
A November 2026 scan of 277 Model Context Protocol servers found that 55 respond without authentication, including 6 critical servers exposing write-capable tools.
The design validates redirect URIs at the authorization step rather than registration, allowing users to trust specific https addresses while blocking open-redirect attacks.
Carrot launched Korea's first advertising MCP as a public beta on September 16.
Clients can now connect by publishing a JSON metadata document on their own domain, replacing the previous manual allowlisting process.
The new vercel connect discover command allows users to search and filter over 1000 services by name, keyword, or connection method.
The system requires users to approve a specific plan and its requested scopes before the agent gains write access to production resources.
Meta and Sierra, along with industry partners, have announced the Personal Agent Protocol, an open standard enabling personal AI agents to securely interact with businesses via websites, APIs, or company agents using OAuth.
The open-source tool replaces shared API keys with individual sign-ins, logging every call under the user's name with one-hour token lifetimes.
Developers can now submit their own services to the Vercel Connect directory via a four-step process involving OAuth or API key verification.
TanStack AI agents can now call OAuth-protected MCP servers without authentication via Vercel Connect.
40.55% of remote MCP servers are exposed without authentication, and all servers implementing OAuth have at least one security flaw.
The AI SDK harness layer now supports native subscription authentication without requiring code changes.
LangSmith Managed Deep Agents automates API key rotation and user-specific identity authentication through the Connections feature.
Open-source video editing tool OpenShorts has released an MCP server integrated with Claude, revealing key know-how on URL handling and asynchronous task design.
Vercel announced the general availability of Vercel Connect, a short-lived credential service for AI agents.
Vercel Connect addresses agent security issues with short-lived, runtime-based tokens.
Vercel Connect is now generally available, enabling secure connections to over 100 services using short-lived tokens at runtime.
Cloudflare has introduced a feature that allows selective permission of specific scopes in OAuth clients.
v0 blocks generated code from accessing user OAuth tokens by routing requests through a proxy outside the sandbox.
Daangn outlines the evolution of its authentication system from SMS verification and identity confirmation to SSO and global adaptation.
Vercel Connect now supports Microsoft managed connectors, enabling access to various services such as Teams and OneDrive.
ElevenLabs has released **ElevenLabs MCP**, enabling direct management of voice and chat agents within Claude.
A scan of live MCP servers in operation found that about 40% expose tools without any authentication process, revealing a security vulnerability.
auth.md, an open protocol that helps AI agents sign up for services on behalf of users, has been released.