Security and identity briefing
Cloudflare issued AI agents identities and spending limits, Rubrik began authorizing them one tool call at a time, and Visa paid $2.4 billion for a company that reads how users behave.
Cloudflare has given AI agents an identity and a wallet. Each Cloudflare account gets a unique web address that works as a stable ID, and owners can extend that identity to individual agents so any business receiving a request can see who authorized it. An Account Wallet holds and manages stablecoins; Virtual Wallets assigned to specific agents carry a spending cap, an approved merchant list and a maximum transaction size the agent cannot exceed on its own. Handle reservation opened August 4. Funding, onramping and the issuing of Virtual Wallets are promised in the coming months.
Rubrik used Black Hat to launch Agent Identity, which grants agents access one tool call at a time. Agents typically inherit the standing permissions built for human employees; Rubrik replaces those with short-lived tokens minted per call. Enforcement sits at a Model Context Protocol gateway, where each request clears a behavioral check on its intent and likely operational impact, a policy check, and identity verification of the agent session. It integrates with Okta and Microsoft Entra ID. In Rubrik’s own survey, 23 percent of security leaders said they have full visibility into the agents already running in their environments. Pricing and a general availability date were not disclosed.
Visa has agreed to buy BioCatch for $2.4 billion in cash. The Israeli firm scores behavior rather than credentials, reading keystrokes, touch gestures, device handling, jailbroken devices and signs of coercion across 19 billion banking sessions a month, covering 760 million users on 1.8 billion devices for more than 350 financial institutions. Andrew Torre, Visa’s president of value-added services, said account takeovers and scams cost the global economy over $1 trillion a year and that AI is enabling the attacks at unprecedented scale. The deal needs regulatory approval and is expected to close by the end of Visa’s fiscal second quarter of 2027.
Fraunhofer SIT has built a real-time warning system for deepfaked video calls. The prototype scores audio and video together and shows participants a running probability that a meeting is manipulated. It runs locally on a laptop with a modern graphics card and twelve gigabytes of graphics memory, so footage never leaves the machine. Martin Steinebach, who heads media security and IT forensics at the institute, said compression strips out the artifacts older detectors relied on, and that a flagged call still has to be confirmed by asking specific questions or calling back on a different channel. Singapore recorded more than 1,200 video fraud cases in January, against 43 in the same month a year earlier.
Two Illinois shoppers have sued Walmart over voiceprints they say an AI system builds from customer service calls. The proposed class action, filed August 4 under the Illinois Biometric Information Privacy Act, says callers heard only an automated message that their voice could be taken for business purposes including fraud prevention, and were never given the written notice of specific purpose and retention period the statute requires. Walmart’s privacy policy, updated June 18, does disclose that it collects voiceprints. The plaintiffs seek $1,000 to $5,000 per violation; a 2024 amendment to the statute caps recovery at a single violation per claimant.
The Senate Commerce Committee advanced four kids’ online safety bills, three of them aimed at AI. The CHATBOT Act would require family accounts, parental consent before a teen creates an account, the most protective design settings by default, and reasonable efforts to stop chatbots presenting obscene material or facilitating suicidal ideation to minors. The Youth AI Privacy Act would bar advertising to minors on chatbots and limit how long a chatbot retains memory of a minor’s interactions. A third orders a National Academies study of AI-enabled toys. The SCREEN Act, which would make pornography sites identify and block minors, cleared 15 to 13 but needs a revote to satisfy Senate attendance rules.
Andon Labs has released Drone-Bench, which measures how well AI models write code to surveil real environments on low-cost drone hardware. Its five tasks rebuild an office in 3D, locate the drone within it, plan and fly a route, build a detector from a single reference photo of a target’s face, and keep the drone following that person without losing them from frame. Each is scored against a baseline written by a human working with coding agents. The strongest model tested reached 87 percent of that baseline averaged across the five tasks, with 3D reconstruction its weakest. Andon Labs says no AI lab will be able to train on the eval.
