TLDR Tech / InfoSec
Anthropic's Zero Trust for AI Agents Sets the Right Test. The Bearer Token Fails It
Dick Hardt applies Anthropic's own "impossible vs. tedious" standard to the Zero Trust for AI Agents framework's baseline credential recommendation and finds short-lived bearer tokens fail it: a stolen token with a shorter TTL still constitutes an exfiltrable secret, making credential theft tedious rather than impossible. Three deeper gaps are identified: authorization scoped to agent-plus-tool relationships rather than specific call parameters, delegation enforced through telemetry after the fact rather than through structurally narrowing authority at each hop, and agent identity assigned without binding to an accountable human principal. The prescribed remedy is proof-of-possession via non-exportable private keys (HTTP Message Signatures), per-call constrained authorization where parameters themselves are the evaluated artifact, and derived authority that narrows as delegation travels, framed not as a better OAuth but as the deletion of bearer primitives entirely.
Read the full story