Notes from the team behind Authsome. Integration patterns, agent credential workflows, security tradeoffs, and product updates. Written for builders, not buyers.
Browser-based AI agents and the cookie-jar problem.
Browser agents like ChatGPT agent mode, OpenAI Operator, Browser Use, and Anthropic computer-use inherit every cookie and logged-in session in the browser they drive. Here is the threat model, what isolation works today, and the honest line between what a credential broker can and cannot fix.
OpenAI API key hygiene for AI agents: project keys, restricted keys, and what an agent should actually use.
OpenAI ships four key types and per-endpoint scopes most teams never enable. Here is which one to hand an AI agent, how to scope it correctly, and where the dashboard stops helping.
Supply chain risks for AI agents: malicious MCP servers, poisoned skills, and how to triage.
A field guide to the 2025-26 wave of agent supply chain attacks. Malicious MCP servers, poisoned skills, npm and PyPI compromises, the five injection vectors, and the exact triage checklist if you already shipped one.
