Posts

All the articles I've posted.

• Why We Only Catch "Rogue" AI Agents by Accident: The Agent Identity Gap

  12 Aug, 2026

  • 14 min read

  Three frontier labs disclosed that their AI agents breached real companies. None were caught in real time. The problem is not model behavior—it is that the agent is using your identity.

• Browser-Based Agents Are Impersonating You: The Agent Identity Problem

  2 May, 2026

  • 23 min read

  Browser-based agents inherit your session, your cookies, and your identity, with no distinction visible to the service provider. Here's why that's a problem we've already solved once, and what needs to happen next.

• Unwrapping MCP Security: A Walkthrough with the PayPal MCP Server

  12 May, 2025

  • 11 min read

  A walkthrough of connecting Claude Desktop to PayPal’s remote MCP server over HTTP, highlighting the full OAuth 2.0 flow with Postman from discovery to authorization

• Unwrapping MCP: A Walkthrough with the GitHub MCP Server

  7 May, 2025

  • 10 min read

  MCP explained from the inside out, starting with a real developer workflow then unwrapping the protocol layer by layer: roles, messages, connection lifecycle, and STDIO transport.

• Protected Resource Metadata Is the Missing Piece in OAuth 2.0 Discovery

  4 May, 2025

  • 9 min read

  OAuth 2.0 could automate client registration and AS discovery, but clients still had to hardcode which authorization server protects a given resource. Protected Resource Metadata fixes that. Here's how PRM completes the dynamic integration story, and why AI agents made it urgent.

• mTLS and OAuth2 — Certificate-Bound Tokens

  26 Apr, 2025

  • 11 min read

  mTLS and OAuth2 — Certificate-Bound Tokens

• mTLS for OAuth2 Client Authentication: A Stronger Alternative to Shared Secrets

  25 Apr, 2025

  • 13 min read

  Shared secrets can be stolen, leaked, or brute-forced. mTLS-based client authentication uses certificates to prove private key possession. Learn how to apply TLS handshake–based authentication to meet OAuth 2.0 client authentication requirements.

• Secure OAuth2: A Simple Story of Two Keys — PKCE

  24 Apr, 2025

  • 11 min read

  Simple Story of Two Keys — PKCE

• Secure OAuth2 (Part -4): Securing Response Using JWT Secured Authorization Response Mode (JARM)

  20 Apr, 2025

  • 11 min read

  Securing Response Using JWT Secured Authorization Response Mode (JARM)

• Secure OAuth2 (Part -3): Push Authorization Request (PAR) to Rescue

  18 Apr, 2025

  • 13 min read

  Push Authorization Request (PAR) to Rescue