AgentCore Gateway supports OAuth 2.0, IAM, and API keys, yet enterprises may still depend on HTTP Basic Authentication. AWS describes a request Lambda interceptor as an extension point for custom and legacy tool authentication.

An AI agent that accesses enterprise data should not act only through a shared service identity. AWS describes propagating user authorization context so an agent returns data according to the requester’s permissions.

As AI and third-party software operate on developer machines, workstations can hold direct paths to source code, credentials, and cloud environments. Wiz is framing the developer endpoint as a security perimeter that needs dedicated attention.

Wiz CIRT’s multi-organization campaign lessons frame GitHub PAT compromise as an identity investigation. Effective response connects a token to its owner, repository access, API activity, and downstream privileges.

Red Hat’s new guidance on securing Claude Code plug-ins foregrounds repository security as AI tools enter developer workflows. For DevOps teams, plug-in assessment should cover code, configuration, access, and release paths together.