The Auth Stack Didn't Break Under AI Agents. It Was Never Built for Non-Human Identity.

Seventy-two thousand. That is roughly the number of CVEs assigned in 2026, and about fifteen hundred of them — 2.1% — touch AI systems in any way. The headline that circulated this month said something else: agent vulnerability disclosures doubled. Doubling sounds like a phase transition. At a base of 2.1%, it is a rounding error wearing a press release. I distrust any percentage that arrives without a denominator. So I took the underlying claims apart. Seven case studies. A vendor survey. A figure — 82% of MCP servers have file-operation flaws — with no denominator, no severity distribution, and no separation between local stdio servers and hosted remote ones. Those are not the same risk class. Merging them is not analysis. It is arithmetic performed on incomparable units. The report itself is a two-part analysis from a security research desk, dated to early October 2026, and its argument runs like this: disclosures involving AI agents doubled year over year, the authentication stack was never designed for machine principals, and the CVE pipeline cannot absorb emergent combinatorial vulnerabilities. The supporting cast is a set of named institutions — GTI statistics, the Microsoft Digital Defense Report 2026, a CSA survey — plus seven authentication-stack cases: Keycloak's delegated administration enabling a token URL redirect, Better Auth storing OAuth state and magic-link tokens in the same unnamespaced keyspace, Frontegg's SAML handler skipping assertion signature validation, Budibase's OIDC invite matching without an invite-code check, a Citrix NetScaler fix that still landed inside a later remote code execution's affected range, plus AD FS and BeyondTrust PRA. Add MCP servers, and the assertion that orchestration middleware accounts for half of AI-related vulnerabilities. One dataset in the report is solid: 141 vulnerabilities exploited in the first eight months of 2026, roughly 17.6 per month, against 127 for all of 2025. Exploitation events are difficult to inflate through automated assignment pipelines. That number I believe. The rest I tested. The proof is in the logic, not the promise. Here is where the report contradicts itself. Seven cases in three weeks, every one single-vendor, discrete, and reproducible. A permission-boundary failure. A storage-key namespacing bug. The oldest mistake in the federation playbook. An authorization logic defect. Every one of these is precisely the class of defect the CVE system was built to handle — and it handled them. They were seen, numbered, published. The failure occurred downstream, in remediation velocity and version hygiene. A fixed build that still sits inside a later vulnerability's affected range is a patch-management failure, not a disclosure-paradigm failure. The report packages a supply-chain hygiene problem as an epistemological crisis. Complexity is the camouflage for incompetence. Then the claim that AI-discovered vulnerabilities carry a 50% higher RCE rate, 26% against roughly 39%. If-then: if the discovery instrument is a scanner or a fuzzer, it will preferentially surface injection and memory-safety defects, and those classes correlate with remote code execution by construction. Human researchers spend scarce hours on logic and authorization bypasses, which carry larger blast radius and are never classified as RCE. The comparison runs between two sampling distributions, not two skill levels. Absent methodology, the number supports exactly one conclusion: AI finds a particular family of bugs faster. It says nothing about severity. Now the 82%. A community-maintained local stdio MCP server and a hosted remote MCP server differ in risk by at least an order of magnitude. A file-operation flaw in a process running under the user's own local privileges, reachable only by that user, is close to unexploitable. Aggregate the populations and you get a number that is precise, large, and useless. This is the base-rate fallacy dressed as a statistic, and I know its shape from the inside. In 2020 I simulated Yearn's vault rebalancing logic against historical liquidity depth and found the optimizer assumed constant market depth. The model was arithmetically clean. The assumption was the bug. Any security metric that omits its population and its reachability conditions is a model with an unexamined assumption. Then the structural claim. Orchestration middleware is said to be half of AI-related vulnerabilities. Run the arithmetic: 1,500 AI-related CVEs, half of them middleware, 750 against 72,000 total. That is 1% of the corpus. A 347% increase on a base of 1% is a real directional signal and a meaningless structural one. Direction and magnitude are separate claims and the report conflates them. And the case library carries a selection bias the report never addresses. Seven same-class events in three weeks is what a team finds when it is specifically hunting that class. It is not a year-over-year rate. There is no same-scope 2025 baseline in the document, which means the seven cases establish that the defect pattern exists and say nothing about whether it is growing. Evidence of existence and evidence of trend are different products, and only one of them was delivered. The largest omission is regulatory. The EU Cyber Resilience Act's active-reporting obligation for product vulnerabilities applies from 11 September 2026 — a legal mandate to disclose, covering every product sold into the EU, arriving inside the measurement window the report uses. Any series crossing that date without a control for it is uninterpretable. Some unknown fraction of the doubling is compliance, not attack surface. I have made this error of attribution before. In 2017 I spent six weeks inside Tezos's Coq verification proofs and concluded the math held while the governance transition from foundation to on-chain voting was practically fragile. A formally correct artifact can be operationally wrong. A rising statistical line can be a legal requirement rather than a threat. What the report gestures at but never names is the actual technical hole. The assertion-binding toolkit already exists: SAML audience restriction, OAuth token binding under RFC 8705, DPoP, mTLS-bound tokens, SPIFFE/SPIRE workload identity. The gap is delegation. RFC 8693 token exchange in agent-to-agent chains — an agent acting for a user, who authorized an orchestrator, which invoked a tool — has no mature profile and no revocation semantics worth the name. Eighty-eight percent of enterprises are trialing agents; eighty-two percent plan to expand within eighteen months. Machine identities will outnumber human identities inside the perimeter, with no lifecycle tooling to recycle them. The report says the identity layer absorbs deployment pressure faster than it can be audited. The precise statement is narrower and worse: non-human identity has no governance framework at all. One correction. The fifteen-minute exploit-generation claim concerns known vulnerabilities — n-day. The same report quotes GTI observing no zero-day exploitation against AI infrastructure. A headline manufacturing zero-day dread while its own source says otherwise is a rhetorical move, not a finding. Static analysis reveals what marketing hides. What the bulls got right, and the report buried: AI-assisted discovery is a defensive capability before it is an offensive one. Hacktron's research agent autonomously found CVE-2026-1731, an unauthenticated OS command injection. That is a defender acquiring scale in the discovery arms race — plausibly the first time the advantage has run in that direction since fuzzing matured. If AI finds and drives fixes faster than attackers weaponize, net risk may fall, and nothing in the report's framing permits that outcome. Second: the disclosed-then-exploited-within-days pattern on edge devices is not new. Citrix Bleed in 2023, ScreenConnect and the Fortinet SSL-VPN series in 2024 — remote access gateways have been first-day targets for three years. Re-labeling a familiar pattern as an AI-era phenomenon is not analysis; it is rebranding. The genuine novelty is the identity class, not the attack tempo. And the public-goods problem with community MCP servers is real even though the 82% is junk: no vendor role, no patch incentive, no responsible party. The number is wrong. The economics are right. The metric that decides this is a ratio nobody publishes: mean vendor remediation time divided by mean weaponization time. When that ratio falls below one, patching stops being a control and becomes a formality, and runtime isolation, asset visibility, and automatic containment are the only levers remaining. Cyber insurers will price this before any regulator does; their questionnaires will ask about agent inventory within two renewal cycles. So here is what I would put to every vendor named in this report. What is your median time from advisory to patched build, do you publish it, and does your underwriter already know the answer? Assume malice, verify everything, trust nothing.