The Cyber Toolchain — issue 053, August 22, 2026

Adds --outputformat cyclonedxJSON1_7 and --outputformat cyclonedxJSON1_7_VEX flags for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 SBOM output. CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and 1.7 reports now include $schema, metadata.tools (object form from spec 1.5), metadata.component (scanned path as BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. subject), dependencies (scan target linked to all detected components), evidence.identity (version-detection technique and confidence, e.g. filecontent, filename, hash, ast), and vulnerabilities[].detail (VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. variants only, when the repository supplies details).

$ retire --outputformat cyclonedxJSON1_7

$ retire --outputformat cyclonedxJSON1_7_VEX --exitwith 0

JSON reports gain a vulnerabilityRepositories field listing the vulnerability repositories used during the scan. All CycloneDX report formats gain retirejs:vulnerability-repository entries under metadata.properties, and CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.

When --insecure is set, JSON reports now include an ignoreRepositoryCertificateErrors field, and all CycloneDX reports include a retirejs:ignore-repository-certificate-errors entry under metadata.properties, making repository certificate-check bypasses machine-readable for auditors.

Mentioning @GitHub in Microsoft Teams channels, threads, or direct messages starts a Copilot cloud agent session visible to all conversation participants; participants with write access to the target repository can trigger code changes directly from the conversation. Work runs asynchronously in a secure cloud sandbox with progress visible in the thread, and artifacts can be picked up in a terminal, the GitHub Copilot app, or an IDE. Repository admins can require an additional approval before any pull request attributed to the Teams Copilot identity can merge; AI credit usage is governed by usage-based billing budgets (cloud sandbox usage billed separately, controllable at product-level or SKU-level). Public channels can be configured with a default repository (DMs cannot), and @GitHub help lists available commands.

Mentioning @GitHub in any Slack direct message, channel, or thread starts a Copilot agent session that can triage issues, implement changes in a secure cloud sandbox, and open pull requests; Copilot creates a dedicated Slack Code channel per task where teammates can inspect diffs and HTML artifact previews. Sessions are multiplayer — any team member can join from the original thread, add context, redirect, or stop it — and run asynchronously, with handoff to a terminal, the GitHub Copilot app, or an IDE via the resulting pull request. PRs and issues are attributed to the Copilot app identity and bounded by existing GitHub permissions; admins can require additional human approval before agent-authored PRs merge. Available in public preview to GitHub Copilot Business and Enterprise plans, with usage counted against existing Copilot entitlements and cloud agent budgets.

Blocked-user lists (Settings → Moderation → Blocked users, for personal and org accounts) now support searching by username, full name, or email; filtering by block reason (Spam, Misconduct, or Harassment); and sort and pagination for long lists. Entries can carry private notes to preserve moderation context, and org blocks now show who applied the block and when it expires. The blocked-user search flow has also been separated from the 'block a new user' action to reduce accidental blocks.

Artifactory Access now supports On-Behalf-Of (OBO) token exchange (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user.) with Amazon Bedrock AgentCore Gateway, so requests from AI agents calling Artifactory's MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server as a registered gateway target are exchanged for short-lived, per-user JFrog tokens rather than a shared credential — preserving audit fidelity, least privilege, and containment. Configuration is done via onBehalfOfTokenExchangeConfig on the gateway target, and the new listingMode field (requires a recent AWS CLI) enables dynamic tool listing so tool discovery also runs under the user's token. Identity mapping relies on JFrog Access OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integration: JFrog trusts the external IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. issuer ($IDP_ISSUER) and maps verified access-token claims (e.g. preferred_username, team) to JFrog users, groups, or project roles via the JFrog OIDC integration API, requiring the token's aud claim to equal the AgentCore Gateway URL ($GATEWAY_URL) and iss to match $IDP_ISSUER. This capability requires JFrog EnterpriseX or higher. The post also compares this approach against header whitelisting (forwarding X-Authenticated-User-style headers) and three-legged OAuth (authorization-code grant with a per-user token vault in AgentCore Identity), noting OBO is the only option delivering verifiable per-user identity at Artifactory without a second login.

⤢ ⤢ ⤢

Adds METRICS_REDIS_TTL (default 2592000 seconds) to control expiry of Redis metrics keys, with active keys refreshed each sync; the metrics plugin now syncs blocked-request data to Redis for a centralized view across instances, buffering new reports per-worker and syncing once Redis memory frees to avoid loss, with atomic list and facet updates. METRICS_MAX_BLOCKED_REQUESTS_REDIS now honors k/m suffixes when bounding report reads. Without Redis, the report cap is the buffer size multiplied by NGINX workers per instance and is cleared on restart unless Redis persistence is enabled; long-term retention requires forwarding logs to syslog or a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..

$ METRICS_REDIS_TTL=2592000

Adds TOTP-based 2FA with secrets stored encrypted in the database using keys kept in /var/lib/bunkerweb/.totp_encryption_keys.json. The TOTP_ENCRYPTION_KEYS environment variable (space-separated keys or a JSON map, each key exactly 43 characters) supplies or rotates keys without relying on auto-generation, with old keys kept alongside new ones during rotation so existing enrollments stay valid. Mounting a volume on /data in the bunkerweb-ui container persists TOTP encryption keys, Biscuit keys, and the Flask secret across recreation; at startup the UI resolves keys from the file, then TOTP_ENCRYPTION_KEYS, then generates a random set (invalidating all 2FA enrollments) if neither is usable, and an invalid key value (e.g. fewer than 43 characters) is discarded and replaced by a random one, leaving 2FA unusable until cleared manually.

# TOTP_ENCRYPTION_KEYS must be exactly 43 characters (e.g. output of passlib generate_secret())
TOTP_ENCRYPTION_KEYS: "aB3dEfGhIjKlMnOpQrStUvWxYz0123456789AbCdE"

TOTP_ENCRYPTION_KEYS: '{"new": "aB3dEfGhIjKlMnOpQrStUvWxYz0123456789AbCdE", "old": "zY9xWvUtSrQpOnMlKjIhGfEdCbA9876543210ZyXw"}'

services:
  bw-ui:
    image: bunkerity/bunkerweb-ui:1.6.14
    volumes:
      - bw-ui-data:/data   # persists Flask secret, TOTP encryption keys, and Biscuit keys

volumes:
  bw-ui-data:

Adds MTLS_CA_CERTIFICATE_DATA and MTLS_CA_CERTIFICATE_PRIORITY to supply the trusted client CA bundle inline as base64 or PEM (e.g. via the Web UI) instead of mounting files, and MTLS_CRL_DATA/MTLS_CRL_PRIORITY to supply a PEM-encoded certificate revocation list the same way, enabling revoked-certificate rejection. The Scheduler validates, caches under /var/cache/bunkerweb, and distributes both to every BunkerWeb instance automatically on each job run with no per-instance volume mounts; if the cache volume is not persistent, mTLS stays disabled after a scheduler restart until the first job run redistributes the bundle.

$ MTLS_CA_CERTIFICATE_PRIORITY=file
MTLS_CA_CERTIFICATE_DATA=
MTLS_CRL_PRIORITY=file
MTLS_CRL_DATA=

$ MTLS_CA_CERTIFICATE_PRIORITY=data
MTLS_CA_CERTIFICATE_DATA=<base64-or-PEM-bundle>
MTLS_CRL_PRIORITY=data
MTLS_CRL_DATA=<base64-or-PEM-crl>

MTLS_CA_CERTIFICATE_DATA: "<base64-or-PEM-encoded-CA-bundle>"
MTLS_CRL_DATA: "<base64-or-PEM-encoded-CRL>"

Incoming X-SSL-* request headers (e.g. X-SSL-Client-Verify: SUCCESS) are now stripped on every site under HTTP/1.1, HTTP/2 and HTTP/3HTTP/3The third major version of HTTP, standardized by the IETF, which runs over QUIC instead of TCP, eliminating head-of-line blocking and reducing connection latency for faster, more resilient data transfer. regardless of whether mTLS is enabled, so only values derived from the verified TLS handshake reach the application. Deployments behind an upstream proxy that sets these headers must capture the value via a server-http Nginx set directive and re-inject it through REVERSE_PROXY_HEADERS, since proxy_set_header alone runs too late.

Every CROWDSEC_* setting is now multisite, letting individual services point at different Local API or AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. endpoints; setting CROWDSEC_API to an empty string on a service retains AppSec inspection without the decision lookup. Adds DISABLE_ONLINE_API to the all-in-one image (matching the official CrowdSec image name) to run CrowdSec without registering to the Central API.

$ docker run -e DISABLE_ONLINE_API=true bunkerity/bunkerweb-all-in-one:1.6.14

The default PERMISSIONS_POLICY now blocks all ch-* Client Hints directives, breaking services relying on Accept-CH or Sec-CH-Prefers-Color-Scheme until the policy is adjusted to re-allow specific hints (e.g. ch-dpr=(self)); it also now denies Chrome's built-in AI APIs by default.

PERMISSIONS_POLICY: "accelerometer=(), ..., ch-dpr=(self)"

$ # In your BunkerWeb service environment or UI, append to Permissions-Policy:
ch-dpr=(self)

Sessions are pinned to client IP and User-Agent with a default idle lifetime of 12 hours and a hard cap of 7 days; cookies can be made permanent without a separate long-lived token, still bound by those limits, and are revoked on logout, password change, or Wipe other sessions. Existing long-lived remember me tokens are now rejected and deleted on the next request, logging out users who relied on year-long persistence; SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS can be extended to replicate long-lived sessions.

Envoy module 2.8.0 adds GraphQL request handling via the ENABLE_GRAPHQL_SUPPORT setting (set to true to enable) and the GRAPHQL_ENDPOINT setting (default: /graphql), which specifies one or more comma-separated endpoints from which the GraphQL operation name and type are extracted.

Adds a statistical detection model to FlowCarp for the CNCMachineRMS binary C2 protocol, identifying sessions on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 that mimic HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. but are actually unencrypted, without needing TLS decryption. A free public demo server at https://demo.flowcarp.com accepts raw PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. uploads via curl --data-binary @suspicious.pcap https://demo.flowcarp.com and returns a JSON alert if CNCMachineRMS traffic is present.

⤢ ⤢

$ curl --data-binary @suspicious.pcap https://demo.flowcarp.com

$ curl --data-binary @suspicious.pcap https://demo.flowcarp.com

Publishes network IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. for CNCMachineRMS: four confirmed C2 server IPs on port 443 (89.110.110.119:443, 85.158.110.78:443, 89.124.79.98:443, 144.124.242.171:443), two C2 domains (notepadreleased[.]com, triotmelon[.]com), and four file hashes for known samples. Also documents the malware's DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. evasion technique, routing lookups to dns.google, cloudflare-dns.com, and dns.quad9.net over TLS before the port-443 C2 connection, so local DNS logs won't capture the domain lookup and defenders should instead alert on DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. activity preceding port 443 C2 traffic.

⤢

The egress sidecar reads OTEL_EXPORTER_OTLP_METRICS_ENDPOINT (preferred) or OTEL_EXPORTER_OTLP_ENDPOINT at startup and automatically injects the destination into the deny-all policy — domains via the DNS proxy, IPs into the static nft allow sets. This always-allow rule survives policy updates and reloads, though deny.always still takes precedence over it.

$ OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://otel-collector.internal:4318/v1/metrics

kata-deploy gains numerous configuration and hardening additions: shared_fs=none to skip shipping virtiofsd when it is not needed, EROFS backing mode configuration support, Helm chart values overlay support, podLabels support on per-node Jobs, TEE key advertisement rendering from the Helm chart, job-mode dispatcher confinement to trusted nodes, isolation of guest debug within runtime classes, removal of nsenter with tightened host privileges, binding of nydus-snapshotter to the node's actual CRI unit, and Helm-driven rollout when mounted ConfigMaps change.

The static release tarball is now split by runtime into per-runtime tarballs, a qemu-no-shared-fs build variant is added, confidential-guest QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. builds are trimmed, and QEMU features and devices are disabled by default to reduce the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..

dragonball improves TDX guest compatibility by adding the VIRTIO_F_ACCESS_PLATFORM flag for TDX virtio devices and a hypercall handler (VcpuExit::Hypercall) for TDX.

Adds the accept_otlp operator to receive OpenTelemetry logs, metrics, and traces over OTLPOTLPOpenTelemetry Protocol, a standard way to send traces, metrics and logs between applications, collectors and monitoring systems. It lets telemetry move across compatible tools./HTTP or OTLP/gRPCOTLP/gRPCOpenTelemetry's wire protocol for shipping traces, metrics, and logs, using gRPC as the transport; tools adopt it to emit observability data to any OTLP-compatible backend without vendor lock-in., supporting JSON and binary Protobuf, gzip compression, TLS and mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with., signal filtering, and bounded request sizes; set schema="record" for direct attribute-key access.

$ accept_otlp "0.0.0.0:4318", transport="http"

Adds the tenzir.parallelism configuration option (also settable via the TENZIR_PARALLELISM environment variable) to configure parallelism node-wide for all pipelines that don't specify their own degree. A // parallelism: directive on a pipeline takes precedence over the --parallelism flag, which takes precedence over tenzir.parallelism; use // parallelism: disabled to opt a single pipeline out.

tenzir:
  parallelism: max,limit_partitions=8

The summarize operator can now run on multiple cores even when emit: <duration> is set, enabling parallel periodic aggregation; use // parallelism: 1 or the window operator when aligned emission intervals are required. It also delivers faster summarize performance on interleaved group keys.

Adds a decimal_format="float" option to the read_parquet operator to read Arrow Decimal128 values as potentially lossy real values; default behavior reads them as strings.

from_file, from_s3, from_google_cloud_storage, and from_azure_blob_storage now run as multiple instances when the pipeline is parallelized, splitting discovered files across instances so large directories are read on multiple cores simultaneously.

The parallel block is now semantically transparent: operators inside observe the same events as they would without it, route_by is automatically inferred and deprecated as an explicit option, and wrapping a source in parallel N { … } no longer produces N copies of every event.

Setting fused=none in a parallelism directive (e.g. // parallelism: 6,fused=none) now consistently means plain buffered channels throughout rather than restricting to a small buffer, and sequential pipelines now run without fused channels.

Renames all built-in module-qualified operators and functions to flat names, e.g. context::enrich becomes context_enrich, ocsf::cast becomes ocsf_cast, and ai::prompt becomes ai_prompt; old spellings emit a deprecation warning and continue working until the next major release.

Databricks Unity Catalog crawl logic now filters out, at ingestion time, catalogs where the Immuta workspace has read-only access and isolated catalogs where the Immuta service principal lacks MANAGE permission, rather than failing later during policy enforcement.

A new ConductorOne MCP gateway integration for Google Gemini Enterprise routes tool calls through https://<your-tenant>-mcp.conductor.one/v1, attributing each call to the individual user's identity rather than a shared service account. It publishes a pre-registered OAuth client metadata document at https://<your-tenant>.conductor.one/auth/v1/client-metadata/gemini-enterprise (the document URL is the client_id, using PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. with no client secret), and exposes authorization_endpoint and token_endpoint discoverable via https://<tenant>-mcp.conductor.one/.well-known/oauth-authorization-server. Setup requires overriding the Google Cloud org policy constraints/discoveryengine.managed.disableCustomMcpServerConnector to Off, enabling six GCP APIs (discoveryengine.googleapis.com, connectors.googleapis.com, integrations.googleapis.com, secretmanager.googleapis.com, iam.googleapis.com, orgpolicy.googleapis.com), optionally allowlisting egress via constraints/discoveryengine.allowedEgressFqdns, setting the connector's Authorization URL Parameters to &resource=https://<your-tenant>-mcp.conductor.one/v1, and using space-separated scopes openid profile email offline_access. Connections are visible under AI access management > AI clients (admin) or profile menu AI & API > AI connections (user), and calls are gated by C1 toolsets and access profiles.

$ # Check current effective policy
gcloud org-policies describe \
  discoveryengine.managed.disableCustomMcpServerConnector \
  --project=YOUR_PROJECT_ID --effective

# Save override to policy.yaml, then apply
cat > policy.yaml <<'EOF'
name: projects/YOUR_PROJECT_ID/policies/discoveryengine.managed.disableCustomMcpServerConnector
spec:
  rules:
    - enforce: false
EOF
gcloud org-policies set-policy policy.yaml

$ gcloud services enable \
  discoveryengine.googleapis.com \
  connectors.googleapis.com \
  integrations.googleapis.com \
  secretmanager.googleapis.com \
  iam.googleapis.com \
  orgpolicy.googleapis.com \
  --project=YOUR_PROJECT_ID

$ # Confirm the client metadata document resolves
curl -s https://YOUR_TENANT.conductor.one/auth/v1/client-metadata/gemini-enterprise

# Discover authorization_endpoint and token_endpoint
curl -s https://YOUR_TENANT-mcp.conductor.one/.well-known/oauth-authorization-server

c1i CLI v0.5.0 adds apps create, apps delete, apps set-owners, auth token, mcp gateway list-tools, mcp gateway call, and a policies command family, rounding out API coverage for agent-focused automation. List commands now emit properly-typed Booleans, counts, and nullable fields instead of stringified or inconsistent JSON, and all responses map onto a single predictable exit-code scheme.

$ c1i mcp gateway list-tools --server-url https://<tenant>.conductor.one

$ c1i mcp gateway call --server-url https://<tenant>.conductor.one/mcp <tool-name> '{"arg": "value"}'

A new Revoke inherited access toggle on an app's details page traces access upstream through direct grants, nested groups, role hierarchies, and delegated provisioning and removes it, instead of stopping at the first result. The toggle is off by default and shows a downstream-effects banner before an approver commits.

c1i now requires a full https:// tenant URL — bare short-name shortcuts are rejected, and a non-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. URL is rejected instead of silently upgraded. The mcp gateway command's --url flag has been renamed to --server-url, breaking any script or alias that still passes --url to mcp gateway.

A new Grant source setting (Direct or All) on automation revoke steps lets automations scope revocations to only direct grants, avoiding collateral removal of group-inherited access.

The public API can now list connector-discovered applications, inspect their managed state, and promote an unmanaged application to managed — returning HTTP 409 on a repeat promotion and exposing the managed application ID in the binding response.

Push-rule execution history is now available at Directory sources > Executions (all connectors) or via Show execution history in a push rule's row menu — each entry records who was pushed, when, which attributes changed, and the rejection reason on failure.

Policies can now be created local to a single app or entitlement via inline creation alongside the global option on each configuration slot. A policy rule or baseline can also reference another policy of the same type, letting a shared flow (e.g. a manager-then-owner approval chain) be defined once and reused — updates to the shared policy propagate automatically to every policy that references it.

New disable_workload_api and disable_sds_api agent options disable the Workload API and SDS APIs on the public endpoint, useful for reducing attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. where those APIs aren't needed.

disable_workload_api = true
disable_sds_api = true

New debug getinfo subcommand in the spire-server and spire-agent CLIs provides access to the Debug APIs.

$ spire-agent debug getinfo

The k8s workload attestor gains disable_kubelet_client to turn off use of the kubelet client, and an opt-in enable_namespace_labels option that produces ns-label selectors from namespace labels.

enable_namespace_labels = true

New trust_bundle_spiffe_workload_api agent configuration option lets an agent fetch its initial trust bundle from a Workload API endpoint, simplifying nested agent deployments.

New use_pod_uid_for_agent_id option in the k8s_psat node attestor derives agent IDs from pod UIDs instead of node UIDs.

New account_list_file option in the aws_iid node attestor lets verify_organization's account list be sourced from a file instead of the AWS Organizations API.

Adds npx clerk@latest init, which auto-detects the framework and package manager, installs the SDK, and wires up the provider, middleware, auth routes, and env file for Next.js, React, React Router, Nuxt, TanStack Start, Astro, Vue, JavaScript/Vite, Expo, Express, Fastify, iOS, and Android; it supports --framework <framework> and --pm <package-manager> to override auto-detection in empty directories, and --app <application_id> to link an existing Clerk application. When the framework supports it, init writes temporary development keys to the project env file so no Clerk account is required upfront, and the app is claimed later via npx clerk@latest auth login. Also adds npx clerk@latest doctor to verify the auth setup and report configuration issues, npx clerk@latest apps list --json to list available Clerk applications with names and IDs, and npx clerk@latest enable orgs to turn on Organizations (multi-tenancy, team invitations, roles and permissions, enterprise SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.) on an existing project.

$ npx clerk@latest init --framework react --pm pnpm && npx clerk@latest doctor

Adds the @clerk/ui package for shadcn/ui theme integration: apply it via appearance={{ theme: shadcn }} on ClerkProvider and @import '@clerk/ui/themes/shadcn.css' in global CSS.

import { shadcn } from '@clerk/ui/themes'
// in your provider:
<ClerkProvider appearance={{ theme: shadcn }}>{children}</ClerkProvider>

Okta now resolves AI agent identities across every registration path into a single authoritative record per org, with each agent carrying an externalId and platform value for uniqueness. This capability is now generally available (GA) in Production, enabling identity lifecycle management for non-human AI agent principals.

Cross App Access (XAA) enables connections between custom SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-agentic requesting apps and SSO resource apps across OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. protocols, removing the need for user consent at runtime. An AI agent can be bound with an OIDC SSO app so they share the same credentials, with admin-controlled visibility over which actions the agent can take on behalf of a user.

A new User access tab configures direct user authentication for AI agents, replacing the Delegation tab workflow. Okta for AI Agent orgs that previously used the Delegation tab to configure AI agent access through delegation links must reconfigure them using the User access tab.

Adds a runtime toggle in Pomerium Zero cluster settings to enable inbound Dynamic Client Registration (DCR) per cluster; the feature ships off by default rather than relying on a single global default. Enable it in the Zero dashboard by going to Cluster Settings for the target cluster and toggling Inbound Dynamic Client Registration on.

Pomerium adds OAuth Client ID Metadata Document (CIMD) support for inbound MCP routes, letting downstream clients such as Claude Code, ChatGPT, and MCP Inspector identify themselves via the lighter-weight CIMD registration path instead of full Dynamic Client Registration.

The Enterprise Console adds -directory-provider and related startup flags so directory sync can be fully configured at launch without using the web UI, plus a -url startup flag that lets the console automatically create its own Pomerium route on first boot, eliminating a manual setup step for new installs.

Pomerium container images now use the base-nossl-debian12 distroless variant instead of base-debian12, structurally removing libssl3 from every deployment.