The AI Agent Vulnerability Wave Is an Identity Debt Problem, Not a CVE Boom

The October 3 disclosure number looked like a clean signal. AI agent vulnerability disclosures had doubled in 2026. By October 8, the same research desk had published seven authentication-stack cases in three weeks: Keycloak, Better Auth, Frontegg, Budibase, Citrix NetScaler, BeyondTrust PRA, and a cluster around MCP servers. The narrative assembled itself: agents expand the attack surface, AI accelerates exploit generation, and the CVE pipeline cannot keep up. I do not buy that narrative. Not because the risk is fake. Because the measurement is wrong. The report's own data undermines its headline. It concedes that CNA automation has inflated CVE counts. It defines AI-related CVEs three different ways. It aggregates local stdio MCP servers with remote hosted MCP servers into a single 82% figure. It cites seven cases from its own case library with no second source. And it uses those seven cases to argue that the CVE paradigm cannot handle emergent combinatorial vulnerabilities, when the seven cases are exactly the kind of single-component defects the CVE system was designed to see. The useful finding is buried one layer down. The auth stack was not built for agent workloads. That is not a disclosure problem. It is an identity debt problem. The revolutionary claim is not that AI agents are insecure. It is that we have granted machine identities delegated authority without building the context-binding, revocation, and audit primitives that delegated authority requires. To evaluate the claim, separate three things: disclosure volume, exploitation velocity, and remediation capacity. They are not the same metric. Disclosure volume is a function of reporting incentives, CNA automation, and regulatory obligations. Exploitation velocity is a function of attacker capability and asset exposure. Remediation capacity is a function of patch economics, version management, and runtime controls. A doubling in disclosures can coexist with flat exploitation risk if the additional disclosures are low-severity or duplicate. A flat disclosure count can coexist with rising risk if remediation is slow. The report conflates the first and third. The CVE pipeline has a known anatomy. A CNA assigns an identifier. NVD enriches the record with CVSS, CWE, and references. Vendors publish advisories and patches. Asset owners map the CVE to their inventory, test the patch, and deploy it. Security operations monitor for exploitation. Each stage has a different latency. The report focuses on the first stage because identifiers are countable. The binding constraint is the last stage because patches are not. This is not a semantic distinction. If 2026 produced 72,000 CVEs and only 141 were exploited in the first eight months, the base rate of exploitation is roughly 0.2%. That does not mean the other 71,859 are harmless. It means the industry cannot treat every CVE as an operational emergency. Triage exists because remediation capacity is finite. The report's headline ignores triage and treats disclosure volume as a proxy for risk. That is a category error. The auth stack matters because it changes the shape of the triage problem. A classic CVE has a product, a version range, a patch, and a workaround. An agent workload has a delegated identity, a token exchange, a tool call, a resource scope, and a session. The CVE may describe the component defect. The exploit path runs through the delegation chain. The patch may fix the component. The delegation chain remains over-scoped. This is why the report feels true even when its numbers do not support the headline. Start with the seven cases. They are not emergent combinatorial vulnerabilities. They are remedial failures. Keycloak: delegated administration permissions allowed a token URL redirect. The defect is an authorization boundary failure. A lower-privileged administrator could influence a token endpoint. That is a classic privilege boundary problem, not a novel agent vulnerability. Better Auth: OAuth state and Magic Link tokens shared storage without namespace isolation. The defect is a storage key collision and state confusion. An attacker who can influence one flow can collide with another. This is the kind of bug that appears in code review, not in an AI-only threat model. Frontegg SAML: missing assertion signature validation. That is SAML 101. If the service provider does not validate the signature, the assertion is a bearer token with extra steps. The fix is not a new paradigm. It is a library call and a test case. Budibase OIDC: invite matching lacked an invite-code check. The defect is authorization logic. The system trusted the invitation context without binding it to the specific invite code. This is a business logic flaw, the category human researchers still find better than scanners. Citrix NetScaler SAML: the fixed version still fell within the impact range of a later RCE. The defect is patch management. The vendor shipped a fix. The customer deployed a version that was still vulnerable to a subsequent issue. The failure is version inventory and change control. BeyondTrust PRA: exploitation appeared within four days, with five exploitation clusters in seven days. The defect is edge-appliance exposure. The appliance sits on the internet, terminates authentication, and concentrates privilege. It is a high-value target with a slow patch cycle. MCP servers: community-maintained servers with file operation flaws. The defect is supply chain. There is no vendor role, no PSIRT, no patch SLA, and no clear owner. The risk is real. The 82% figure is not. Not one of these is a combinatorial vulnerability that the CVE system cannot describe. Each has a product, a version range, a weakness class, and a remediation path. The CVE system saw them. The failure is that the patch did not arrive before the exploit. The report calls that a disclosure paradigm failure. I call it a remediation economics failure. The arithmetic of the AI-CVE claim is even weaker. If 2026 had roughly 72,000 CVEs and roughly 1,500 AI-related CVEs, AI-related CVEs are about 2.1% of the total. If agent orchestration middleware accounts for half of that, it is about 750 CVEs, or roughly 1% of all CVEs. A 347% increase from a 1% base is directionally interesting. It is not a structural shift. It is a small base growing quickly. The exploitation data is more reliable. The report says 141 vulnerabilities were exploited in the first eight months of 2026, or about 17.6 per month. That is consistent with the claimed monthly average of 18. It also exceeds the 127 exploited vulnerabilities in all of 2025. Exploitation events are harder to inflate than CVE counts because they require evidence: a payload, a campaign, a victim, a patch bypass. When disclosure counts and exploitation counts diverge, trust the exploitation count. The patch window is the real signal. The report cites CSA data that some categories move from disclosure to confirmed exploitation in under one day. The BeyondTrust timeline supports the direction: first exploitation cluster within four days, five clusters within seven days. If the patch SLA is 14 days, the patch is not a control. It is a post-incident cleanup step. This is where quantitative rigor matters. A simple risk model is exposure multiplied by exploit probability multiplied by impact. Remediation reduces exploit probability only if remediation latency is shorter than exploitation latency. If exploitation latency is one day and patch latency is 14 days, the patch reduces risk for the 13 days after the attack window has already closed. Runtime isolation, credential scoping, and kill switches reduce impact during the window. That is the only control that operates at the speed of the threat. The 50% RCE claim is a category error. The report says AI-discovered vulnerabilities have an RCE rate about 50% higher than human-discovered vulnerabilities, moving from 26% to roughly 39%. That sounds alarming. It is mostly selection bias. AI scanners and fuzzers are good at injection, memory safety, and parser bugs. Those classes correlate with remote code execution. Human researchers spend more time on logic flaws, authorization bypasses, and business process abuse. Those classes can be more damaging in practice, but they are not statistically classified as RCE. The data supports a narrow claim: AI is better at finding certain vulnerability classes. It does not support the broad claim that AI is better at finding high-severity vulnerabilities. For blockchain infrastructure, this distinction is not academic. The highest-impact bugs in DeFi are often logic bugs. A missing invite-code check in an OIDC flow is a logic bug. A missing SAML signature validation is a logic bug. An over-scoped custody token is a logic bug. An AI fuzzer may never find them because they require understanding the intended authorization model. A human auditor may find them in an afternoon because the model is visibly wrong. The MCP 82% figure is a base-rate fallacy. The report says 82% of MCP servers have file operation vulnerabilities. It does not provide a denominator, a severity distribution, or a reachability analysis. A local stdio MCP server that runs with user privileges is not comparable to a remote hosted MCP server in a multi-tenant environment. A file operation flaw that requires local access is not comparable to a remotely triggerable path traversal. Aggregating both into 82% produces a number that is precise but not useful. This matters for crypto because MCP servers are becoming the tool layer for agents that touch wallets, keystores, RPC endpoints, and custody APIs. An MCP server that exposes a filesystem tool and also has access to a keystore directory is a key exfiltration path. An MCP server that exposes a shell tool and also holds an API key for a signer service is a transaction signing path. The risk is not the percentage. The risk is the capability composition. The review question is not how many MCP servers have file bugs. The review question is which MCP servers have file access plus credential access plus network egress. The real gap is assertion-to-action binding. The modern auth stack was built to answer one question: is this assertion valid? SAML validates signatures and conditions. OIDC validates issuer, audience, and expiry. OAuth validates scope and token signature. The agent workload asks a different question: is this assertion valid for this operation, on this resource, in this session, by this agent, under this delegation chain? Those are not the same question. The primitives exist. SAML audience restriction binds an assertion to a service provider. OAuth token binding with RFC 8705 binds a token to a client certificate. DPoP binds a token to a proof-of-possession key. SPIFFE and SPIRE assign workload identities. RFC 8693 defines token exchange for delegation and impersonation. The gap is not cryptographic impossibility. The gap is deployment and lifecycle. Agent-to-agent delegation chains are immature. Token exchange in agent scenarios is poorly standardized. Revocation is slow. Non-human identity inventory is incomplete. Audit logs often record the service account, not the agent. That is the technical answer to the phrase the auth stack was not built for this. It was built for human SSO and service accounts. It was not built for a population of short-lived, delegated, tool-using machine identities that can act autonomously inside a permission boundary. The revolutionary shift is not that agents can authenticate. It is that agents can act. Authentication without action binding is just a faster way to make a mistake. Blockchain infrastructure is more exposed than it looks because the off-chain auth layer is the real signer. A DeFi agent may have a smart account with session keys and a paymaster policy. That is the on-chain control surface. But the agent usually reaches the smart account through an off-chain API: a custody provider, a key management service, an RPC gateway, a transaction relayer. That API is protected by OIDC or SAML, API keys, and service accounts. If the OIDC token is over-scoped, the on-chain session key policy is irrelevant. The attacker does not need to break the smart account. The attacker needs to steal the token that authorizes the relayer. This is where crypto teams misread their own threat model. A Solidity audit does not read SAML metadata. A ZK circuit review does not review OIDC token binding. A bridge audit does not review the MCP server that gives an agent filesystem access to a deployment key. The smart contract may be formally verified. The auth layer may be a default Keycloak realm with delegated administration enabled and no audience restriction. The verified contract is not the weakest link. An agent chasing yield through Aave or Compound is not exposed because the interest-rate curve is arbitrary. It is exposed because the API token that authorizes the deposit is over-scoped and unbound to the operation. The interest-rate model may be a governance parameter. The token scope is an attack path. A rollup can post data to Ethereum. That does not bind an OIDC token to a wallet operation. The DA layer is not the control plane for agent identity. Dynamic NFTs and programmable royalties do not change the auth problem. The issue is the signer that authorizes the royalty update. The metric I would add to every agent security review is assertion-to-action binding coverage. It is the percentage of agent actions where the credential is bound to the specific operation, resource, session, and expiry. A token that can call any method on any resource is not bound. A token that can call one method on one resource for five minutes is bound. A token that can be replayed from another device is not bound. A token that requires a DPoP proof or mTLS certificate is bound. A token that carries a delegation chain with a verifiable agent identity is bound. A token that is issued to a shared service account is not bound. The second metric is patch latency versus exploitation latency. If patch latency is greater than exploitation latency, patching is not a preventive control. It is a recovery control. The organization should stop reporting patch compliance as a security metric and start reporting runtime isolation coverage, credential lifetime, and kill-switch latency. The third metric is credential lifetime versus delegation duration. If an agent is authorized for a 30-minute task but receives a 24-hour token, the token outlives the task by 47 times. That is identity debt. If the token is a refresh token with no rotation, the debt compounds. If the token is shared across agents, the debt is unassignable. If the audit log cannot distinguish the agent from the service account, the debt is invisible. The fourth metric is NVD enrichment backlog. If CVE volume doubles and analyst headcount does not, the percentage of CVEs without enriched metadata becomes the real triage bottleneck. A CVE without a CWE, CVSS vector, and affected version range is a number, not an actionable record. The report does not mention enrichment backlog. That is a significant omission because it is the operational constraint that makes disclosure volume meaningful. Here is the contrarian angle. The report says the CVE paradigm is failing. I say the CVE paradigm is doing exactly what it was designed to do: name and classify. The failure is in the market for remediation. Patches are not deployed because change management is slow, because appliances are forgotten, because vendors do not backport, because customers do not want downtime, because no one owns the community MCP server. That is not a disclosure paradigm problem. It is an operations problem. The report's own seven cases prove it. The second blind spot is historical amnesia. Edge devices and remote access gateways have been exploited within days of disclosure since at least 2023. Citrix Bleed, ScreenConnect, and the Fortinet SSL-VPN series are the reference cases. The report repackages an old pattern as an AI agent phenomenon. The new part is the agent workload. The exploitation velocity is not new. If the industry did not fix patch economics for internet-facing appliances after 2023, it will not fix them because the appliance now terminates an agent token. The third blind spot is the defensive signal. AI-assisted vulnerability discovery gives defenders scale. The Hacktron AI research agent that found CVE-2026-1731 is a defensive capability, not only an offensive one. If defenders can find and patch vulnerabilities before attackers weaponize them, the net risk direction could fall. The report only tells the attacker side of the story because the attacker side sells better. A balanced analysis would ask whether AI discovery is reducing the n-day window from the defender's side as well. The fourth blind spot is regulatory contamination. The EU Cyber Resilience Act's vulnerability reporting obligations apply from September 11, 2026. That will mechanically increase disclosure counts in Europe. Some of the doubling in 2026 may be compliance, not attack surface. The report does not mention the CRA. That is a major gap in its causal framework. It attributes a statistical phenomenon to attackers when part of the phenomenon is a reporting mandate. The fifth blind spot is the business model. A security research desk that publishes a weekly threat series has an incentive to frame each week as an escalation. That does not make its technical findings wrong. It does explain why the headline is disclosure doubling and the caveat about CNA automation is in paragraph two. The report's own case library is a selection bias. Three weeks and seven cases of the same type means the team was looking for that type. It does not establish an industry-wide year-over-year increase without a comparable 2025 baseline. The sixth blind spot is the blockchain team's assumption that audits cover this. They do not. A smart contract audit covers the contract. A ZK audit covers the circuit. An infrastructure audit may cover cloud IAM. Almost no one audits the join between them: the OIDC token that authorizes the custody API, the SAML assertion that grants the agent a role, the MCP server that exposes the keystore, the service account that has been reused for three agents. The revolutionary narrative needs a new capability. This is an old capability at new speed. The old capability is identity and access management. The new speed is autonomous action. Watch the CISA KEV catalog for agent middleware. KEV additions are a better risk signal than CVE counts because they require evidence of exploitation. Watch the CRA reporting data after September 2026. It will separate compliance-driven disclosures from attack-surface-driven disclosures. Watch cyber insurance questionnaires for non-human identity governance. Insurers price risk faster than standards bodies. If agent deployment starts affecting premiums, the market has accepted the risk. Watch platform component marketplaces. If agent platforms begin offering reviewed MCP servers, the trust intermediary model has arrived. That is the commercial shape of the fix. My forward-looking judgment is that agent identity becomes a procurement line item by 2027. MCP server review will mirror app store review. Patch SLAs will be measured in hours for internet-facing auth components. Runtime isolation will win budget over patch automation because patching cannot close a one-day window. The organizations that treat agent identity as a spreadsheet of service accounts will discover the problem during an incident, not during an audit. The question is not whether the assertion is valid. It is whether the assertion is valid for this operation, in this session, by this agent. If you cannot answer that in milliseconds, your patch SLA is irrelevant.