Agent Identity Got Real. Yours Is Still an API Key.

Three separate vendors shipped real access-control infrastructure for AI agents this week. One vendor showed you what happens when there isn't any.

That's the split worth tracking. Vercel, n8n, and AWS all published ways to scope exactly what an agent can touch — a task, a tenant, a time window — instead of handing it a standing credential and hoping. Meanwhile OpenAI unilaterally wound down Cursor's access to its own models the moment SpaceX closed the acquisition, and Anthropic had to go to federal court to keep the Pentagon from stripping its guardrails by fiat. Read together, the lesson isn't "agents are getting safer." It's that access is becoming a real category — some of it built as infrastructure you can audit, and some of it still just a vendor's mood.

Models + launches

OpenAI is winding down its contract providing OpenAI models to Cursor now that SpaceX owns the company [1]. If your team's Cursor setup quietly routes through GPT-5.x under the hood, that access just got an expiration date instead of a "trust the vendor" assumption. No framework decided this, no audit trail explains it — one company bought another, and the model access that came with the old ownership structure doesn't survive the transition.

Anthropic's automated alignment researcher closed 65% of a frontier-scale model's safety gap in 60 hours, testing over 50 solutions and landing on one built from just over 2,000 training examples — roughly 15,000 times more efficient than Anthropic's production alignment procedure [2]. It didn't beat the shipped model: released Claude Opus 4.8 sits at 72%. The headline isn't the model getting smarter. It's that the effort required to fix a model's bad behavior is collapsing, which changes how often vendors can afford to actually do it.

Tooling shifts

Vercel Connect is now generally available, replacing long-lived API keys with short-lived, scoped tokens across 100+ connectors, fine-grained role-based access, and full audit logs, priced at $3 per 1,000 token requests on Pro [3]. If your agent stack still authenticates by pasting an API key into an env var, this is the alternative that doesn't leave a standing credential sitting around waiting to leak or get committed by mistake.

n8n published the first practical blueprint I've seen for task-based access control — checking the specific task and live context at request time instead of a fixed role assigned upfront [4]. Static role-based access breaks the moment an agent starts acting at machine speed; a role you granted this morning doesn't know what the agent is actually being asked to do this afternoon.

Source: n8n — RBAC for AI agents

AWS's Bedrock AgentCore Memory now isolates memory per user and per tenant with OAuth and Cedar policies out of the box [5]. That's one less custom auth layer to hand-roll before you can safely run a multi-tenant agent on someone else's data — which used to be the part every AgentCore deployment quietly reinvented on its own.

SMB angles

OpenAI's own adoption numbers show the cliff underneath all this identity work: 98% of its employees use Codex for coding, but only 17% of paying org seats and under 1% of individual ChatGPT subscribers touch any agent for non-coding work [6]. Coding is the one job agents have actually cracked. Don't buy the pitch that sales, finance, or ops are solved too — the access-control infrastructure shipping this week is mostly being built for a job agents already do well, not the ones they don't yet.

Adjacent to watch

A federal judge ruled that the Pentagon's "supply-chain risk" ban on Anthropic — imposed after Anthropic refused to strip guardrails blocking autonomous weapons and mass surveillance use cases — was unconstitutional retaliation, not a legitimate security call [7]. That's proof a vendor can hold a line on how its model gets used and still win the legal fight, even against its biggest potential customer.

A model subscription isn't a utility. It's a relationship — and OpenAI just showed Cursor how fast a vendor can end one.

Put the two identity stories next to each other and you get the actual shape of the week:

flowchart TD
  Task([Agent requests access]) --> Layer{Who decides<br/>what it can touch?}
  Layer -->|Vercel Connect| Scoped["Short-lived scoped token<br/>100+ connectors, audit log"]
  Layer -->|n8n task-based control| Context["Checked against the task<br/>+ live context, not a fixed role"]
  Layer -->|AWS AgentCore Memory| Tenant["Per-user, per-tenant isolation<br/>OAuth + Cedar policy"]
  Layer -->|No framework, vendor discretion| Revoke["OpenAI winds down Cursor's<br/>model access post-SpaceX deal"]
  Scoped --> Outcome([Access granted or denied,<br/>logged, revocable])
  Context --> Outcome
  Tenant --> Outcome
  Revoke -.->|"no audit trail,<br/>no appeal process"| Gap(["The gap: identity<br/>infrastructure vs. vendor mood"])

Sources

[1] OpenAI — Our decision on Cursor following its acquisition by SpaceX — openai.com [2] Anthropic — Automated researchers mitigate alignment failures — anthropic.com [3] Vercel — The end of credential sprawl for agents — vercel.com [4] n8n — RBAC for AI agents — blog.n8n.io [5] AWS — AgentCore Memory fine-grained access control — aws.amazon.com [6] TechCrunch — OpenAI is building an AI agent for everything. Will everyone use them? — techcrunch.com [7] TechCrunch — Anthropic gets its first court win over the Pentagon's "supply-chain risk" label — techcrunch.com

None of these individually change what you ship Monday morning. Together they say the same thing twice: access for agents is becoming real infrastructure you can audit, or it's staying a vendor's unilateral call — and this week, both versions shipped side by side. If you're running agents against anything that matters, go find out which one your stack is actually running on.

The short version

• Vercel Connect, n8n's task-based access control, and AWS's AgentCore Memory all shipped real scoping for what an agent can touch — the "paste an API key and hope" era has a replacement now
• OpenAI wound down Cursor's access to its own models the moment SpaceX's acquisition closed — no framework, no appeal, just vendor discretion
• Anthropic's automated alignment researcher closed 65% of a frontier-scale model's safety gap in 60 hours from just over 2,000 training examples — roughly 15,000x more efficient than its production alignment procedure, though released Opus 4.8 still scores higher at 72%
• OpenAI's own numbers: 98% of employees use Codex for coding, but under 1% of individual ChatGPT subscribers use any agent for non-coding work — agents have cracked one job, not every job
• Anthropic won a federal court ruling against the Pentagon's "supply-chain risk" ban after refusing to strip guardrails on autonomous-weapons use cases
• If you're building or buying agent infrastructure, ask which of this week's two stories describes your actual access model — the scoped-token version or the vendor-mood version