FusionAuth 1.69 Strengthens Identity Controls for AI Agents

Summary

FusionAuth says AI agents have not created fundamentally new identity questions, but they have removed the human-speed limit on how quickly delegated authority can be exercised. Agents can operate continuously, call APIs, access services, and interact with authorization systems, making overly broad permissions more dangerous. The company cites its 2026 State of AI & Identity Report, in which 88% of technology leaders said AI deployment was outpacing their identity and security infrastructure. FusionAuth 1.69 responds with several control-plane changes: RFC 9207 issuer identification is enabled by default to help clients detect authorization-server mix-up attacks, and Signature Verification Key Selection lets applications restrict JWT validation to explicitly trusted keys. The release also adds an AI Agent entity type and lifecycle webhooks for tracking creation, updates, and deletion of non-human identities. Browser applications can use DPoP through the React, Angular, and Vue SDKs; the sender-constrained tokens bind access to a client key, although APIs must still validate the proof. FusionAuth also added SAML and password-hash import flexibility, group-auditing improvements, runtime and dependency updates, and security fixes. Deployments using external JWT or SAML providers or active key rotation should consult the 1.69 migration guide before upgrading.