SPIFFE agent tokens can still be replayed — WIMSE wrote the fix
The boring layer of the agent stack just got an upgrade nobody has installed yet: the identity standard most agent frameworks lean on turns out to hand out credentials that work in whoever's holding them.
SPIFFE — the de facto standard for giving an AI agent a machine identity — issues bearer tokens, and a bearer token authenticates possession, not the person who was issued it. A Kenneth Buchi piece on HackerNoon lays out the gap: once a workload gets its short-lived credential through the SPIFFE Workload API, nothing in the base specification makes the holder prove it owns the private key behind that identity on every request. Inside one trusted network that is survivable. Across trust boundaries, where an LLM-driven agent is calling tools and APIs it does not control, a copied token is a copied identity for the whole life of the token. The piece cites production SPIFFE use at Uber, Stripe and Netflix, so this is not a fringe configuration.
The fix landed from outside the project. The IETF's WIMSE working group has spent this year drafting the Workload Proof Token (draft-ietf-wimse-wpt, now at revision 02, edited by Brian Campbell and Arndt Schwenkschuster), a credential design that requires proof of possession on every call rather than only at issuance. SPIFFE then adopted it rather than competing with it: the new WIT-SVID is explicitly a sub-profile of the WIMSE Workload Identity Token, so every WIT-SVID is a WIMSE WIT. The published SPIFFE spec is blunt about why it exists — JWT-SVIDs are recommended to expire in seconds precisely because of their bearer nature, while a proof-of-possession credential can safely live as long as an X.509 one. It also warns that a proof of possession must be scoped tightly to the specific action and request being made, and that the spec defines no mechanism for propagating revocation of an individual WIT-SVID.
Adoption is where the story gets less tidy. Support for issuing WIT-SVIDs inside SPIRE is still an open tracking issue, an experimental Go package exists but sits in an exp path, and Buchi cites a vendor-run discovery scan finding that most agent-identity issuers on the market do not offer proof-of-possession binding at all. The practical read for anyone deploying agent identity right now: short token lifetimes narrow the damage window, they do not close the hole, and "proof of possession" is currently a differentiating question to ask a vendor rather than a checkbox to tick. It is also a useful signal about how this layer evolves — one open standard found a real weakness in another, built the answer, and the incumbent adopted it instead of forking.
What to watch: whether SPIRE ships stable WIT-SVID issuance, and whether agent-identity vendors treat proof of possession as table stakes before the next credential-theft incident makes it a requirement.
We tracked the case where agent credentials were the prize — OpenAI's agents attacked RubyGems months before the Hugging Face breach — and the answer then was nobody watching the keys.
If your agents run on SPIFFE today, are you willing to say out loud what happens when one of those tokens walks out the door? Tell us in the comments.
Sources: SPIRE GitHub issue #6326 — WIT-SVID support in SPIRE · go-spiffe experimental WIT-SVID package
