More than 60,000 emails were taken from a single U.S. agency in an attack that began with one stolen commercial signing key. The intruders, described as foreign actors, used that key to forge tokens and walk into government email accounts. NIST cites the case as the reason its newest security publication exists.
On Sept. 16, 2026, NIST and the Cybersecurity and Infrastructure Security Agency finalized guidance titled Protecting Tokens and Assertions from Forgery, Theft, and Misuse, known as NIST IR 8587. Help Net Security reported that it targets federal agencies and cloud service providers.
What the guidance covers
Tokens are the digital proof that tells a system who or what is asking for access, and which resources it may use. They make single sign-on possible, so a person can move between applications without signing in again each time, and they support zero trust by letting systems check access before granting it.
The document deals with identity and access management systems built on digitally signed tokens that rely on asymmetric cryptography. Those systems handle single sign-on, identity federation, API access and the access that automated services need. The advice centers on guarding the keys that sign tokens, restricting how those keys can be used, and verifying every token before access is granted. It also takes in token lifetimes, revocation, session management, logging and defenses against reuse of stolen tokens.
Who does what? Cloud providers secure their identity providers and authorization servers, protect signing keys, issue tokens safely and hand customers the security features to configure. Customers set up the services, manage access policies and review permissions. Some jobs fall to both sides: responding to a compromised token or key, sharing security signals, revoking access and investigating incidents.
Ryan Galluzzo, NIST’s Digital Identity Program Lead and one of the authors, said: “This publication provides implementation considerations for protecting tokens appropriately. Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.”
The gap: AI agents
AI agents use the same kind of signed token to reach email, files and tools. NIST says the same protections should apply to them, but concedes that agents “create additional IAM challenges that require further guidelines and, in some cases, new or expanded standards and protocols,” as CSO Online quoted.
Analysts told CSO Online that this leaves real work for companies. “Token hardening assumes the token holder is a known, bounded actor,” said Yih Khai Wong of IDC Asia/Pacific. “An agentic system breaks that assumption.” Jonathan Ong of Omdia warned against assuming a valid token means legitimate activity, and noted that revoking tokens is not always possible given architectural limits. Neil Shah of Counterpoint Research pointed to audience restrictions and binding a token to the client that holds the private key, both of which make a stolen token harder to replay.
The guide also adds considerations for the shift to post-quantum cryptography, advising organizations to map where public-key cryptography sits in their identity systems.
CSO Online tied the topic to a May incident in which a public GitHub repository believed to belong to a CISA contractor was found to hold sensitive government credentials, including AWS tokens and GitHub access tokens. CISA said at the time there was no sign that sensitive data had been compromised. Amit Kumar Jena of Kanerika noted that API keys fall outside IR 8587’s scope, although the guidance still requires covered tokens to stay out of logs, CI/CD pipelines and build artifacts.
Sources
- NIST and CISA finalize playbook to stop token theft and forgery – Help Net Security
- AI agent authorization risks remain a gap in new NIST-CISA token security guidance | CSO Online
