Oracle plans biometric approval for AI agents, taps OpenAI for security testing

Oracle plans to extend biometric identity checks to sensitive actions started by AI agents. This would let applications ask approved employees to prove who they are before certain actions can go ahead.

These plans come with the launch of Oracle’s AI Security Mesh. This system uses OpenAI cybersecurity AI models to find security weaknesses, investigate ways attackers might use them, and test fixes across business applications and computer systems.

Oracle already offers OCI Identity Assurance, which includes face checks using selfies, tests to make sure a real person is present, and checks of government-issued identity documents. Oracle introduced these features earlier this year as part of OCI Identity and Access Management (IAM).

Oracle says signing up with biometric checks and verifying identity later can help detect people pretending to be someone else or sharing accounts. These checks compare the person trying to access an account with the employee whose identity was registered.

Under the proposed plan, an AI agent could start an operation that needs special access. Before the operation continues, the application could ask an approved employee to verify their identity using biometrics.

However, checking who someone is does not prove that they are allowed to carry out a particular action. Applications must still link the identity check to the requested action and apply the correct access rules.

Oracle is also working to reduce security risks in the applications and computer systems that AI agents use.

AI Security Mesh combines AI models with Oracle’s testing tools and information that customers provide about their systems. The AI agents can investigate how attackers might take advantage of security weaknesses, explain how to reproduce the problem, and test suggested fixes to see whether the systems behave as expected.

Organizations can set limits on what the tests cover. They must also approve changes to fix problems before those changes are put in place.

Oracle says each AI agent has its own identity, permissions limited to its assigned task, and access that is granted only when needed. Separate monitoring systems can also spot and stop actions that go beyond approved limits.

“By combining OpenAI’s advanced models with Oracle’s enterprise security capabilities, we can help security teams investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require,” says Johannes Landgraf, head of cyber at OpenAI.

In related news, iProov recently put its Human Approval and Presence Specification (HAPS) into use. This system connects biometric checks that confirm a real person is present with permission to carry out specific actions through AI agents.

Comments