What IT leaders need to know about AI-fueled death fraud

There’s a better way, Kiser noted: “OAuth Token Exchange exists as a technical solution that enables proper delegated authority [in that it] proves Bob is authorized to act for Alice, not just that Bob has Alice’s password. But it’s not widely adopted.”

A related issue is that agentic systems “can now create posthumous avatars and deepfakes of deceased individuals, raising questions about consent and control,” Kiser said. “Unauthorized re-creations have already generated legal disputes, yet no frameworks exist for people to specify whether, or how, their likeness should be used after death.”

This also raises questions about how identity authentication systems today handle autonomous agents. 

“Moving from delegated access, as in having credentials, to delegated authority requires work on multiple fronts. For AI specifically, even with proper delegation, how do you prove an AI avatar was authorized to exist in the first place?” Kiser asked. “There’s no legal framework for what constitutes consent, especially posthumous consent. It’s crazy murky at best.”

Developing and implementing international standards for delegated authority would help address both issues. “Building delegated authority infrastructure for AI agents would solve digital estates, too,” Kiser said. “It is the same fundamental problem.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts