The core AI credential problem is solved by removing secrets, not by another attack detector

In September 2026 Dario Amodei, the head of Anthropic, published an essay arguing that existing safety circuits are not keeping up with the pace at which AI models improve. In the same month Anthropic released a report on real attack vectors, and one of the main ones is still the theft of tokens, passwords and API keys, and the interception of credentials.

The community is now actively looking for ways to make the actions of AI systems verifiable and controllable. To build a circuit that actually holds, though, it helps to name the nature of the change correctly.

Artificial intelligence increases the scale of attacks. Human error becomes cheaper for the attacker, and traditional portable credentials become an even more attractive target. A model can generate personal phishing around the clock, clone a voice and sweep a digital footprint.

The logic of the attack stays the same: find and steal a portable secret, a password, an SMS code, a bearer token, and present it as the owner. As long as a secret travels the network, it can be intercepted, coaxed out or simply bought.

That is why the thing to change is not only how attacks are detected, but the architecture of access itself.

By access-first we mean an architecture where security starts not with monitoring and breach detection, but with removing portable secrets from the network path of authentication entirely.

In Toqen.app this is done at the level of the hardware and the protocol:

1. The key never leaves the device. The private signing key is created inside an isolated chip, Secure Enclave or Android Keystore, and physically cannot be extracted or sent over the network.
2. There are no secrets in the databases. The server keeps only the public key used to verify a cryptographic signature. A leak of the service database gives an attacker nothing to log in with.
3. Every login is unique. The signature is produced fresh for one specific single use challenge. Intercepting the traffic yields neither the private key nor a signed request that can be replayed.
4. Protection against phishing relay and context or origin substitution. Unlike a plain mechanical confirmation, the Toqen.app application receives the original parameters of the request, the Relying Party ID, the type of action being requested and the single use challenge, directly over a verified channel. You see the real name of the service and the scope of access on your phone screen, even if you were lured onto a fake site or talked into authorising somebody else's session.

This removes the portable secret as a class of attack during authentication. There is simply nothing for an attacker to intercept and present again over the network.

An honest boundary. Toqen.app closes the layer where access is first granted. A compromised phone, malware in the operating system or a vulnerability in somebody else’s code inside an already open session are different layers of security and need their own dedicated answers.

Alongside the current industry discussion there is already a working approach to one concrete layer of the problem, namely granting access safely without ever moving a portable credential.

The Toqen.app architecture went live in December 2025. Knowing that safe interaction in human to agent and agent to agent scenarios would become a critical challenge for the whole industry, I sent the project materials to the key companies:

• 10 April 2026: sent OpenAI a description of Toqen.app as access layer infrastructure for agent systems, as part of their call for input on Industrial Policy for the Intelligence Age.
• 15 April 2026: received confirmation that the submission had been accepted for review.
• 27 April 2026: sent follow up specifications and possible integration formats, a pilot, a grant, infrastructure support.

The same materials went to the Anthropic team.

With an enormous flow of incoming initiatives it is entirely natural that a detailed review of every proposal takes time. The point here is to highlight something else: one specific segment of this hard problem already has a practical answer, with a working core, an open source mobile client and an architecture that has been tested.

Toqen.app is open to working with AI infrastructure developers, security researchers and engineering teams.

The mobile client source is open for audit, and the technical documentation and contacts are on toqen.app.

If AI agents keep gaining autonomy, should the next layer of security infrastructure be built around secrets that can be stolen, or around proofs of access that cannot be carried away?

The whole login chain is easier to touch than to read: an ordinary password next to a signature that never leaves the phone, plus an attack simulator that shows exactly what an attacker walks away with in each case.