Oracle plans biometric approval for AI agents, taps OpenAI for security testing

The plans accompany the launch of Oracle's AI Security Mesh, which uses OpenAI cybersecurity models to identify vulnerabilities, investigate potential exploits and test fixes across enterprise applications and infrastructure. Oracle's existing OCI Identity Assurance capabilities include selfie biometrics, liveness detection and government-issued identity document checks, introduced earlier this year within OCI Identity and Access Management (IAM). Oracle says biometric enrollment and subsequent verification can help detect impersonation and account handoffs by confirming that the person accessing an account matches the enrolled employee.

Under the proposed approach, an AI agent could initiate a privileged operation, with the application requiring biometric verification from an authorized employee before proceeding. However, verifying a person's identity does not establish authorization for a particular action. Applications still need to connect the verification result to the requested operation and enforce the relevant permissions.

Beyond identity verification, Oracle is also addressing security risks in the applications and infrastructure used by AI agents. AI Security Mesh combines models with Oracle's testing tools and customer-supplied information about their systems. The agents can investigate how vulnerabilities could be exploited, provide reproduction steps, and test proposed fixes against expected behavior.

Organizations can define the scope of testing and must approve remediation changes before they are applied. Oracle says each agent operates under a separate identity, with task-specific permissions, and just-in-time access. Independent monitors can also detect and stop activity outside approved boundaries.

“By combining OpenAI's advanced models with Oracle's enterprise security capabilities, we can help security teams investigate complex issues, prioritize critical risks, and accelerate remediation while maintaining the controls they require,” says Johannes Landgraf, head of cyber at OpenAI. In related news, iProov recently implemented its Human Approval and Presence Specification (HAPS), which links biometric liveness checks with authorization for specific AI-agent actions.