Why SPIFFE Agent Identities Can Still Be Replayed, and How WIMSE Fixes It

SPIFFE is a widely adopted standard for giving AI agents a short-lived, cryptographically verifiable identity credential. However, it can still be vulnerable to replay attacks where an intercepted token can be reused. SPIFFE tokens are bearer tokens, meaning anyone holding the token can present it without verifying it's the right workload.

This weakness existed since SPIFFE's early design and has only recently started to be addressed. The IETF's WIMSE group has standardized a solution called Workload Proof Tokens, signed JWTs that require proof of possession of the private key for the specific HTTP request. SPIFFE has now incorporated this standard as its own WIT-SVID.

Most deployments still rely on shared secrets or weak authentication methods, but the convergence of standards and emerging support in the SPIRE reference implementation is improving the situation. It's crucial for deployments to move towards using the more secure WIT-SVID format rather than relying on bearer tokens alone to protect against replay attacks.