RFC 10027 Best Current Practice for Security of Cross Device Flows
Successful authentication on one device does not establish that the request from another device belongs to the intended transaction. This is standards guidance about a defined threat model, rather than evidence that any particular agent deployment implements the mitigations.
Successful authentication on one device does not establish that the request from another device belongs to the intended transaction. This is standards guidance about a defined threat model, rather than evidence that any particular agent deployment implements the mitigations.
What the source establishes
RFC 10027, published as an IETF Best Current Practice in August 2026, distinguishes cross device authorization from session transfer. It describes consent phishing that persuades a user to authorize an attacker without stealing credentials, and recommends risk assessment, protocol selection and mitigations including proximity and request binding.
Moona assessment and evidence limits
Successful authentication on one device does not establish that the request from another device belongs to the intended transaction. This is standards guidance about a defined threat model, rather than evidence that any particular agent deployment implements the mitigations.
Verification scope
Moona reviewed the retained source on 29 September 2026. Source acquisition and review establish provenance for this account; they do not reproduce an experiment, validate a vendor deployment or authorize an action.
Sources
This analysis interprets third-party reporting, research and announcements. Moona is not the original reporter of the underlying events.