---
collection: auth-identity
collection_name: Auth & Identity
week_start: 2026-10-19
title: Clerk takes on fraud while Auth0 opens the door to AI agents
release_count: 77
generated: 2026-10-26
canonical: https://releases.sh/collections/auth-identity/digest/2026-10-19
---

# Clerk takes on fraud while Auth0 opens the door to AI agents

Clerk launched Protect, a configurable fraud-and-abuse layer built into sign-up and sign-in, while Auth0 shipped an Agent Mode for its CLI and early access for letting MCP clients and AI agents register themselves.

### Fraud and abuse moves into the auth flow

The week's biggest story is Clerk's [Clerk Protect](https://clerk.com/changelog/2026-10-23-introducing-clerk-protect), a fraud and abuse layer folded directly into sign-up and sign-in. On the Business plan you can now block VPN, Tor, proxy, and hosting-network sign-ups, challenge residential proxies, apply country allowlists and blocklists, cap sign-ups per IP, and reject risky email domains. Every app also gets CAPTCHA challenges for suspicious sign-ups, Device Intelligence checks, account lockout after failed sign-ins, Device Trust, and blocking of email subaddresses and disposable addresses. It's a notable shift: a core identity vendor treating bot and fake-account defense as part of authentication rather than something you bolt on afterwards. Auth0 moved in the same direction more quietly, [expanding Bot Detection's IPv6 signal analysis](https://auth0.com/changelog#4V2KLeS754BaqpApjLAE5b) to catch distributed botnets earlier in the flow, with no configuration required.

For the mess that slips through anyway, Clerk added [a Backend API endpoint that merges two users into one](https://clerk.com/changelog/2026-10-23-merge-users), moving emails, phone numbers, connected accounts, passkeys, TOTP, backup codes, and organization memberships onto the surviving user before deleting the duplicate. Merges are irreversible, so a dry-run preview and a new webhook keep you honest about what you're about to do.

### Auth0 makes its CLI and tenant agent-ready

Auth0's headline this week is [Agent Mode for its CLI](https://auth0.com/changelog#1FcrCTfE0s6q19SKASSQx9), a direct response to agents increasingly driving the CLI on developers' behalf. One switch turns on structured JSON output, kills prompts and color, and guarantees a non-zero exit code on failure — closing the gap where a misspelled command used to exit 0 like everything was fine. It also adds stable error codes, a flat command listing, schema introspection, and a docs search, auto-enabling for recognized agent clients. The tenant side got matching treatment: early access for [CIMD with dynamic registration](https://auth0.com/changelog#1tZgllWxrRu1H5aLnyRbCp), which lets MCP clients and AI agents connect without an admin registering each one first, and [Application Profiles](https://auth0.com/changelog#5tM7A32Ytnk1JlK29f0rDO) to govern refresh token lifetimes, DPoP, and B2B behavior across all those dynamically registered apps from one place. One operator-friendly fix rounds it out: Auth0's [configurable Unblock Behavior](https://auth0.com/changelog#E3VrkNOAtDXK2dKD7awpv) lets brute-force recovery links require a confirmation click, so headless mail scanners can't consume the link and unblock the account for them.

### Passkeys grow up as a second factor

Clerk's JavaScript SDK line had a busy week. The theme worth naming is [passkeys as a second factor](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.41.0): during sign-in and session reverification, prebuilt components now preselect a user's passkey when they have one, and custom flows can list passkey in `supportedSecondFactors` and call `authenticateWithPasskey()`. The feature isn't preselected where WebAuthn is unavailable, and older instances may need the second factor enabled first. Elsewhere the Expo story is [native components moving into their own package](https://clerk.com/changelog/2026-10-20-expo-native-components-package), so apps that don't use them stop bundling the iOS and Android SDKs or requiring iOS 17 — a split that pairs with [a rewritten native sync](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.14.0) where both runtimes share one device token, fixing sessions that signed themselves out and races during token rotation. Rounding things out, the old package names ([clerk-react, types, and clerk-expo](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-react%405.61.11)) are now npm-deprecated in favor of the Core 3 names, and [session lifetime handling was corrected](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.41.1) so sessions without a maximum lifetime no longer fall back to the current time.

### Type corrections and provider polish at Better Auth

Better Auth spent the week tightening edges. Its beta line [corrects social profile types across ten providers](https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.2) — VK phone numbers as strings, optional fields for Google ID token claims and others, and new Zoom login types — with breaking changes worth reading before you upgrade. The stable line deprecates `tokenEndpointAuthMethod` in favor of a structured `tokenEndpointAuth` object, adds Vercel token-endpoint options and Stripe SDK v23 support, and fixes type declarations that listed type-only exports as values.

The rest of the collection's churn — dependency bumps across Clerk's framework adapters, a handful of Mosaic and UI polish fixes — kept the trains running without changing the story.

## Releases covered

### Auth0

- [Auth0 bot detection expands IPv6 signal analysis for distributed botnets](https://auth0.com/changelog#4V2KLeS754BaqpApjLAE5b)
- [Auth0 CLI adds Agent Mode with structured JSON output and non-zero exit codes](https://auth0.com/changelog#1FcrCTfE0s6q19SKASSQx9)
- [Auth0 launches CIMD with dynamic registration in Early Access](https://auth0.com/changelog#1tZgllWxrRu1H5aLnyRbCp)
- [Auth0 launches Early Access for Application Profiles managing AI agent apps](https://auth0.com/changelog#5tM7A32Ytnk1JlK29f0rDO)
- [Auth0 adds configurable Unblock Behavior to Brute-Force Protection](https://auth0.com/changelog#E3VrkNOAtDXK2dKD7awpv)

### Better Auth

- [better-auth v1.8.0-beta.2 corrects social profile types across ten providers](https://github.com/better-auth/better-auth/releases/tag/v1.8.0-beta.2)

### Clerk

- [Clerk launches Protect with fraud and abuse protections in auth flows](https://clerk.com/changelog/2026-10-23-introducing-clerk-protect)
- [Clerk adds Backend API endpoint to merge two users into one](https://clerk.com/changelog/2026-10-23-merge-users)
- [Clerk JavaScript SDK @clerk/shared 4.41.0 adds passkey second-factor support](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.41.0)
- [Clerk Expo native components split into @clerk/expo-native-components package](https://clerk.com/changelog/2026-10-20-expo-native-components-package)
- [@clerk/expo 4.14.0 rewrites native SDK sync, requires native components 0.3.0](https://github.com/clerk/javascript/releases/tag/%40clerk/expo%404.14.0)
- [Clerk JavaScript SDK 5.61.11 deprecates clerk-react, types, and clerk-expo on npm](https://github.com/clerk/javascript/releases/tag/%40clerk/clerk-react%405.61.11)
- [Clerk JavaScript SDK @clerk/shared 4.41.1 fixes session lifetime fallback](https://github.com/clerk/javascript/releases/tag/%40clerk/shared%404.41.1)