SPIFFE identity tokens for AI agents can still be replayed if intercepted. The IETF WIMSE group built the fix, and SPIFFE just adopted it.