Google AI Updates: October 17, 2026

1. Google OAuth Adds DPoP Binding for Refresh Tokens

Google. Google’s OAuth platform now supports DPoP (RFC 9449), which cryptographically binds refresh tokens to a client-generated key pair, so a stolen refresh token cannot be replayed without the private key. Access tokens (typically valid for an hour or less) stay standard Bearer tokens to avoid per-request signature verification on high-QPS APIs like Gmail, Calendar, and Drive. For multi-agent and MCP chains, Google recommends routing delegation through Google Cloud Secure Token Service, since oauth2.googleapis.com does not support RFC 8693 token exchange, and it ships an adoption guide plus a DPoP adoption SKILL.md for coding agents. Workspace Context-Aware Access also uses DPoP to validate agent identities at the Agent Gateway on the Gemini Enterprise Agent Platform. Source

2. Google Cloud Shares Eval Lessons From Building Its Developer Plugin

Google Cloud. Google Cloud’s team behind the new Google Cloud Developer plugin published four evaluation practices drawn from building it. On an initial 11-prompt suite, an LLM judge that read only the agent’s final reply failed three prompts the agent had actually passed, which led the team to grade raw tool-call trajectories instead. They also recommend preserving turn structure in telemetry, because parallel tool dispatch let searches run before a skill’s injected instructions reached the context, and running live and credential-free “plan-only” evaluations side by side, which surfaced roughly half of their most important findings. Golden sets curated by human experts serve as the durable baseline as models and harnesses change. Source

3. Google Publishes an Agent Evaluation Playbook Built on the Open-Source agent-eval Toolkit

Google. A companion Developers Blog post, tied to an AI Agent Clinic episode that builds an eval pipeline for a LangGraph agent in 60 minutes, walks through evaluating agents with the open-source agent-eval toolkit. The approach starts from critical user journeys, where each clause becomes a check, then uses ADK user simulations to generate multi-turn test traffic before real production traces exist, and layers checks across the stack rather than relying on one top-line score. It is aimed at catching silent failures such as retry loops and excess tool calls that still produce plausible final answers. Source

4. YouTube Music Starts Labeling AI-Generated Songs

YouTube. Google is rolling out a generative AI label in the YouTube Music app and website that tells listeners when a track was made with AI tools, mirroring the disclosure it added to AI-generated videos on YouTube earlier this year. Google is not banning or demoting AI music. The move follows Deezer’s AI-music filter earlier this week and signals that provenance labeling is becoming a standard expectation for audio generation platforms. Source