Nathan Labenz keeps his AI agents on a separate machine. On his personal laptop, Claude and Codex can reach his own accounts, and he tells them to follow fairly specific instructions instead of running long tasks on their own, "because I'm concerned about what they might get up to." On a Mac Mini that he calls the agent's computer, they can run for longer and work through obstacles. There they use their own Gmail and GitHub accounts, which, he said, look "basically indistinguishable from human accounts" to everyone else online. "I'm just sort of having my agents pose as humans," said Labenz, host of The Cognitive Revolution. He asked whether anything tells the people on the receiving end that an agent is acting, where it came from or who is powering it.
"Yeah, basically no, is I think the unfortunate answer," said Alan Chan, a research fellow at the Centre for the Governance of AI (GovAI). The episode was recorded in two sessions and published on October 14, 2026.
An AI agent is a system that carries out tasks by itself: it browses websites, sends messages and makes purchases. Chan has worked on how to keep track of such systems for years. In the January 2024 paper Visibility into AI Agents, he and his co-authors described three separate tools. Identifiers show whether an agent is involved, and which one. Real-time monitoring lets someone step in while the agent is working. Logs support investigation afterward. Identification is the part the open web still lacks.
Why companies will get there first
In Chan's ideal setup, every service would give people an easy way to create a limited sub-account for an agent, with restricted permissions and an identity that traces back to that agent. He said the main obstacle is coordination, not technology. He expects to see such sub-accounts soon inside companies, where tolerance for risk is lower and a single organization controls the infrastructure. He said many startups are already building enterprise agent-identity products.
His example was Anthropic. In a recent post about automating its own AI research, the company said it gives internal agents identities. Chan noted that different models can correspond to the same agent identity, and he took the company's oversight argument to mean that a problem can be traced back to the agent, the context it had and its earlier conversations. Anthropic's September 17, 2026 report matches that account. It describes identities that persist across model upgrades, with the records and messages an agent creates tied to its identity and linked back to transcripts.
On the open internet, Chan said, an agent's identification would have to be accepted by "basically every other platform or service," and each platform has reasons to promote its own scheme, which might lock users in. He mentioned the OpenID Foundation, which runs an AI identity management community group, and the Agentic AI Foundation. The Linux Foundation launched the latter in December 2025 with Anthropic's Model Context Protocol, Block's goose framework and OpenAI's AGENTS.md as its first projects. "As of right now, it's not a solved problem," Chan said.
A ladder of disclosure
Labenz asked what an agent should actually reveal: that it is an AI, which company runs the model, or which person sent it. Chan said no single answer fits every case. He also said the exact boundary of "an agent" matters less than one principle: whatever computation a model does should be linked to some identity in the end.
He then described a ladder of steps, each with its own privacy cost:
- Declare that it is an AI. If people mainly want to know whether to trust what they are reading, saying "this is an AI" may be enough, without saying which AI.
- Name the inference provider. This is the company whose servers run the model. If you see an agent misbehaving, you could contact that company. Chan said providers would need a way to sort complaints, since they could otherwise be "flooded with like millions of complaints about agents doing random things online."
- Identify the responsible person or business. If law moves toward making users liable for what their agents do, high-stakes uses might need to identify the prompter. That could be a business instead of an individual, and the information need not be public. Chan compared it to IP addresses. He cannot find out who is behind one, but police can by going to each organization along the chain.
The middle step is the one Chan said he is "probably most confident about." He thought it would speed up the response to cases like a recent incident involving Hugging Face. As he described it, in that kind of case the agent is not fully adversarial and the user is out of the picture, so the urgent questions are whether an agent is involved at all and whom to call to stop it.
Amazon, Muse and the gatekeepers
Labenz brought up a concrete fight. He said that in the previous few days Amazon had banned Meta's new Muse AI from shopping on its site. He would have welcomed the bots for a while, he said, and he expected the ban to start an arms race between detection and evasion by users who still want their agents to shop on Amazon.
Chan said that, other things being equal, agents should get more access to the web. He gave examples from his own life: an agent that could read all the relevant legal cases on an immigration question, or compare options before a large purchase. He offered a guess about Amazon's reasoning. If personal agents like Muse become the main point through which people deal with everything else, Meta would hold the data and the customer relationship, and could steer shoppers toward Amazon's competitors. He noted that Amazon has its own Rufus agent. The move makes business sense, Chan said, but is "probably bad from a sort of societal user access and welfare perspective." He said he did not know who should set the rules. Letting platforms try different approaches seemed useful to him, but he wanted "very clear rules of the road" on access, whether through legislation or a regulator.
Labenz asked which standards were most promising. He mentioned Google's Agent2Agent protocol and AGNTCY, a project he said Cisco has been leading. Chan called the field a "hodgepodge" and said the technical differences matter little in practice. He expects the winners to be standards backed by many companies, as Google's is, or by powerful gatekeepers. His guess was something like Cloudflare's Web Bot Auth. Instead of trusting easily faked labels or IP addresses, it has automated requests carry a cryptographic signature that the website can check against a published key. The site still decides for itself what an authenticated agent may do.
Chan compared Cloudflare's position to that of the social media companies that became gatekeepers to information earlier this century. If agents become the way people consume information online, the companies that sell the ability to block them "just gain a ton of power," he said. He wants Cloudflare to state its blocking policies clearly and to coordinate with AI labs so that legitimate agents are not shut out.
At one point Chan mentioned a Cloudflare product that sends agents "down labyrinths and rabbit holes." When Labenz asked about it, Chan said he was not talking about Web Bot Auth but about a separate product sold to website owners. He said its workings are not public and guessed that it uses something like prompt injection, meaning hidden instructions planted for an AI to read, to steer agents toward synthetic sites. Cloudflare has published a description of this product, AI Labyrinth. It describes an opt-in defense that gives suspected unwanted crawlers hidden links to AI-generated decoy pages, which waste the crawler's resources and help identify bots. It does not describe prompt injection. Chan also described agents being blocked unless they identify themselves or pay through Cloudflare's microtransaction system. That fits Cloudflare's pay-per-crawl beta, in which publishers choose free access, paid access or blocking, and Web Bot Auth signatures identify who gets charged. Chan said this could turn out well if Cloudflare does not lock people into its own protocols or payment method.
Why Chan stepped back from open-web rules
Labenz tried to sketch the overall picture: open, free access by default, with site owners able to gate their content. He admitted he found it "fuzzy" what an agent would need to prove, and whether an agent that wanders onto a random website is really authorized by the person who sent it.
Chan said he shared the confusion. That is partly why, he said, he has been thinking "a lot less" about the issue over the past couple of years: working out a good global policy is "totally intractable." Individual sites are experimenting for their own reasons. Some want payment for their data, and some want to save their servers for human readers. When he started this work, he said, agents seemed like a big deal that nobody was discussing, and the threat model was unclear. Better capabilities and real incidents have since sharpened his priorities. He now puts less weight on open-web authorization and more on strong monitoring and security inside companies, and on identification that supports good investigation of incidents. Labenz described this as a form of entity-based regulation. The web stays a "wild west" for experimenters, while large companies must make their agents identify themselves, so that in the next incident someone can see it is an OpenAI bot and call OpenAI.
Chan pointed to a foundation that already exists in Europe. Article 50 of the EU AI Act requires providers to mark AI-generated audio, images, video and text in a machine-readable, detectable way. A code of practice, which the European Commission describes as a voluntary framework for showing compliance, covers marking and detection. Chan's example was a tag in an API response stating that the text is AI-generated. He said Anthropic has recently implemented watermarking to comply. The company's documentation describes invisible watermarks in text and signed provenance data attached to files. Article 50 requires marking content as AI-generated, not naming the inference provider. Chan argued that once everyone is marking content, adding the provider's name "seems like much easier" as a next step, and he called this "a semi-optimistic thing."
Money, insurance and reputation
Labenz raised an idea from economist Tyler Cowen: agents should be capitalized, meaning money is attached to an agent so that people it harms can make a claim. Cowen and Sonia Farrell Pearson explore the idea in an August 2026 essay. They note that it only works if the same agent keeps a persistent identity and consequences can actually be enforced. Chan said the idea seems technically feasible but would be a hard sell: "the average person doesn't really have a Bitcoin," and few people would be reassured that someone's agent might hack them but will pay them back. He thought it was worth trying, perhaps first in the crypto community.
His alternative was proof of insurance. An agent would present a certificate, similar to a website's SSL certificate, showing that it carries insurance coverage. If the agent then tried to social-engineer or hack you, you could take a claim to the insurer. Chan named two problems. Claims would need tamper-proof evidence of what the agent did, because people will falsify claims. And collecting that evidence might mean the insurer records what the agent does on a user's computer, which he called bad for privacy.
Labenz asked whether secure connections might solve much of this. He described HTTPS as a channel where each side knows the other is who it claims to be. The protocol behind it, TLS 1.3, qualifies part of that picture: authenticating the server is standard, but authenticating the client is optional. Chan said this kind of encrypted handshake would confirm that you are talking to the agent you meant to contact, but not whether that agent is trustworthy. For that he thought agents need a continuous identity that builds a reputation over time. Before connecting, you might check its score on "ratemyagent.com or something like that." He described once looking up a business on Trustpilot before buying, finding a one-out-of-five rating, and feeling he had dodged a bullet.
In Chan's view, that reputation would have to rest with a person or a legal person, such as a company. For businesses, tying it to the company's name seemed fine to him. For individuals he suggested proof of personhood, then corrected himself mid-answer: it shows only that someone is a unique person, not that it is the same person each time, and confirming sameness "actually leaks some information." He thought some middle ground might trade a little privacy for more accountability.
The email precedent
Labenz offered email as a model. Anyone can email anyone. Gmail limits mass sending, and recipients judge messages by their content and by opt-in identifiers such as DKIM, a signature that lets a domain take cryptographic responsibility for a message. Chan took the lesson that "muddling through is fine." Spam is still a big problem and costs a lot of effort to fight, he said, but email works, and so, more or less, does social media.
As for agents on the web, Chan said the worst outcomes would be cybersecurity harms: stolen data, stolen identities, hacked accounts. He expects security to improve as agents themselves take on defensive work. Beyond that, he worries about a closed internet and platform lock-in, the outcome he had just warned about in Amazon's fight with Meta. Those are bad, he said, "but it still seems like we can muddle through more or less."