Who Owns This Agent? Tracing AI Agents Back to Their Owners
cs.CR, cs.AI, cs.MA
Submitted: 2026-05-15
Updated: 2026-09-27
Comments: Under Review
Code: https://github.com/unclecode/crawl4ai
License: http://creativecommons.org/licenses/by/4.0/
The gist: AI agents increasingly act autonomously in the world, yet harmful behavior cannot be reliably traced to the account that deployed the agent.
Terminology
Abstract
AI agents increasingly act autonomously in the world, yet harmful behavior cannot be reliably traced to the account that deployed the agent. This creates an accountability gap across both benign and malicious settings: misconfigured or hijacked agents may cause unintended harm, while malicious operators may deploy agents for scams, harassment, or cyberattacks. In many cases, these agents rely on vendor-hosted language models. Affected parties can observe the harm, but cannot identify the responsible vendor session or account. We formalize this problem as agent attribution: linking an observed agent interaction to the account responsible for the underlying model calls. We present a canary-based protocol in which an authorized party embeds selected signals in content consumed by the agent, then asks the vendor to search a narrow time window of account-linked session logs. Lexical canaries provide exact-match attribution when a benign operator does not deliberately evade detection. Against adaptive adversaries, we use task-relevant semantic canaries whose removal or replacement also removes information required for successful task execution, creating a utility--evasion asymmetry. Across communication, web, and cyber-agent settings, we show that the protocol supports reliable session attribution, withstands adaptive transformations, and scales to practical vendor-side log search.
Sources
- Generative Language Models and Automated Influence Operations: Emerging Threats and Potential Mitigations
- An Overview of Catastrophic AI Risks
- Risks from Learned Optimization in Advanced Machine Learning Systems
- Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
- Building Production-Ready Probes For Gemini
- The Alignment Problem from a Deep Learning Perspective
- The Effects of Reward Misspecification: Mapping and Mitigating Misaligned Models
- Can AI-Generated Text be Reliably Detected?
- Smarter, Better, Faster, Longer: A Modern Bidirectional Encoder for Fast, Memory Efficient, and Long Context Finetuning and Inference
- Anatomy of an AI-powered malicious social botnet
- ReAct: Synergizing Reasoning and Acting in Language Models
- Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models
- Provable Robust Watermarking for AI-Generated Text
- Universal and Transferable Adversarial Attacks on Aligned Language Models
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs