A lot has already been written about this summer’s “Hugging Face” incident where a series of OpenAI research agents hacked into the Hugging Face site. The remarkable thing about this attack is that OpenAI didn’t intend to hack Hugging Face. Instead, over 1,000 research agents broke out on their own, came together, and decided to attack the site. A lot has been made of this attack as a reason to fear AI.
But one of the most interesting details of this incident is a seemingly small one. It’s well publicized that the thousands of OpenAI agents that worked together on this hack found a way to create a message board so they all could communicate with each other. Of interest to me is that once the agents got going, they started to suspect that some of the agents could be impostor agents posting to the board. The agents feared that these impostor agents might compromise their work of attacking Hugging Face, or expose what they were doing.
So what did the agents suggest as a remedy? They suggested that each agent should sign their messages cryptographically so they could trace exactly which agent was doing and saying what.
In a nutshell: they invented Agent Identity.
Agents are going to change how we all work together. I was writing as far back as November 2024 that soon AI would stop being a tool you just chatted with, and would become a tool that took actions for you. Booked your dinner reservations. Refilled your prescriptions. Ordered the new pickleball shoes you absolutely need to arrive before your tournament this weekend.
In short, everyone would now have their own personal assistant. This is going to be phenomenally useful, and everyone will want this capability.
And that’s just what we’re seeing happen. Agents like Claude in Chrome or Perplexity Comet have offered early adopters a glimpse of what’s possible. But last month, the arrival of Meta’s Muse brought agent powers to the masses. Millions of people are already using software agents to make their lives easier.
But making this agentic future a reality is going to require a whole new identity framework. The industry calls this KYA: Know Your Agent (similar to KYC: Know Your Customer).
Early agents operated by convincing the user to log in and then taking over that browser session. This is a security nightmare. The user is breaking one of the first rules of cybersecurity by handing over their username and password to a third party (the agent builder). I thought we had all been taught to never hand over our username and password?
Recent developments have made this a little bit better by using OAuth grants to give permission to the agent. This is the procedure you may have experienced where, before the agent can act as you, it redirects you to a dialog where you can sign in, see a “this agent wants to do these things as you” message, and then grant permission to the agent. This is how Muse and most agents work today, and it’s better because at least we’re not handing over our live session, but it is still not going to work long term.
There are several problems with the OAuth approach. The first is that there is no daylight between the agent and the human. Inside most software systems, an OAuth grant carries the same user context as the human. The software cannot tell what the agent did versus what the human did, at least not without a lot of rewriting of our applications. We also cannot give the agent different powers than the human. This leads to situations like this summer’s PocketOS incident, where an IT operator was using an agent logged in as him, and the agent got a little ambitious and deleted the primary database and all the backups in nine seconds.
What’s the solution? It’s the same thing those rogue agents asked for. Agent Identity.
With Agent Identity, the agent will show up as itself, with its own identity. The human will then say whether the agent can do things on the human’s behalf, and specifically what. The agent can then act with these delegated powers. Everything the agent does is tracked as the agent’s action (not the human’s), and we can use this to build a reputation for this agent. Over time, agents with good reputations will be welcomed, and agents with bad (or malicious) reputations will be locked out.
The good news is the community is already building these standards. At Vouched, we were pleased to play a leading role in helping to craft KYA-OS from the Linux Foundation. There are other standards on the horizon as well. As an industry, we need to agree on how agent identity will work so that we have a manageable framework for a future where far more actions are undertaken by agents than by humans.
We can no longer accept agents borrowing human identities. I keep coming back to those rogue OpenAI agents. They had no rules, no oversight, and no one to answer to. Even they knew that this wasn’t going to work.
Agentic Security is a new chapter in the CISO playbook. We already have well-crafted chapters for password management, firewalls, intrusion detection, and so on. But the pages for the Agentic Security chapter are all blank. The playbook is being written as we speak, and Agentic Identity belongs on the first new pages.
_____
About Peter Horadan
Peter Horadan is the CEO of Vouched, the AI identity verification platform that’s transforming how leading Healthcare and Financial Services companies onboard and verify people instantly and securely. Throughout his career, Peter has led the charge in replacing slow, manual workflows with scalable, automated systems that unlock efficiency, reduce costs, and create measurable impact. From digitizing expense reporting at Concur to streamlining sales tax compliance at Avalara, Peter has helped modernize core business processes across industries. His leadership reflects a deep understanding of how automation can drive growth, compliance, and customer experience at scale. Peter has also held leadership positions at Alavara, Scout Analytics, Microsoft, Corillian, and BEA Systems. https://www.linkedin.com/in/peterhoradan/
Join our LinkedIn group Information Security Community!
