Read this post on Shoshana’s Substack: Papercuts.
What happens when an AI agent makes a purchase you didn’t intend? How will banks respond when your agent moves funds or pays bills? Should websites know that the agent is performing tasks on your behalf or should the actions only be attributed to Claude? The new capabilities of AI agents raise fundamental questions about responsibility online. Companies, foundations, and governments are suggesting different approaches to fill this gap. In this case, a flexible approach that allows different services to address these problems in the right way for each service will best preserve people’s ability to engage freely and privately online. Meanwhile, one proposal in Congress would break the way programming works.
Building out the internet architecture for agent identity
Several organizations are developing infrastructure for AI agent identity, which will be useful for different kinds of companies and websites that want to limit what AI agents can and can’t do when using their services. Currently, when AI agents access websites, their activity is typically associated with network and browser-level identifiers. The Linux Foundation is developing a new open source Agent Name Service that would build identity into internet infrastructure, connecting identity to Domain Name System (DNS). It adds on existing internet architecture to give websites a clearer picture of which agent is interacting with them and would facilitate websites identifying AI agents and controlling what they can do. Meanwhile, Cloudflare, Google, and Mastercard are developing systems for identifying agents or enabling trusted transactions. Other companies hope to link agents to biometric or government-backed identities. These approaches may make sense in some contexts, but they differ sharply in their implications for privacy and anonymity. Recent identity verification breaches should cause companies to hesitate before embracing such solutions.
Who’s responsible for AI actions?
Agents can create real commercial challenges. Customers may be unaware of the purchases or actions of their agents, and any dissatisfaction can create costs for the merchant. Scale creates other problems. Imagine if thousands of agents independently order the wrong shade of pink nail polish. Mass returns become a real business issue. An agent might independently book non-refundable flights or hotels based on incomplete preferences, leaving customers angry at the airlines or hotels themselves. And insider trading violations—even if accidental—could arise from agents being instructed to buy and sell the best stocks for maximum profit.
Medical care raises similar questions. Patients may authorize AI agents to complete forms or sign disclosures, while providers may want additional verification that the agent truly represents the patient. AI agents signing disclosure forms on behalf of people could also open up doctors and medical providers to serious liability. Other privacy laws, including FERPA and HIPAA, also assume rules about authorized access that AI agents complicate.
Existing law already addresses many questions of responsibility. Under the Uniform Electronic Transactions Act, adopted in 49 states, people are generally responsible for transactions made by their “electronic agents.” There are also early signs that when business chatbots make offers to customers—however detrimental to the business—the company will be forced to honor them. Meanwhile, banks may also require stronger verification under existing anti-fraud and Know Your Customer obligations. And this has prompted discussion of analogous “Know Your Agent” frameworks.
But broad laws addressing agent use would miss the mark. Many websites want to be accessed by AI. Stores want their products recommended by chatbots and the same goes for medical services and, really, anyone selling anything. AI is so often used for coding, and publishers of API documentation generally want AI coding agents to have access to information about how their tool’s code works to make coding easier for customers. Even within a single company, there may be things they want AI to work with and access and things they want to block it from doing.
As a result, a variety of companies may want the ability to either reject activity from AI agents or require AI agents to be tied more closely to specific individuals. To that end, there are good uses for agent-identifying technology.
Early government fumbles addressing the problem
While the Linux Foundation’s efforts promise to be a new, useful layer of the internet, lawmakers are already addressing these issues. Unfortunately, they’re doing so in ways that miss the mark. The Stealth Bot Prohibition Act would prohibit people from deploying a “stealth bot”—software that scans, indexes, scrapes, or accesses an internet source without disclosing its identity and purpose—in a way likely to damage, “burden” or “impair” the service. Despite its name, the bill reaches many longstanding computing practices unrelated to AI.
First, the Computer Fraud and Abuse Act and other statutes already prohibit many forms of malicious attacks that damage websites. If the goal is to target cyberattacks, Congress already has tools to do so.
Next, the bill never defines what it means to “burden” or “impair” a website. Every website visit—even by Google’s search crawlers—burdens a website to some degree. People scrape websites constantly for good and bad reasons. I scrape websites to monitor media mentions of the Abundance Institute’s scholars and retrieve the relevant text. Under this law, I could face ridiculous liability for simple automation. Millions of developers, journalists, researchers, businesses, and hobbyists rely on similar automations. The bill could expose routine automation to severe legal risk.
Worse, the legislation defines “stealth bots” as tools that do not disclose their identity, purpose, and intended use whenever they access a website. That requirement is wildly impractical. My automations are built in Zapier, where bits of Python code run inside larger workflows. They don’t announce, “I am Shoshana’s media monitoring bot collecting articles where Abundance Institute is mentioned.” Nor should they have to. Requiring every automated tool to reveal exactly who built it and why would impose enormous compliance costs, surprise millions of developers, and undermine anonymous access to information. People also use automated tools to research sensitive subjects—from medical conditions to domestic abuse to divorce—and should not have to disclose those purposes to any website. The First Amendment protects not only anonymous speech, but also anonymous access to information.
Finally, the bill prohibits bots from obscuring their identities to appear human when used with generative AI services. This could criminalize ordinary automation. I once built a Zapier workflow whose WordPress upload module rejected Zapier’s default user-agent string. Replacing it with random text fixed the problem. Under this bill, had I replaced it with my own name, that routine compatibility fix could become unlawful simply because the workflow incorporated AI. I also have no idea what, if anything, Zapier tells other services about my automations today—and I certainly wouldn’t want it broadcasting what I’m building or why. That kind of requirement would create serious problems not just for Zapier, but for the millions of people using modern no-code and AI tools.
Congress isn’t alone. Estonia is developing government-backed digital identities for AI agents tied to user identities. Part of the purpose is to establish who is responsible for specific actions online. The announcement does not make clear whether this will be required or to what degree agent ID would be tied to individual ID. We should expect to see many more proposals addressing different kinds and layers of AI identity.
Governments should not require AI agents to identify their users
The Linux Foundation’s proposal extends existing internet infrastructure, enabling new private solutions and choices. More concerning are proposals that would require the use of government systems to verify the identity of every AI agent—and tie those agents to real people. Lawmakers around the world are eagerly pursuing and passing age verification requirements for social media and AI chatbots. AI agents could be next. Moreover, there is a real risk that governments will require more for agents. Most age verification proposals try to establish age without requiring the user’s full identification. These efforts have varying degrees of success. However, because AI agents act on behalf of users, lawmakers may actively pursue full identity verification for AI agents.
Such proposals would run straight into common and powerful critiques of age verification regimes, including infringing on the well-established right to speak anonymously and creating identity theft risks. Governments should allow AI agents to browse the internet with the same anonymity people enjoy today and should not forcibly identify those users merely because they delegated the work to software.
AI agents are exciting and powerful new tools, but also raise new complications for consumers and businesses alike. Some companies and services may well choose to add layers of identification requirements to avoid legal risk or otherwise protect their services. Companies should remain free to require identity verification on their own websites—or reject AI agents altogether. Those choices belong to private actors, not the government.