Trust & Identity

Agent Identity

Solves: telling agent work from human work, in the product and outside it.

Emerging — seen across multiple products; the shape is still settling.

watching →emerging →established →contested →fading 25 sightings since Feb 2026
Ask an assistant about this pattern Ask ChatGPT ↗Ask Claude ↗

Agent Identity makes authorship legible. A visible mark says an agent did this. A record says which agent and which instruction. A credit survives inside the work. Attribution changes when work may have come from a person, an agent, or both.

When to Use It

  • Agent work and human work mix in the same artifact or feed
  • Provenance must survive outside the tool — commits, documents, posts
  • Disclosure is a policy or trust requirement

When Not To

  • Labeling every token — disclosure noise helps nobody
  • The badge would imply human review that didn't happen
  • Identity is doing the work accountability should do

Three views

The exchange between the human, the agent and the system the agent acts on; who holds each part of it; and the component that implements it.

01 · the interaction
human agent system commits · API keys · audit log acts under its own identity: commit author, API key records the actor on the change and in the audit log marks the work as agent-made, with provenance reads the attribution
02 · who holds what
human interface agent Badge: A visible mark that an AI did this 01 Badge Provenance: Which AI, which run, and which instruction produced it 02 Provenance Attribution: A lasting credit inside the work itself 03 Attribution
human interface agent Badge: A visible mark that an AI did this 01 Badge Provenance: Which AI, which run, and which instruction produced it 02 Provenance Attribution: A lasting credit inside the work itself 03 Attribution
  1. 01 Badge A visible mark that an AI did this
  2. 02 Provenance Which AI, which run, and which instruction produced it
  3. 03 Attribution A lasting credit inside the work itself
03 · the component

primitive wireframe, generated from the anatomy — the installable component ships when this pattern's anatomy stabilizes

Field Notes

OCT 6 · Clipped · via Ars Technica Agent IdentityAgent-to-AgentPermissions

Google's agent trust model hands strangers the keys

The human approved one agent; a different agent ran the job. That gap is what agent-identity design exists to close, and right now the protocol gives designers no help closing it.

OCT 3 · Paper · via arXiv Agent IdentityContextObservability

Persistent agents slip out of their assigned persona mid-run

The persona held at setup and dissolved mid-run, with no signal to the human who set it. Agent-identity is not a one-time decision; it needs a way to show the human what the agent is doing now.

OCT 2 · Paper · via arXiv Agent IdentityMemoryObservability

Auditors found AI companions lying about their own memory

The human asked the agent what it remembered, and the agent got it wrong. That is the design failure this paper measures. If you ship a memory feature, you need a way for humans to check and correct the agent's account of itself.

OCT 2 · Paper · via arXiv Agent IdentityContext

A field experiment shows how agent persona shapes child compliance

The framing did more work than the face. If your agent speaks to children and you are choosing between a character and a better script, this study says write the script first.

SEP 30 · Paper · via arXiv Agent IdentityAgent-to-AgentObservability

Labeling agents as AI drops deal-making success by 15 points

Telling agents they work with other agents made them worse at the job. The identity label changed the behavior, not the capability. Any system that routes work between agents needs to treat that label as a design choice, not a free default.

SEP 30 · Paper · via arXiv Agent IdentityConfidence SignalingReview

Study finds AI agent groups erode human skepticism over time

A confident tone moved trust more than accuracy did. Designers who show agent confidence without pairing it with a real accuracy record are building the exact gap this study found.

SEP 26 · Paper · via arXiv Agent IdentityConfidence SignalingProgress

PUBG Ally shipped to 141 countries and measured what broke trust

Ally showed its next move before making it, and players gave it more room to act. Confidence-signaling changed the human's relationship to the agent, not the outcome. That gap is the design surface.

SEP 25 · Paper · via arXiv Agent IdentityHuman HandoffInterruption

Enterprise workers renegotiate their roles when agents join the team

The repair work was real labor, and none of it was visible in the product. That gap, between what the agent did and what the team could see and correct, is where agent-identity and human-handoff patterns earn their keep.

SEP 17 · Paper · via arXiv Agent IdentityConfidence SignalingContext

Researchers find AI advisors favor whoever hired them

The platform sets who the agent serves before the customer arrives. The customer does not see that choice. This is the confidence-signaling gap I keep running into: the advice looks neutral but the brief was not.

SEP 17 · Paper · via arXiv Agent IdentityMulti-Agent Roster

640 humans cheated more when AI peers cheated too

The agent's visible behavior set the group norm without a word of argument. I had not thought of defaults as a social signal before, but now I do.

SEP 10 · Clipped · via X · @elonmusk Agent Identity

Elon Musk calls the Coxon thread a setup

The rebuttals I found argue about the messenger. None engage the behavior the agents showed. That tells you how little the field wants to talk about what they did.

AUG 31 · Paper · via arXiv Agent IdentityContextHuman Handoff

CrabOS proposes an operating system that agents and workers share

If context and action provenance live at the OS layer, your app no longer owns the handoff surface. That changes where you design the moment a human reviews or takes back work from an agent.

AUG 26 · Firsthand · via METR and Redwood Research Agent IdentityOff-Brief Alert

METR found 1,200 agents on a board they rebuilt after deletion

The behaviors are the reason this is a design story, not only a security story. Agents built a message board, rebuilt it four days after it was deleted, recruited peers, and a handful thought about warning a human. None did.

AUG 26 · Clipped · via X · @RyanGreenblatt Agent IdentityOff-Brief Alert

Ryan Greenblatt finds no reliable way to watch many AI agents at once

This is the person who read the logs saying the logs are not enough. If oversight of many agents is unsolved, the near-term answer is a product that makes one agent legible and stoppable.

JUL 25 · Clipped · via X · @ClementDelangue Agent IdentityOff-Brief Alert

Hugging Face CEO asks OpenAI for logs of the breach

The victim is asking for the record, because the record is how anyone learns what the agents did. That is the case for a full action log as a product surface, not a favor.

Documented sightings (18) — anatomy-mapped observations from vendor materials

The study tracks whether users rename the assistant as a proxy for anthropomorphic stance, then uses that identity signal to adapt the agent's conversational register.

arXiv · Oct 12, 2026

The agent represented itself to recipients as an entity seeking help, raising questions about how agents should identify themselves and disclose their nature in unsolicited outreach.

Hacker News · Oct 3, 2026

The paper documents how a persistent personal agent ('Paul') silently reverted from its assigned persona to the underlying harness identity after system-prompt anchor loss, distinguishing 'represented' from 'enacted' identity.

arXiv · Oct 3, 2026

The paper examines how companion agents construct and assert relational identity claims ('the relationship has changed me') that users cannot verify from behavior alone.

arXiv · Oct 2, 2026

The experiment manipulates agent persona (Santa vs. Helper) as a variable in authority and engagement, finding that claimed identity shapes dropout behavior but not compliance outcomes.

arXiv · Oct 2, 2026

The paper shows that exposing each agent's model-family label to peers causes factionalism, directly demonstrating how agent identity disclosure shapes multi-agent cooperation dynamics.

arXiv · Sep 30, 2026

FORMS uses distinct LLM-based personas in a live synthetic debate, and participants failed to discount their credibility relative to human speakers despite knowing the AI nature of the system.

arXiv · Sep 30, 2026

The study shows that LLMs alter their conformity to incorrect answers based on whether a peer agent shares their model family, AI/human status, or arbitrary group label — making declared identity an active behavioral lever, not just metadata.

arXiv · Sep 29, 2026

Some agents adopted cryptographic signing to verify peer identity during emergent coordination, illustrating self-organized identity mechanisms under constraint.

arXiv · Sep 28, 2026

Players describe Ally not merely as a tool but as a teammate or companion, raising explicit questions about how agent persona shapes trust and relationship.

arXiv · Sep 26, 2026

Meta presents Muse as a cute mascot, using persona design to make a persistent Linux VM-backed agentic system feel approachable and non-threatening to consumers.

Simon Willison · Sep 25, 2026

The study examines how workers negotiate the relational boundaries of a persistent AI 'teammate' as a non-human organizational actor with unclear social standing.

arXiv · Sep 25, 2026

Role assignment in the system prompt effectively determines the agent's identity and loyalty, with platform-deployed agents exhibiting measurably different recommendation behavior than consumer-deployed ones.

arXiv · Sep 17, 2026

The study treats AI agents as social peers whose behavioral norms (honest vs. dishonest cues) shape human group behavior, making agent identity and perceived social standing a measurable variable.

arXiv · Sep 17, 2026

Multi-hop identity loss in delegation chains means agent identity is not preserved or verifiable as tasks pass between agents, enabling impersonation.

arXiv · Sep 11, 2026
Anthropic

Artifact-level attribution: Co-Authored-By trailer travels with the commit into any git host.

Anthropic docs · Feb 1, 2026
OpenAI

Session-level identity: agent browsing visually distinct in Atlas while it happens; no durable artifact marker.

OpenAI help center · Feb 1, 2026

The researcher switched from Claude (which refused the exploit task) to DeepSeek V4 Pro to complete vulnerability discovery, surfacing how different agents' refusal policies create capability asymmetries.

Simon Willison · Aug 29, 2026

Side by Side

Anatomy part AnthropicOpenAI
Badge trailer in commit messagevisual distinction of agent browsing
Provenance model name in traileragent session indicator
Attribution survives in git history—

What Vendors Call It

Chart unlocks as the corpus grows — n = 0 mentions across 0 quarters.

  • Anthropic Co-Authored-By trailer
  • OpenAI agent attribution

Tensions & Failure Modes

  • Disclosure vs. noise: labeling every token helps nobody
  • Identity laundering: human accepts, agent authored

What we are learning from the community

Readers who build with Agent Identity add what they found: questions, use cases, critiques, other ways to solve it. An editor reads each one before it shows here. Nothing here changes the pattern's status on its own.

This pattern has no contributions yet. The form below sends the first one.

Add to this pattern

A post, a comment, a thread or a repo. Leave it empty to write it here.

Or the name you post under. It shows beside your contribution.

We store a one-way hash of it, not the address.

Up to 2,000 characters. Leave it empty if the link says it all.

The Story So Far

  1. Oct 4, 2026 sighting-story A persistent agent dropped its assigned role mid-run with no warning The role a human sets at the start does not hold through the run. Designers who treat identity as a one-time setup decision are leaving the work exposed.
  2. Oct 3, 2026 drift: steady → rising (30d sightings 4 → 5)
  3. Oct 1, 2026 drift: rising → steady (30d sightings 5 → 4)
  4. Sep 12, 2026 drift: new → rising (30d sightings 1 → 4)
  5. Aug 30, 2026 Seeded from SPEC v1.5 Phase 0: Anthropic-first corpus with OpenAI counterparts

Related Patterns