Who Owns This Agent? Tracing AI Agents Back to Their Owners

2026-05-15

AI Summary

Current AI agents lack a reliable mechanism for attributing their actions to specific deployers, leading to accountability gaps. This work formally defines the agent attribution problem for the first time and introduces a robust provenance protocol based on “canary” injection: by embedding filter-resistant, performance-neutral traceable signals into interaction streams, the platform can accurately link sessions to user accounts through log analysis. The approach integrates session-log matching with constrained signal embedding and has been validated across diverse real-world scenarios, demonstrating strong reliability, robustness, and scalability suitable for large-scale deployment.

Abstract

AI agents are increasingly deployed to act autonomously in the world, yet there is still no reliable way to trace a harmful agent back to the account that deployed it. This creates the same accountability gap across both ends of the intent spectrum: benign operators may deploy misconfigured or overbroad agents that cause harm unintentionally, while malicious operators may deliberately weaponize agents for scams, harassment, or cyber attacks. In many cases, these agents are powered by vendor-hosted models, a dependency that holds even for sophisticated adversaries such as state actors conducting cyber operations. In either case, affected parties can observe the behavior but cannot notify the responsible operator, stop the session, or identify the account for investigation. We formalize this gap as the problem of agent attribution: linking an observed agent interaction to the responsible account at the hosting vendor. To our knowledge, this is the first work to define the problem and present a practical solution. Our protocol is canary-based: an authorized party injects a canary into the agent's interaction stream, and the vendor searches a narrow window of session logs to recover the originating session and account. Simple canaries suffice in non-adversarial settings. For adversarial operators who filter or paraphrase incoming content, we develop robust canary constructions that cannot be suppressed without degrading the agent's own task performance, yielding a formal asymmetry in the defender's favor. We evaluate a variety of scenarios including real-world agents and show that our attribution method is reliable, robust, and scalable for vendor-side deployment.

Problem

• agent attribution
• AI accountability
• harmful AI agents
• operator identification
• AI traceability

Innovation

• agent attribution
• canary-based tracing
• AI accountability
• robust watermarking
• adversarial robustness