Vint Cerf—one of the architects of the modern internet and a key figure behind TCP/IP—has reportedly been working on a plan aimed at something the web has never really had to solve at scale: how to make AI agents identifiable, interoperable, and governable once they start operating “in the wild.”
The idea sounds simple on the surface. But it’s not. The open internet was built for humans and for software that behaves predictably: browsers request pages, servers respond, protocols define what “correct” looks like. AI agents are different. They don’t just fetch information; they can decide what to do next, coordinate with other systems, and take actions across multiple services—often without a human in the loop for every step. That shift turns the internet from a network of endpoints into a network of actors.
And when you have actors, you need ways to recognize them.
According to reporting, Cerf’s team is developing a standard intended to identify AI agents as they operate online. In parallel, there’s a broader push to “unleash” AI agents across the open internet—meaning not just allowing them to exist, but enabling them to function more freely while still maintaining visibility and trust. The tension at the heart of this effort is familiar to anyone who has watched the internet evolve: innovation wants fewer barriers, but safety and accountability require shared rules.
This is where agent identification becomes more than a technical nicety. It’s a foundation for transparency in an environment where automation can otherwise be indistinguishable from ordinary traffic—or from malicious behavior.
What “identifying AI agents” could mean in practice
When people hear “standard for identifying AI agents,” they often imagine something like a visible badge on a website or a label in a user interface. But the internet doesn’t work that way. Most of the time, identification happens at the protocol level: headers, certificates, tokens, signatures, and other machine-readable signals that let systems decide whether to trust, throttle, block, or allow.
A credible agent-identification standard would likely focus on machine-to-machine recognition. That means a way for an agent to declare itself (or be declared) in a consistent format, so that receiving systems can interpret the signal reliably. The goal wouldn’t necessarily be to expose the agent’s internal model or proprietary details. Instead, it would provide enough structured information for downstream systems to understand what kind of actor is making requests, under what authority, and possibly under what constraints.
Think of it less like “this is ChatGPT” and more like “this is an automated agent operating under a specific identity and policy profile.” That distinction matters because it separates transparency from surveillance. A system can be identifiable without being fully knowable.
Why this matters now: agents change the threat model
The internet already has bots. It already has scrapers, crawlers, and automation frameworks. So why is agent identification suddenly urgent?
Because AI agents are not just bots that follow fixed scripts. They can interpret context, generate new instructions, and adapt their behavior based on what they see. That makes them more capable—and also more unpredictable. Even well-intentioned agents can cause harm through mistakes: sending the wrong message, triggering unintended workflows, or interacting with systems in ways that weren’t anticipated by the service provider.
From a security perspective, the difference between “a bot that requests URLs” and “an agent that can act” is enormous. An agent can become a proxy for user intent, but it can also become a proxy for attacker intent. If an agent can convincingly mimic legitimate behavior, then traditional defenses that rely on static patterns become less effective.
Identification standards can help close that gap by giving defenders and platforms a consistent way to classify traffic. Instead of guessing whether a request came from a human browser, a known integration, or an unknown automation framework, systems could rely on a standardized declaration. That enables better rate limiting, better auditing, and more targeted policy enforcement.
It also creates a path toward accountability. If an agent is identifiable, then actions taken by that agent can be traced back to an identity and a policy set. That doesn’t automatically solve accountability—bad actors can still lie—but it raises the cost of deception and improves the quality of incident response.
Interoperability: the missing layer between models and networks
There’s another reason this effort feels like it belongs to someone like Cerf. TCP/IP wasn’t just about moving packets; it was about making networks interconnect. It created a common language so that different systems could communicate without needing bespoke agreements for every pair of endpoints.
AI agents today are often trapped inside silos. A model might be powerful, but the agent wrapper, tool integrations, authentication flows, and action permissions are frequently custom. When you move from one platform to another, the agent’s behavior changes. The “agent” becomes a product-specific implementation rather than a portable capability.
A standard for agent identification could be part of a larger interoperability stack. If agents can declare themselves consistently, then platforms can build reusable trust and governance mechanisms. That reduces friction for legitimate agents and makes it easier to apply consistent safeguards.
In other words, identification is not the end goal. It’s the on-ramp to a more general idea: agents should be able to participate in the open internet without each service reinventing the wheel for trust.
The “unleash” framing: enabling freedom with guardrails
The phrase “unleash AI agents across the open internet” is provocative, and it hints at a philosophy. The internet’s history is full of moments where new capabilities were initially treated as threats—email, file sharing, search, even web forms. Over time, the ecosystem matured into norms and standards that allowed innovation to scale.
But the internet also learned painful lessons. When new capabilities arrive faster than governance, the result is fragmentation: platforms build their own rules, users get confused, and attackers exploit inconsistencies. A standard approach aims to prevent that outcome for agents.
If the standard is widely adopted, it could reduce the need for one-off negotiations between agent developers and every major service. Instead, services could implement a common interpretation of agent identity signals. That would make it easier for legitimate agents to operate while giving platforms a consistent basis for enforcement.
Importantly, the standard doesn’t have to dictate what agents are allowed to do. It can focus on how agents are recognized and how their identity and authority are communicated. That leaves room for policy differences across jurisdictions and platforms, while still providing a shared technical layer.
A unique angle: identification as a trust primitive, not a content filter
One of the most interesting aspects of agent identification is what it does not necessarily do. It doesn’t have to be a content moderation system. It doesn’t have to decide whether an agent’s actions are “good” or “bad.” Instead, it can function as a trust primitive—something that helps systems decide how to treat an agent’s requests.
That matters because content filtering at the protocol level can quickly become brittle and politically fraught. But trust primitives are more modular. A platform can say: “We will treat requests from identified agents differently than anonymous traffic,” without needing to inspect every generated output.
For example, a service might allow an identified agent to access certain APIs with scoped permissions, while requiring additional verification for unrecognized automation. Another service might throttle identified agents differently depending on their declared purpose. Yet another might log actions with higher fidelity when an agent identity is present.
This approach aligns with how the internet already works. Authentication and authorization are not the same as content judgment. They’re about who is making the request and what they’re allowed to do.
What could be included in an agent identity signal
While the exact details of any emerging standard are not fully public in the reporting, it’s useful to consider what a robust agent identification scheme would likely need to cover to be useful in real deployments.
First, it needs a stable identifier. That could be tied to an organization, a developer, or an agent deployment instance. Second, it needs a way to express authority. An agent shouldn’t just claim an identity; it should be able to demonstrate it, likely through cryptographic signatures or verifiable tokens.
Third, it needs scope. Agents can do many things. A standard that only identifies “the agent” without describing what it is authorized to do would be too blunt. Scope could include which tools it can call, which domains it can interact with, or what permission level it has.
Fourth, it needs lifecycle signals. Agents may rotate keys, update versions, or change behavior. A standard should support versioning and revocation so that identity remains meaningful over time.
Finally, it needs compatibility with existing internet infrastructure. The best standards don’t replace everything; they integrate. That means fitting into HTTP-like request flows, API gateways, and logging systems that already exist.
If these elements are handled well, agent identification becomes a practical building block rather than a theoretical concept.
The governance question: who sets the rules?
Standards are never purely technical. They reflect incentives and power. In the internet’s early days, standards emerged through open processes and broad consensus. Today, the ecosystem is more complex: major cloud providers, browser vendors, standards bodies, and governments all influence what gets adopted.
Cerf’s involvement suggests a desire to keep the approach grounded in interoperability and open participation. But adoption will still depend on whether the standard is easy to implement, whether it provides value to service providers, and whether it can be trusted by users and regulators.
There’s also the question of enforcement. A standard can define how agents identify themselves, but it can’t force compliance. Enforcement will come from platforms choosing to accept or reject agent identity signals. That means the standard’s success depends on whether enough major services treat identification as meaningful.
If only a few services adopt it, the standard won’t create the network-wide effect that TCP/IP did. If many adopt it, then agent identity becomes a de facto requirement for scaling agent activity safely.
Privacy and misuse: the hard trade-offs
Any identity system introduces trade-offs. If agent identities are too detailed, they could enable tracking across sites.