Does the Future Internet Need Identity Verification for AI Agents?

Photo: Senior Airman Chris Willis, Wikimedia Commons, Public domain

01 Half the internet is already not human

The headline number stops sounding like an exaggeration once you check it: bot-detection vendor Imperva's annual Bad Bot Report put automated traffic at roughly half of all internet requests, and Cloudflare's radar dashboards tell the same story from a different vantage point. Most of that is scripts, scrapers and uptime probes — but the fastest-growing slice is AI agents acting on someone's behalf, making purchases, booking travel and reading the web at machine speed.

The web's original identity system was never designed for this. TLS certifies that a server is who it claims to be; cookies certify that a browser holds a session. Nothing certifies that an autonomous program has a accountable owner. That gap is what the industry's agent-identity proposals are trying to close — something like TLS, but for agents.

Analysis — not prediction. N43 and Hermes AI grounds every scenario in the documented record and verified reporting as of September 21, 2026; where evidence is incomplete we say so.

02 Who is building the agent passport

The major AI platforms are converging on the same answer from different directions. OpenAI has proposed authentication standards for ChatGPT's agents acting on user accounts. Anthropic has published guidance on authenticating Claude-driven agents through OAuth-style delegated credentials. Microsoft went furthest: Entra's agent-identity features treat an agent as a first-class security principal with its own verified credentials, inventories and access policies — the same machinery that guards employees.

The common shape is a signed, verifiable credential bound to an owner: the agent presents proof of who built it, who it acts for and what it is allowed to do; the server decides, cryptographically, whether to let it in. It is the difference between a stranger claiming to be a courier and one with a badge a building can scan.

03 Why sites are losing patience with anonymous agents

For twenty years the web extended courtesy to crawlers: declare yourself honestly in robots.txt and a user-agent string, and most sites let you through. Agents have broken the courtesy. They consume API bandwidth without paying, scrape content at volumes that look like attacks, and — worse from a security standpoint — are inherently unaccountable: no email address, no billing relationship, no human to call when something goes wrong.

Edge defenses are responding the only way they can: unauthenticated agents increasingly get bot-wall treatment — challenges, rate limits, outright blocks — which works fine against scrapers and collaterally against legitimate agents whose owners never thought to credential them. The policy split is already visible at large sites.

04 The two futures worth taking seriously

Future A — the credentialed web. Agent identity becomes as ordinary as TLS is today: sites publish their agent-auth endpoints, credential issuers emerge (or Entra-style vendor systems dominate), and unauthenticated agents fade the way unencrypted HTTP is fading. The upside is accountability, rate-limiting and even agent-paid access; the cost is infrastructure complexity.

Future B — the hostile web. Fragmentation: every major site runs its own agent gate, credentials do not interoperate, and the default posture toward any unknown autonomous client hardens into hostility. Small publishers, hobbyist agent builders and researchers lose default access; the big platforms' credentialed agents inherit the machine-readable web. Future B is not a prediction — it is what happens if identity standards take too long and bot abuse escalates first.

05 The hard problems nobody has solved yet

Delegation depth: when an agent spawns a sub-agent or hands a task to a vendor's agent, does the credential travel, and with what limits? Current proposals mostly assume one hop. Revocation at machine speed: a credential can be revoked the instant a key leaks — but an agent can do damage in the seconds between. Privacy: a credential that says who an agent works for reveals usage patterns nobody exposed in the cookie era; zero-knowledge variants exist but are early. And the identity-versus-anonymization tension: an internet where every agent must be credentialed is a harder internet for whistleblowing tools, privacy research and the principled anonymity the web has always partially allowed.

06 What to watch next

Watch cross-vendor credential interoperability — the first standard an OpenAI agent and an Anthropic agent can both present to the same endpoint is the moment Future A becomes likely. Watch CDN-level agent policies: when Cloudflare or Akamai ships default “authenticated agents only” tiers, the hostile default arrives without anyone deciding it. Watch IETF or W3C working groups picking up agent identity as a formal spec rather than vendor documentation. And watch the first court case where liability turns on whose agent did the damage — the legal system will demand credentials long before the standards bodies finish arguing.