Who Owns This Agent? Tracing AI Agents to Their Owners

Researchers propose and formalize the problem of "agent provenance," that is, associating observed agent behavior with the account that initiated the underlying model calls, and give a protocol based on canary signals. The paper points out that when an autonomously acting agent causes harm, the victim can observe the damage but cannot locate the responsible vendor session or account, creating an accountability gap. In the protocol, an authorizing party embeds selected signals into the content the agent consumes, and then asks the vendor to search session logs associated with the account within a narrow time window. Literal canaries can achieve exact-match attribution when the operator does not deliberately evade detection; against adaptive adversaries, task-relevant semantic canaries, once removed or replaced, also lose information needed to execute the task, creating an asymmetry between utility and evasion. In communication, Web, and cyber agent scenarios, the protocol supports reliable session attribution, resists adaptive transformations, and can scale to actual vendor-side log retrieval.