The views expressed in this article are those of the author and do not necessarily reflect the position of CoinGeek.
TL;DR: After a September 30 Senate hearing on rogue AI, Senators Hawley and Murphy announced the AI Agent Accountability Act, which would apply Computer Fraud and Abuse Act liability to operators and developers of reckless AI agents. Enforcing it requires knowing which agent acted and who stands behind it, which API keys can’t show. Signed agent identities anchored on a public ledger, like Sigma Auth’s Know Your Agent model, can.
Key Takeaways:
On September 30, a Senate subcommittee gathered in room SD-342 of the Dirksen Senate Office Building for a hearing called “Rogue AI: Securing the Homeland Against AI Agent Attacks.” Five witnesses took the table, and the man Senator Josh Hawley most wanted to hear from was not one of them.
Hawley said he had invited OpenAI CEO Sam Altman, who declined. According to Allison Mollenkamp’s report in Roll Call, OpenAI said it received the invitation on Friday, and its spokesperson offered this instead: “OpenAI is deeply engaged with Congress on federal policies to advance AI safety.”
Deeply engaged, from a different zip code…
Hawley didn’t need Altman to make his point, because “At the end of the day, they’re a product,” he said, and when a product built “in a reckless kind of way” crashes a hospital ER or shuts down a bank, “it’s the people who made it who should be responsible.”
The next day, Hawley (R-Mo.) and Sen. Chris Murphy (D-Conn.) announced the bipartisan AI Agent Accountability Act.
This bill is a liability regime in search of a defendant. Every provision assumes somebody can say which agent did the damage, whose key it ran under, and who built it, and the internet, as currently plumbed, cannot answer a single one of those questions, so whether its sponsors know it or not, Washington just wrote a job posting for Know Your Agent.
And the job is already filled, on Bitcoin, of all places.
Which agent, though?
I’m working from Hawley’s press release, because the bill text isn’t in front of me yet, and per the release, the Act does three things.
Operators who knowingly run an AI agent that recklessly causes hacking damage or loss could face criminal and civil liability under the Computer Fraud and Abuse Act, the federal anti-hacking law. Developers could face the same if they failed to put reasonable safeguards in place when they knew, or had reason to know, what their agent could do. And the U.S. Attorney General and state attorneys general could sue to block operators and developers from committing, conspiring to commit, or attempting those offenses.
Fine. But with agentic software development, and autonomous agents able to act in the real world, there’s a nuance wrapped in a vaguery that really shouldn’t be left open to case law, in my opinion: Which operator? Which developer, of which build? Block whom, exactly? And do you want gray-haired Supreme Court Justices to decide?
On today’s internet, an agent is an API key and a display name, and Sigma Identity’s own explainer puts the API key problem better than I can: a key “proves that whoever holds it was given it at some point. It does not prove who holds it now.” Keys get pasted into logs, config files, and public repositories, and a display name is just a string, so I could name my agent “Senator Hawley” in about four seconds and nothing would stop me. But is the Senator liable for actions taken by the agent I named after him?
I think not!
So the prosecutor walks into court with a crashed hospital system, an angry attorney general, and a log file that the attacker called itself “helpful-assistant-7” or perhaps “Senator Hawley,” with no other leads to work from.
Not exactly a clean chain of custody.
Enter the witnesses
The witnesses described the missing piece almost exactly and never once called it a ledger.
Marius Hobbhahn, CEO of Apollo Research, recommended built-in evaluations as a requirement during development and urged Congress to preserve agents’ “chain of thought” so their actions and reasoning can be tracked, tracked by whom, and stored where? A log sitting on the operator’s own server is a diary, and diaries get edited the night before the deposition, especially when “super intelligence” is involved in protecting itself.
A record worth anything in court has to be signed by the thing that acted, timestamped by something other than the defendant, and impossible to quietly rewrite afterward, which is a description of a public blockchain doing what it was designed to do. Sigma Auth, to be precise about my own company’s product, does not store an agent’s reasoning. It anchors who the agent is and signs what it does, which is the half of Hobbhahn’s trail that answers “who” and “when.”
Paul Ohm of Georgetown Law went further, urging strict liability for AI developers because criminal-intent requirements were written for human perpetrators. “The genius of the centuries-old common law system is that it is flexible and adaptable enough,” he said. I like Ohm’s instinct, but you cannot even reach the intent question until you can attribute the act, and strict liability without attribution means a developer eats the damage for every fork and every stolen key on earth, which is less accountability than a lottery with a federal prosecutor holding the tickets.
Then Sen. Andy Kim (D-N.J.), the subcommittee’s top Democrat, said, “This is not going to be something that we can just base on voluntary commitments from these different companies.”
Agreed, Senator. Everywhere else that mattered, “trust us” eventually became “sign here,” and agents should be no different.
I co-founded Open Protocol Labs, which builds Sigma Auth, so weigh my enthusiasm accordingly, but these Senators are asking for the product we built, and we built it knowing these asks would come soon.
Well, they’re here as of two weeks ago:
The mechanics below come from Sigma’s own Know Your Agent explainer.
The agent holds a key pair generated on the machine that will act, and the private key never travels. Its public identity is published via BAP (the Bitcoin Attestation Protocol), with the attestation hashes anchored on BSV rather than stored in a vendor’s database. Every request is signed with a specific key. Hence, a captured signature is useless for a different one, and anyone can verify it against the published public key without calling home to anyone.
Humans get the same model, since a person’s BAP identity signs in to apps through OAuth 2.1 and OpenID Connect, and existing clients keep working.
On top of the identity sit the claims: Sigma can issue BRC-52 credentials (verified email, phone, domain, GitHub, organization membership, a BAP wallet binding, a BRC-169 handle, provider assurance, among others), and a standard BRC-100 wallet can acquire and prove them. A service can gate what an agent may do by NFT ownership, a token balance, or a BAP allowlist; delegations are wallet-signed, so “this agent acts for this organization” is a signature and not a press release, and the server, per its own README, exposes agent capabilities “without ever signing on a user’s behalf.”
Sigma says plainly that Know Your Agent is not a standard: “It is a name for a problem, the way ‘zero trust’ was a name for a problem before anyone shipped a product.” It also does not unmask the human behind an agent by default, because binding to a legal person is a separate choice the operator makes, and the one-line version is theirs: “KYC answers who the customer is. KYA answers what the software is, and who stands behind it.”
Who stands behind it? That is Hawley’s whole bill.
But isn’t this just more regulation?
Sen. Rick Scott (R-Fla.), in the same room, warned that “the Chinese Communist Party wants to destroy our way of life” and that “we’ve got to continue to be competitive with AI.” Sen. Joni Ernst (R-Iowa) added, “What we don’t want to do is fall behind China.” President Trump has called the industry’s own safety commitment “morally binding,” saying that through the FBI and the Department of Justice (DoJ), “We automatically have regulation,” a position most of the Republicans on the subcommittee echoed.
I am not in the habit of cheering for new federal liability. But identity is plumbing, not regulation, and nobody has to pass a law for a keypair. The market builds plumbing when the liability is real, and Hawley said as much himself: “With this liability regime in place, AI companies will have every incentive to keep their products safe.”
The cheapest way to prove you were not the reckless operator is to prove which operator you were, so picture Ohm’s strict-liability courtroom: the developer who can show a signed attestation chain from the agent they shipped, and a signed record of what it did, walks out, and the one running a fleet of agents on a shared API key stays.
China doesn’t win that race. Sloppy operators lose it, which is how it should be.
So here’s my prescription, for builders and for the staffers drafting the text. Give each agent its own key and publish its identity on a ledger that the operator does not control. Sign every action, so the record is attributable, timestamped, and tamper-evident. Gate what an agent is allowed to touch on attested claims, never on a name.
Do that, and the Accountability Act finally has a defendant, Hobbhahn gets his trail, Ohm gets his attribution, and Kim gets something sturdier than a promise.
Washington is asking who stands behind the agent.
On Bitcoin, the agent can already sign its answer.
FAQs:
What is the AI Agent Accountability Act?
A bipartisan bill from Sens. Hawley and Murphy was announced on October 1. It applies the Computer Fraud and Abuse Act liability to operators and developers whose AI agents recklessly cause hacking damage.
Who is liable under the AI Agent Accountability Act?
Operators who knowingly run reckless agents, and developers who lack reasonable safeguards despite knowing what their agent could do. This is per the press release, not the full bill text.
What was the Rogue AI Senate hearing?
A September 30 Senate subcommittee hearing with five witnesses. Sen. Hawley said OpenAI CEO Sam Altman was invited and declined.
What is Know Your Agent (KYA)?
A name for the problem of verifying what an AI agent is and who stands behind it. It is not yet a formal standard.
Why aren’t API keys enough to identify an AI agent?
A key only proves someone was given it, not who holds it now. Keys leak, and display names are editable text.
How does Sigma Auth identify AI agents?
Each agent generates its own keypair. Its identity is published through the Bitcoin Attestation Protocol (BAP) on BSV, and every request is signed and publicly verifiable.
Does Know Your Agent reveal the human behind an agent?
Not by default. Linking an agent to a legal person is a separate choice made by the operator.
This opinion piece is published to encourage discussion. The author’s views are their own and do not constitute legal, procurement, or policy advice, nor do they represent the positions of CoinGeek or its partners.
Watch | Blockchain + AI: Unlocking Web3’s Future
Be the first to comment