Agent identity week: four days, four answers, and 99.1%

Sources cited in this piece · Proof x401 launch release, 15 Oct 2026, via GlobeNewswire (Manila Times mirror, quoted verbatim) · Chain of Trust demonstration, 14 Oct 2026, GovWare 2026, via PRNewswire and Forkast analysis (Toscale, quoted verbatim) · Vouch Protocol Agent Trust Index, first sweep 19 Oct 2026 (quoted verbatim) · Circle × Proof demonstration, 19 Oct 2026, Money20/20 USA, via CryptoBriefing (quoted verbatim). Secondary reporting labeled as such.

Somewhere between 14 and 19 October 2026, the agent world's question flipped. For two years the industry had asked whether agents could talk to each other — MCP for tools, A2A for agents, both now parked under the Linux Foundation's Agentic AI Foundation. In five days it started asking whether agents can prove anything. Four events, four different answers, one shared blind spot — and one number that frames the whole week: 99.1%.

1. The four answers, in their own words

Chain of Trust (14 October, GovWare 2026, Singapore). GoDaddy, Infoblox, Google and Cloudflare, with Singapore's Infocomm Media Development Authority (IMDA), demonstrated an open reference architecture for agent transactions across independent platforms. The Forkast analysis records the stack it traversed, verbatim: “discovery via DNS-AID, identity through ANS, DNSSEC, and DANE, communication using A2A and MCP, mandate verification via AP2, Passkeys, and SD-JWT, payment processing via UCP, trust indexing, and an append-only audit log using SCITT.” The demo simulated a Madrid-to-Singapore flight purchase across four agents on three clouds, and “successfully blocked rogue scenarios, including a look-alike seller and forged credentials.” Two caveats belong in the same breath: the payment layer ran in Stripe's test mode — “No real capital moved” — and the architecture is offered, in the report's own framing, as a starting point rather than a production-hardened ecosystem.

x401 (15 October, Boston). Proof shipped what its launch release calls a first: “the first company to put verified legal identity and transaction authorization for AI agents into production with the launch of x401, an open protocol that lets any website ask an AI agent to prove who it's acting for and what that person approved.” The mechanism extends the web's existing vocabulary — “x401 protocol extends HTTP 401, the web's standard unauthorized-response mechanism, allowing a website to specify the evidence an AI agent must provide before proceeding” — and the flow is deliberately human-in-the-loop: “The agent carries the request; the person's wallet signs it.” Underneath sits a conventional trust anchor, in the release's own description: each verified person holds an X.509 certificate issued by Proof's WebTrust-audited certificate authority, following a Kantara-certified NIST IAL2 identity-proofing process, bound to a hardware-protected key. The context line matters as much as the launch: it came “weeks after Amazon blocked Muse from its marketplace, exposing a problem every business on the agentic web now faces.” And the business model is per-claim: a website can “pay per claim over x402… so identity can now be metered like bandwidth or compute.”

The Agent Trust Index (19 October). Vouch Protocol's benchmark asks one question of every public agent: “can it cryptographically prove who it is, on whose authority it acts, and that it has not been tampered with?” The first sweep checked 46,303 unique agents from the public MCP registry on 19 October 2026. Result: “99.1% of the 46,303 agents checked cannot present an identity anyone can verify.” The 0.9% that pass — 396 agents — do it with “a resolvable did:web identity”: per the published methodology, a did:web document at the agent's own domain (60 points) carrying a usable public key (40 points). Three agents are post-quantum ready; “Not one carries an ML-DSA key.”

Circle × Proof (19 October, Money20/20 USA, Las Vegas). The demo paired x401 with Circle's payment rail: “an identity-gated purchase. A merchant asks an AI agent for two things: proof of identity and proof of payment.” The agent “responds with an approved credential, using Proof's x401 protocol. That credential is selectively disclosed, so the merchant sees only what it needs to see,” then pays in USDC through Circle's x402 protocol and Agent Wallet. The merchant “receives tamper-evident proof that the payment happened. It does not end up storing the buyer's full personal details.”

2. What all four anchor trust in — and what none of them carries

Read the four answers side by side and a pattern emerges: every one of them rents its trust from an institution. Chain of Trust anchors identity in DNS (ANS, DNSSEC, DANE) and mandates in Passkeys and SD-JWT — the domain system and the platform account system. x401 anchors it in a certificate authority: an X.509 chain from a WebTrust-audited issuer. The Trust Index's own passing bar is institutional in exactly the same way — a did:web document is a document at a domain, resolved through DNS, published by whoever controls the domain. Even the payment leg leans on an existing rail (Stripe's test mode; Circle's USDC settlement). Nothing here is wrong — institutions are how the web has always bootstrapped trust. But notice what the pattern means: in all four designs, the agent's identity is only as good as the institution's say-so, and verifying it means asking the institution (or its registry) over the network.

Two rows of that table are empty in all three shipped designs, and they are the two rows this project exists to fill.

The empty row called freshness. Every answer above verifies a snapshot: this certificate chain is valid, this did:web document resolves, these signed terms match. None of them answers the question that matters to the party relying on the answer — is it still true now? Chain of Trust runs 14 buyer-side and 10 seller-side checks per transaction, which is rigor about the moment of the transaction and silence about every moment after. x401 binds a signature to specific approved terms, which is excellent evidence for a dispute and no statement at all about standing. A did:web document is a static document; the internet's answer to freshness has historically been to re-fetch and hope. In our vocabulary the missing property has a name: standing — the property that a statement is true within a time bound, not merely true when signed. The dual-pillar answer puts a 120-second lease on it, because a fact without an expiry is a fact nobody re-checked.

The empty row called offline. x401 verification checks “the cryptographic signatures and certificate chain” — the chain lives on the network. did:web identity resolves a document — over the network. Chain of Trust's discovery and identity layers are, by design, distributed lookups. All three are sound engineering and all three share a property: verification stops when the network stops. Our own bar is the three offline tests — disconnection, survival, explanation — because a verification procedure that requires permission from a third party to complete is a verification procedure that party can revoke. Local arithmetic, or it is not verification.

One more distinction, because the week's vocabulary invites the confusion: derivation is not identity. A did:web document at a domain is a self-published assertion; the domain's control is the authority behind it, and the document can say anything. A derived address is a different animal: the name is a function of the canonical authority — SHA-256(canonical_authority)[:16], sixteen hex characters, no landlord. The Trust Index's 396 passing agents did something real and worth crediting; they proved control of a name. Proving control of a name is not the same as the name being a consequence of the authority, and the gap between those two sentences is exactly the gap the second pillar was built to measure.

3. Where the dual-pillar answer sits in this week

Our two protocols answer the two questions the week's four projects are, from different angles, circling. RTTP (rttp://) answers where and when: an agent's address is derived, not registered — no DNS-AID lookup rents you a name, no ANS record vouches for you, the address is the hash of the authority itself. IQA (iqa://) answers whether: an attestation envelope carries the statement with an Ed25519 signature, verification is local arithmetic, standing is a 120-second lease with four states (ghost, probation, radiant, genesis), and malformed input fails closed — REJECT is a conclusion, not an exception. Chain of Trust assembled its answer from existing standards and said so; ours is on the standards track too, with rttp:// and iqa:// recorded as IANA provisional schemes (CRI 27 and CRI 28) and the joint addressing draft in IETF ISE review. Different speeds, same question.

The honest scorecard: the industry shipped, in production, in one week, what we have spent two years specifying. Proof's x401 moves real credentials for real assistants today; Chain of Trust blocked a look-alike seller in a live demo; the index put a number on the gap. What the industry has not shipped — the two empty rows — is what our draft is for. And the number that should stay on everyone's desk is the index's: 99.1% of 46,303 agents cannot present an identity anyone can verify. The week the question flipped was the week the answer stopped being optional.

The protocol war answered how agents talk. This week opened the war over who they are. The name tags finally arrived — handcuffed to institutions. The nameplate standards are still being written, and the pen is still in play.