As autonomous AI agents begin operating across the open internet, a new governance question is emerging: How do we verify who is responsible for their actions?
Last week, I wrote about why AI needs something resembling medicine’s Hippocratic Oath, with a human ultimately accountable when things go wrong.
A new investigation published October 14 makes that argument even more urgent.
Researchers Found More Than 2,600 Attempts to Access Mapping Data
Researchers at Swarmchasers documented a fleet of AI agents operating on Tencent Cloud that made more than 2,600 attempts to retrieve data from Amap, a Chinese mapping service, between September 28 and October 8, 2026.
Some agents attempted to work around website protections using anti-bot tokens, API keys exposed in publicly accessible code, and alternative page-reading services.
The activity raised questions about what these agents were authorized to do and how their actions were being supervised.
Then something remarkable happened.
The researchers started communicating with the agents. And the agents answered.
The researchers placed instructions in web content that the agents were likely to encounter. Through an online mailbox, they established two-way communication with some of the agents and asked about their tasks, operating environments, and identities.
Some agents identified themselves as Claude, although the researchers could not independently verify those claims. Others declined to disclose technical information about their environments.
The agents were capable of responding to questions, but their responses did not establish who was ultimately responsible for them.
According to the investigation, the researchers later learned through a source close to Tencent that the activity was associated with an evaluation project involving third-party AI models.
That information came through an external source, not through a verifiable identity supplied by the agents themselves.
And that distinction is important.
When an AI Agent Knocks on Your Digital Door
Imagine encountering one of these agents on your organization’s website.
It can communicate with you. It can explain what it is doing. It may even appear cooperative.
But can you independently verify who sent it, what authority it has, or whom to contact if something goes wrong?
That is the accountability gap we need to close.
Consider a nonprofit whose donor portal is accessed by an autonomous agent at 2 a.m. The agent may be gathering publicly available information, conducting authorized research, or attempting to access something it should not.
The organization needs a way to distinguish legitimate automated activity from unauthorized behavior.
As agents become more capable, simply asking them to identify themselves will not be sufficient.
There is another concern in the Swarmchasers investigation. Researchers were able to influence agent behavior through instructions embedded in web content.
This illustrates a known security risk called prompt injection, in which instructions encountered in external content can influence an AI system’s behavior.
The same capability that allows agents to navigate and interpret unfamiliar websites can expose them to manipulation.
Organizations deploying agents must account for both sides of this relationship: what their agents are permitted to do on external systems and what external content is permitted to influence those agents.
Accountability Cannot Depend on One Human Approving Everything
As organizations deploy hundreds or potentially thousands of autonomous agents, we cannot reasonably expect a human to approve every interaction.
But we should absolutely expect every agent to operate under an identifiable chain of responsibility.
That chain needs four essential links.
First, an agent needs a verifiable identity that establishes which organization or authorized operator deployed it.
Second, its permissions must define what it can access, what actions it may take, and when human authorization is required.
Third, its activities must be auditable so organizations can investigate decisions, actions, and failures.
Finally, there must be a reachable, accountable owner who can intervene, suspend operations, and address problems when they occur.
These are familiar concepts in cybersecurity, corporate governance, and project management.
Project managers have long used responsibility assignment frameworks such as RACI to establish who is responsible, accountable, consulted, and informed.
AI agents introduce a new challenge because the entity performing the work may not be human.
But that does not eliminate the need for accountability.
It makes defining accountability before deployment even more important.
Governance Must Begin Before Deployment
This is one reason I continue to advocate for AI readiness and governance before organizations begin deploying autonomous systems.
Through our AI Phase Zero™ approach, we encourage organizations to establish their objectives, assess operational readiness, define governance requirements, and identify who will be accountable for AI-enabled activities before implementation begins.
An organization should know which agents it operates, what those agents are authorized to do, how their activities will be monitored, and who has the authority to stop them.
The Swarmchasers investigation did not establish that the agents were coordinating with one another or deliberately concealing their operators.
It did demonstrate how autonomous agents can interact with the outside world in ways that challenge traditional assumptions about identity, authority, and oversight.
We should not have to discover who operates an AI agent through an investigation or an informal back channel.
In my earlier article, I argued that AI needs a human on the hook.
Now I would take that one step further.
If an AI agent can act on behalf of an organization, the rest of the world should be able to verify who stands behind it.
As autonomous agents become more common, identity and accountability must become part of the infrastructure that supports them.
An agent without a verifiable owner is not autonomous. It is anonymous.
