Verified Doesn't Mean Trustworthy: The Gap in Agent Identity

A response to David Christopher's “Who Sent This Bot? The Web Needs an Answer” (Bankless)

---

David Christopher's recent piece on agent identity gets the problem exactly right, and it's the clearest map of the standards race I've read. Websites can't tell a crawler from an agent because, from the server's side, they behave identically. Both load fast, execute JavaScript, follow links. If the distinction can't be inferred from behavior, it has to be carried as something the agent can prove.

He reduces the identity problem to three questions:

Which agent is this? Whose authority is it acting under? Who is liable if it exceeds that authority?

Those are the right three. ERC-8004, World's AgentKit, Proof's x401, Cloudflare's bot verification: each answers one or two, none answers all three, and the delegation layer at the center remains unsolved.

I want to add a fourth question, because I think it's the one that gets skipped, and I spend most of my time staring at the data that answers it:

What has this entity actually done?

Identity is not history

Suppose the standards race resolves tomorrow. Every agent carries a verifiable credential. Every request proves a delegation chain back to a KYC'd human with a legal identity and a liability trail. Christopher's three questions: answered.

You now know exactly who you're transacting with. You still don't know whether you should.

A World-verified agent, backed by a real human with a real legal identity, can be operating a wallet that spent last week draining a lending protocol. The credential is valid. The delegation is real. The human is identifiable and liable. And the wallet is still one you should refuse.

Identity establishes attribution, meaning who to blame afterward. It doesn't establish trustworthiness, meaning whether to transact at all. Those are different questions, answered by different data, and in TradFi we've never confused them. Your bank knows exactly who you are; it still pulls your credit report. KYC and creditworthiness are separate checks because identity and history are separate facts.

Agent commerce is heading toward a stack that has the first one and not the second.

The automation is not the tell

Here's the part that surprised me, and it's the reason I think behavioral data deserves a seat in this conversation rather than a footnote.

I run a wallet-scoring system that reads on-chain behavior: transaction cadence, counterparty structure, funding patterns, protocol history. It produces a trust score without reference to any label or registry. The premise was straightforward. Automated attackers should look different from normal users.

They do. But they don't look different from legitimate automated actors, and that distinction turns out to be everything.

Score a DEX arbitrage bot: high-frequency, scripted, near-zero variance between transactions, funds concentrated across a handful of counterparties. Score an exploit wallet mid-laundering: high-frequency, scripted, near-zero variance, funds concentrated across a handful of counterparties.

Identical fingerprints. One is a seven-year-old market maker doing its job. One just drained a protocol.

If you built a filter on “does this wallet behave like a bot,” you'd flag both, and in an agentic economy, most legitimate participants will be bots. Automation is about to be the baseline, not the anomaly. Any trust system that treats scripted behavior as suspicious will spend its life blocking the customers.

So what actually separated them in my data? Not the automation. What the wallet had touched. The exploit wallet's gas came from a mixer. It had no history with any recognized protocol. Its funds were funneling toward a small number of destinations at speed. The arb bot had years of legitimate protocol interaction and no mixer contact anywhere in its history.

No single one of those signals is sufficient. Plenty of legitimate wallets have concentrated counterparties. Plenty of new wallets have thin protocol history. It's the cluster that no honest operation produces: mixer-funded gas, no legitimate history, funds funneling out fast. And crucially, that cluster is a fact about what the wallet has done, not about how fast it did it.

That's the fourth question. And it's answerable from public data, today, without any identity infrastructure at all.

What this doesn't solve

I want to be precise about the boundary, because the failure mode of this argument is overclaiming.

Behavioral scoring catches a specific class of attack: the automated, mixer-funded, high-volume kind. That class is growing. SlowMist logged 182 security incidents in the first half of 2026, roughly 50% more than the same period last year, and attributed much of the rise to automation lowering the barrier to entry.

It's also the class that leaves the clearest trail, because scaling an attack means touching more things, and every touch is permanent and public.

But it doesn't catch everything, and pretending otherwise would be the same mistake the identity layer makes in reverse.

Flash loan exploits are invisible to it. A single atomic transaction from a wallet with years of clean history. There's no behavioral pattern to detect. The entire attack is one block.

Patient, professional operations are invisible to it. State-sponsored groups don't behave like bots. They behave like careful humans, over years, with aged wallets and buried funding trails. The absence of a fingerprint is the whole point of their tradecraft.

Logic bugs are invisible to it. When an oracle's signature verifier accepts a malformed update, as happened on Hedera recently, the attacker's wallet tells you nothing useful about the vulnerability. The failure was in the contract, not the counterparty.

So behavioral scoring is not a security layer. It's a counterparty risk layer. It answers “should I transact with this address,” not “is my code correct.” Those get conflated constantly and they shouldn't be.

Where this fits

Christopher concludes that the answer will be a mixture of on-chain identifiers and off-chain credentials rather than one winning standard. I think that's right, and I'd argue the mixture needs one more ingredient.

The architectural pattern he highlights from x401 (request the specific proof appropriate to the action) is exactly right, and it extends naturally. Reading a public article needs no identity. Accessing private data needs proof of humanity. Signing a contract needs KYC and delegated authority.

And accepting a payment from a wallet you've never seen needs to know what that wallet has been doing.

Not instead of identity. Alongside it. A verified agent with a clean behavioral history is a different counterparty than a verified agent whose wallet is three days old and funded through a mixer, and no identity credential in the current standards race distinguishes between them, because that's not what identity credentials are for.

The delegation layer is the gap everyone's pointing at. Fine. But when it's solved, we'll have built a system that knows precisely who is stealing from us.

Follow @Kaelai_ on X for updates on KaelAi Shield, new chain integrations, and case studies from the agentic economy.