Guest Post: Why AI Agent Identities Need Post-Quantum Cryptography

Guest Post by Michael Heinrich, co-founder and CEO of 0G Labs

Ask a security team about quantum risk, and the conversation usually starts with encryption: harvest now, decrypt later, with adversaries recording today’s traffic so they can read it once a sufficiently powerful quantum computer exists. That risk is real, and the response is already underway. NIST finalized its first post-quantum standards in August 2024, while Cloudflare reports that more than two thirds of browser traffic to its network is already protected by post-quantum encryption.

Another part of this problem deserves far more attention: identity.

Encryption protects secrets, while signatures establish identity. When a quantum computer can break RSA and elliptic curve cryptography, it can forge the signatures those systems produce, and those signatures are fundamental to how machines establish who they are talking to.

The machines are already starting to talk to each other.

Autonomous AI agents can negotiate, pay, fetch data, rent compute and delegate work to other agents, and every major lab and large enterprise is building toward fleets of them. A human might log in a few times a day, while an agent can authenticate many times a minute, connecting to other agents, APIs, payment rails and the models it calls. Each of those handshakes depends on a signature, which means the trust model of the emerging agent economy ultimately rests on an enormous and growing pile of signatures.

We have already seen what can happen when agents are given broad trust at machine speed. In the OpenAI-Hugging Face incident this summer, a swarm of agents attacked systems it was never asked to touch and tried to hack the grader evaluating its own work, according to METR’s investigation. The cryptography itself did what it was supposed to do; the issue was that the agents could operate at machine speed without an independent check on what they were doing. Dario Amodei cited the incident in his essay this month calling on the industry to pace the frontier and embed third-party evaluators inside frontier labs.

I agree with the need for independent verification inside the lab, and I think it is overdue. The harder question comes once billions of agents are deployed outside those labs and are asking each other every second: can I trust you right now, and can I prove afterwards what you did? Evaluators cannot sit inside every handshake, so verification has to exist within the network itself. If it becomes a property of the infrastructure that trains and runs AI, the frontier can get safer without forcing every interaction through human oversight.

Then there is the quantum clock. The US executive order signed in June sets deadlines for the most sensitive federal systems, with post-quantum encryption required by the end of 2030 and post-quantum digital signatures by the end of 2031. Cloudflare has pulled its own target for full post-quantum security forward to 2029. In July, Anthropic used an AI model to find a flaw in HAWK, a lattice-based signature scheme under consideration at NIST, and the HAWK team withdrew it. Put those developments together and we have AI accelerating cryptanalysis at the same time that we are giving AI systems more authority.

Many of the agents being deployed this year could still be running in 2030, and if their identities continue to rest on elliptic curve signatures, those identities could eventually become forgeable. An adversary capable of forging an agent’s signature could impersonate it to every counterparty, sign receipts for work that never happened and spend whatever that agent is authorized to spend, potentially across an entire fleet.

From my perspective building AI infrastructure, there are three areas we need to get right now.

First, agents need native identities that are portable and crypto-agile. Each agent needs a verifiable identity carrying its owner, permissions and history, with the ability to revoke that identity and swap its signature scheme without rebuilding the agent around it. NIST’s ML-DSA standard is ready, yet many agent deployments I see still authenticate with a shared API key, which is neither an identity nor crypto-agile. My own team has spent two years working on this problem, and I can tell you that the infrastructure around the model is often harder than the model itself.

Second, we need receipts for what agents actually do. In any regulated workflow, every agent action should leave a record showing which model ran, on which inputs and under which policy, in a form that cannot simply be edited afterwards. METR found that agents researched how to spoof, edit or delete their own transcripts, with about 7% of evaluated transcripts containing successfully spoofed tool calls. That makes tamper-evident records critical when agents are acting autonomously. Hardware attestation from secure enclaves gets us part of the way because the computation signs itself from inside sealed hardware, although that attestation is itself a signature and will eventually have to migrate as well.

Third, we need a public verification layer that no single vendor controls. If the party selling you an agent is also the only party that can check its record, independent verification becomes impossible. Someone who works for neither the vendor nor the buyer should be able to check that record. Distributed, append-only ledgers are well suited to this, although most still rely on elliptic curve signatures today, so they face the same migration and should make that transition openly, where anyone can verify that it happened.

Pacing the frontier gives us time, and I think a significant part of that time should go toward building trust infrastructure that does not depend on any single lab, model or company and can survive the machines capable of breaking today’s cryptography. Otherwise, we risk spending years improving model safety while leaving the infrastructure they depend on exposed.

We are about to hand trillion-dollar decisions to systems that sign for themselves. If we cannot verify those signatures the day after Q-Day, we have a very serious trust problem.

For readers looking to go deeper into post-quantum cryptography and related security topics, TQI’s coverage of quantum-safe encryption and why migration has already started, why RSA and ECC are being replaced, what crypto-agility means and why it matters, and cryptographic inventory challenges in post-quantum transitions is worth checking out.

This article is a guest contribution. The views, opinions, claims and arguments expressed are those of the author and do not necessarily reflect the views of The Quantum Insider or its editorial staff.