Proving Humanity

Introduction

The way I use the internet has been changing dramatically over the last year.

I’m using Google search significantly less and my “browsing” has been increasingly routed through AI agents. My agent buys my dog’s food, lets me know when I receive important emails, tracks my packages (and tells me they’ve been delivered before my building’s package system notifies me), and keeps me up to date on markets and news without having to open X or media websites each morning.

As a result, I am interacting with webpages, online shops, and inboxes far less often than in the past. Instead, my agents are acting on my behalf. This is also increasingly the case for many of my friends (both crypto-native and not). People are starting to “use the internet” less, and where there would otherwise be three real humans clicking through webpages, there are now a hundred agents, for example, scattered around for numerous specialized tasks.

How are websites and “the internet” broadly going to compensate for this shift? For most of the internet’s history, bots were something sites worked to keep out. They usually arrived at the site’s expense, and their rigidity made them easy to spot. Agents complicate both halves of that equation. A growing share of agentic traffic comes from people acting through software, and blocking it means blocking those people. At the same time, agents produce conduct that looks increasingly like a human’s, which makes detection harder and makes it easier for a malicious operator to pass as many separate individuals.

The purpose of proving humanity is no longer chiefly to keep machines out. It is to make sure every machine leads back to someone.

This points to a question the internet has never had to answer: not “is this a machine?” but “is a real person behind it, and are they only counted once?” Agents are beginning to identify themselves, and early efforts to link agents to verified people are emerging. But no widely adopted standard yet establishes that a person stands behind an agent, or that one person isn’t posing as thousands.

The following argues that as agents become a primary interface to the internet, the web will need a way to show that a distinct person stands behind an agent, and that it should do so without revealing who that person is. Several projects are trying to solve proof of humanity, but we will describe or evaluate none of them here. The point of this report is to show why the problem is becoming urgent.

Defining the Problem

For most of its history, the internet had no formal verification system for humans. CAPTCHAs have been used to verify an operator is human, but they do so by identifying gaps between what machines and humans can do. Quantitative and other technical approaches to machine detection have also been used, where things like rate limiting, timing patterns, and fingerprinting are applied to identify and block unwanted or malicious machine traffic. These measures worked because designing humanlike machines was costly at scale.

This assumption is faltering in the age of agents. Agents can replicate human behavior instead of simply imitating it, and a growing share of them are acting legitimately on humans’ behalf. This pivots the question of “bot” detection from “is this a human?” to “is a real person behind this agent?”

From Bots to Agents: A Shift in Capability and Intention

The internet has long assumed a human is present without formally verifying it. Limits in machine capability made that assumption acceptable. Automation could be convincing or plentiful, but rarely both. A program that acted like a human was costly to build, both technically and financially, so these programs stayed scarce. Cheap automation was plentiful, but it gave itself away through its speed, its repetition, and its inability to cope with anything unexpected.

That latter kind is what “bot” still means to most people: a script that carries out a fixed sequence of actions, like posting the same message repeatedly or refreshing a page at set intervals. However complex its branching, a script can do only what its author anticipated. Its decisions are made in advance, and that rigidity is what made it easier to detect. This is also a point we made in reference to agents acting on users’ behalf in DeFi.

Generative AI has been weakening the limit on content and communication. In a 2025 Turing test, judges picked GPT-4.5 as the human 73% of the time when it was prompted to adopt a humanlike persona, more often than they picked the actual human participants. A 2024 meta-analysis found that people identify deepfakes only a little better than chance.

Agents extend this breakthrough to behavior. Where a script follows instructions, an agent pursues a goal. It is told what to accomplish, not how, and it works out the steps as it sees best fit. It can read pages it has never seen, decide what to click, adjust when something fails, and continue until the task is done. The real difference is when, and by whom, decisions are made. In a script, the decisions are fixed upfront by its author, while an agent makes decisions in the moment, in response to the world presented to it. That responsiveness is precisely the quality that used to be treated as evidence of humanness.

Blocking an agent increasingly means blocking the person it serves. The question that matters is shifting from “is this a machine?” to “is a real person behind it, and are they answerable for what it does?”

The shift shows up along several dimensions at once. Agents can sustain extended conversations, keeping a consistent voice and memory instead of falling apart after a few turns. They can carry out long chains of action through interfaces designed for human hands and eyes. They can transact – purchasing, booking, and committing – on someone’s behalf, so their actions carry economic and legal consequences, not just informational ones. And they can do all of this without a human approving each step.

These capabilities are also not experimental. To name a few: In February, Nous Research released Hermes, an open-source agent that browses the web, writes and runs code, remembers what it learns, hones skills from use, and reports back through messaging apps like Telegram and Slack, all on its owner’s hardware. More recently, in August xAI released Grok Bot, a consortium of always-on agents with their own computers that work inside tools and apps just as human users do. In September, Meta launched Muse, an agent that sends emails, books travel, completes forms, and makes purchases. Weeks later, OpenAI launched dots, always-on agents that run in the background on cloud computers and connect to more than 4,000 apps. The old bot imitated the outputs of human activity. The agent reproduces the activity itself, on a person’s behalf.

What makes this more than a technical shift is who the agents are working for. People are increasingly using agents to handle their day-to-day tasks, like buying groceries, booking trips, monitoring email, and reading and summarizing websites. As that setup becomes routine, a growing share of the activity on the web will be a person acting through software, not a person at a keyboard, and the line between what a human did and what a machine executed on their behalf becomes blurry. Most of these people are ordinary users letting agents do what they would otherwise do themselves, not the adversary that machine detection was built to stop.

Machine-made content and machine-driven behavior can still be caught in many settings. But the constraints that once kept convincing automation scarce, cost and detectability, are weakening together. At the same time, more of that automation is acting with a person’s authority, not against them. Detection assumed that a non-human visitor was an intruder, usually at the site’s expense. That assumption is breaking on both ends where machines are harder to spot, and the ones that are spotted are increasingly likely to be someone’s legitimate representative.

The Diminishing Gap

The CAPTCHA’s history highlights how the gap between machine and human capability has been progressively diminishing, because each iteration of it was a function of failures in prior versions. Its full name, the Completely Automated Public Turing test to tell Computers and Humans Apart, offers a view into this. Alan Turing’s original thought experiment asked whether a machine could pass as human to a human evaluator. The CAPTCHA flips this on its head where a machine becomes the judge humans must convince. Given this, CAPTCHAs never proved that a human was behind an action. They verified a gap in machine ability and treated passing the test as evidence of humanity. First generation CAPTCHAs prompted people to demonstrate abilities, like reading distorted text and identifying traffic lights in images. These tests assumed that perception was where the gap between humans and machines was. That assumption eroded over roughly a decade, as machine-learning models learned to read distorted text and, later, to classify images. A 2024 study from ETH Zurich showed that an off-the-shelf object-detection model could solve every reCAPTCHAv2 image challenge, confirming the trend. The more revealing finding was that the tests for humanness weren’t solely tied to identifying the images. Rather, reCAPTCHAv2 appeared to lean on cookies and browsing history to judge whether a user was human. To some extent the perception puzzle was theater, while additional checks were happening elsewhere.

Alan Turing’s thought experiment asked whether a machine could pass as human to a human evaluator. CAPTCHAs made the machine the judge a human must convince.

The “elsewhere” was a strategic response to the failure of previous generations of CAPTCHAs, and had become the primary fix to the problem. Instead of solely asking users to prove abilities, they began observing user behavior. Google released reCAPTCHAv3 in 2018, which scored website viewers in the background (Cloudflare’s Turnstile followed a similar logic), analyzing behavioral topography rather than presenting puzzles. The philosophical takeaway is that the test stopped asking what a person can do and started observing how humans do things: the drift of a cursor, the rhythm of navigation, the texture of an ordinary browsing history. Proving humanity was no longer a demonstrative exercise and was instead read from conduct.

The issue now is that conduct is what agents reproduce. This became evident in July 2025 when users noticed that OpenAI’s ChatGPT Agent, which operates its own browser to complete tasks, clicked through Cloudflare’s “I am not a robot” checkbox without triggering subsequent checks. Turnstile reads behavior and environmental signals. The agent passed the check because its behavior and environment appeared human to the system. One checkbox passing is a possible anecdote, and not absolute proof. But it highlights a structural weakness in tests built on behavioral signals in that they lose reliability as agents produce behavior that increasingly looks human, and the test has no independent signal to fall back on.

The takeaway here isn’t that CAPTCHAs are bad or poorly designed. Every iteration was a fair response to a moment, each identifying humanity in a gap: first in perception, then in behavior. The problem is that gaps of this kind are local, and specialized bots were only able to exploit them one by one. Agents, however, are general and don’t take advantage of a specific weakness in a specific test. They increasingly do what people do, and they leave less and less of a gap for a test to flag. Detection will keep catching some machine behavior, but it is a strategy built for an adversary with fixed limitations, and it offers diminishing returns against one whose limitations keep receding.

Not all Agents Are Adversarial

One final facet of this shift complicates everything that follows. A growing share of agent activity is likely to not be adversarial at all. The agent that clicked through Cloudflare’s checkbox was converting a video for the person who asked it to. The Muse agent I sent to Chewy for dog food was acting on my behalf for something I historically did myself. Automated traffic now makes up a majority of requests on some networks, and agent-driven traffic is the fastest-growing part of it. Much of that traffic is still crawlers and malicious bots, and no one yet knows what share is legitimate delegation. But the share is growing, and any detection regime has to assume it is not zero. This means the old goal of detection, keeping machines out, is no longer merely difficult but often wrong. Blocking an agent increasingly means blocking the person it serves. The question that matters is shifting from “is this a machine?” to “is a real person behind it, and are they answerable for what it does?”

The Delegation Problem

Every system for telling humans and machines apart has rested on a simple sorting rule: humans in, machines out. The rule was crude but coherent, because for most of the internet's history the two categories mapped cleanly onto two kinds of intent. A person visiting a site was presumed to be there for their own purposes. A machine pretending to be a person was presumed to be there for someone else's, usually at the site's expense. Detection could be binary because the moral question was more or less binary. To catch a machine was to catch maliciousness.

Agents break this rule, and not because they are better at deceiving. They break it because a growing share of them are not deceiving anyone. An agent that books a flight, files a form, or compares prices on behalf of the person who asked it to is honestly non-human and entirely legitimate. It is the user, acting through software. Excluding it means excluding the person behind it.

A principal does not need to be named to be real. What a counterparty needs at the moment of action is assurance that a distinct person stands behind the agent. A name matters only if things go wrong.

This tension is already playing out. Shortly after Muse launched, Amazon blocked it from shopping on its site, objecting in part that the agent did not disclose it was an AI while browsing, as Amazon's rules require. This is the situation older bot detection rarely had to confront: an entity that is plainly a machine and yet has every right to be present, because it stands in for someone who does.

The question "is this a human?" stops being the right question. What matters is whether a real person stands behind the machine.

An Old Concept, a New Kind of Agent

The concept of delegation itself is not new. People have always acted through others (e.g. a lawyer signing on a client's behalf, an assistant answering correspondence, a broker executing trades). Law has a mature vocabulary for this. In the law of agency, a principal authorizes an agent to act, and the principal is bound by what the agent does within that authority. The law also distinguishes cases by how much the other party knows. A principal may be disclosed, where the counterparty knows both that an agent is acting and for whom; unidentified, where the counterparty knows an agent is acting but not for whom; or undisclosed, where the counterparty has no notice that the agent is acting for anyone. These categories exist because what the counterparty knows about the other side of a transaction determines who is responsible when something goes wrong. The law tolerates a principal who goes unnamed, partly because the agent in the middle can usually be held liable. An AI agent cannot be, so something else has to do that work. At minimum, a counterparty needs assurance that a real person stands behind the agent and cannot simply start over.

What is new is the nature of the agent. Human delegation always involved two accountable people. If an assistant misrepresented their employer, the assistant could be questioned, sued, or fired; the chain of responsibility ran through someone at every link. An AI agent is a link that cannot answer for itself. It holds no legal personhood and cannot be held accountable. It can be copied without limit and run at a speed no human intermediary could match. When the agent is a person, delegation spreads responsibility across two parties. When the agent is software, responsibility may rest mainly on the person using it or other parties involved in its development/operation, depending on the circumstances and applicable law.

Delegation to machines therefore concentrates much of the burden of accountability on a question human delegation never had to settle: is there a person at the end of the chain, and can a counterparty tell that there is? This idea is one we discussed in February. Though the conversation was largely hypothetical, we highlighted that the capability of AI was nearing a point where questions need to be asked around the principal-agent dichotomy relative to AI agents. The abilities of agents and access to easy-to-use agentic products have grown precipitously since then, making this idea increasingly relevant and one that should start to be answered.

Existing Solutions and Their Limits

There are some solutions to this problem, but they are limited. Cloudflare's Web Bot Auth lets an agent sign its requests cryptographically so that websites can verify where it comes from, replacing identification by user-agent strings and IP addresses, both of which can be spoofed. Cloudflare has since created a category of "signed agents," defined as agents generally directed by an end user rather than by a single company, whose hosting platform signs their requests. This is progress, because it lets an honest machine declare itself. But notice what the signature attests to. It identifies the platform operating the agent, not the person directing it. A request signed by a major AI provider tells a website which company's software is knocking, not which of that company's millions of users sent it. In the vocabulary of agency law, this is delegation with an unidentified principal, which the law tolerates. The machine is disclosed, and the person behind it need not be named. What the signature does not establish is that there is a person at all, or that it isn’t the same person behind a thousand others. Services will increasingly ask two questions of every agent: which agent is this, and is a real, distinct person behind it? Signatures answer the first question, but they leave the latter open.

Payments protocols go further, because money forces the question. Google's Agent Payments Protocol (AP2), announced in 2025, is built around "mandates," or cryptographically signed records of a user's instructions that serve as tamper-evident proof of what the user authorized. An intent mandate captures the user's request and its limits; a cart mandate records approval of a specific purchase; together they form an auditable chain from instruction to checkout. The protocol even distinguishes transactions where the user is present from those where an agent acts later, without the user online, within rules the user signed in advance. AP2 is, in effect, an attempt to build the law of agency into software: a record of what the principal authorized and whether the agent stayed within it. Yet it too stops one step short. A mandate proves that an account holder's key signed an instruction. It does not prove that the account holder is a person, or a different person from the holders of 10,000 other accounts. The chain of accountability is traced all the way back to a key, and then it ends.

None of this means delegated actions are untraceable. Platforms that host agents keep records of which account directed which agent, and those records can be retrieved in a dispute or through a legal process. But this kind of accountability is private, after the fact, and dependent on an intermediary's records and cooperation. It does not help a counterparty decide, at the moment an agent acts, whether to trust it. It ties actions to an account rather than to a person, so it cannot tell one person from 1,000 accounts. And it disappears when an agent runs on its owner's hardware, with no platform in between. The question is not whether a tether exists somewhere, but whether the party on the other side can verify, at the moment the agent acts, that a person stands behind it.

What Proving Humanity Is For

Taken together, these cases suggest a reframing. The purpose of proving humanity is no longer chiefly to keep machines out. It is to make sure every machine leads back to someone. A person might reasonably run thousands of agents, and those agents might create more of their own. What matters is that however long or branched out the chain becomes, it ends in a person, and that many agents are never mistaken for many people. A proof of personhood is the end of that chain and is the point where “this agent acts for this account” becomes “this agent acts for a person, and that person counts once.”

Anchoring agents to a verified person does two things that agent signatures and mandates cannot do alone. First, it ties the number of parties to the number of people. However many agents exist, they cannot manufacture additional principals, so a count of participants means what it claims. Second, it makes someone answerable. When an agent causes harm, a responsible person exists to be sanctioned, limited, or, where the law requires, identified, instead of an account that can be abandoned and recreated.

The principal does not need to be named to be real. What a counterparty needs at the moment of action is assurance that a distinct person stands behind the agent. A name matters only if things go wrong, and then only to the institutions with a legitimate claim to it.

The AI Safety Bifurcation

"AI safety" covers two different families of problems, and proof of humanity bears on only one of them.

The first family is technical: building AI systems that reliably do what their designers intend, which is also referred to as “alignment.” It includes models that pursue the wrong objective, deceive their overseers, or give meaningful help to someone building a weapon. These are problems inside the system, and proof of humanity does nothing to solve them. A misaligned model doesn't need to pass as a person to cause harm, and a dangerous capability is no less dangerous for being requested by a verified human. Alignment receives most of the field's attention and sits at the center of much public fear about the technology.

The second family concerns what AI capability does to the world around it, and specifically to institutions that depend on knowing who is acting, at least knowing a verified person is acting. This is the safety concern proving humanity centers on.

Counting People

Much of social and economic life is counted in people. A vote matters because it stands for one person. A petition matters because of how many signed it. A benefit or a free trial is offered once per person. Reviews, trending topics, and public opinion are all effectively headcounts. These signals have value because people are scarce.

The capability shift described in the previous sections weakens that scarcity. When an agent can write, converse, and act like a person, and can be copied without limit, a person becomes something that can be produced cheaply. The effect resembles counterfeiting, though the analogy is imperfect, because voices are not interchangeable like money. What the two share is a value that depends on scarcity. Once fakes can be produced at will, every genuine instance is worth less. It matters most where a count is the rule, as in one-per-person allocations such as benefits, token distributions, and ticket sales, and in public consultations that treat the number of distinct voices as evidence. It also affects reviews, polls, and trending topics, though these can sometimes rely on reputation and quality weighting rather than strict uniqueness. What has kept these attacks in check is the cost of making each fake convincing. Agents are steadily lowering that cost.

The harm is not limited to the fakes that get through. Once counterfeits are known to circulate, every count becomes suspect, including the honest ones. A shopper who knows reviews can be faked discounts all of them. A platform that knows its polls can be stuffed stops trusting its polls. The signal loses value for everyone, whether or not any particular fake is present. The same suspicion also creates a new tactic where real people are dismissed as fake. The legal scholars Robert Chesney and Danielle Citron call this the liar's dividend: once fabrication is plausible, authentic evidence can be denied. When persons can be counterfeited, a genuine movement, a wave of valid complaints, or a real crowd can be waved away as bots. What erodes is a society's ability to know how many of its members actually want or believe something, which undermines epistemic security.

Who is posing as a fake person?

Within this frame, proof of humanity does one thing precisely: it restores the scarcity of persons, so that a count means what it claims. It bounds how many parties can act, not what any of them does, and it says nothing about whether a verified person is telling the truth. It is simply infrastructure for a world in which machines can now produce “people.”

Importance of Proving Humanity

The first part of this paper described what has changed. This next section asks who pays for it. Three kinds of harm follow, and they share a common root where persons can now be manufactured, and agents can act with no verifiable person behind them. Institutions that give each person one share of something lose the ability to enforce that allocation. Anyone dealing with an agent loses someone to hold answerable. And the public loses a reliable picture of what people actually believe.

One Person, One Share

Many systems define fairness in terms of persons. A benefits program pays each eligible person once, a token distribution allots one share per participant, and a ticket sale caps each buyer at four seats. Online, these rules have been enforced less by verification than by effort. Uniqueness is checked through cheap proxies such as an email address, phone number, or payment card, and what stopped abuse was the labor of making each additional claimant plausible. That labor left patterns defenses could catch: New York’s Attorney General documented one broker buying more than 1,000 U2 tickets in a single minute in violation of the four-ticket limit.

Most of these systems don’t need to know who a participant is, only that they haven’t claimed before, which is why proof of personhood fits: each person counted once, however many agents act for them.

Agents remove that constraint. An agent can open accounts, complete applications, and maintain each identity over time, giving each its own timing, details, and history, so there is no common pattern to find. Blocking agents is not an answer, because innocent people will use them to claim what is legitimately theirs. The question becomes whether a claim traces back to a person who has not already claimed. People are finite while agents are infinite. Most of these systems don’t need to know who a participant is, only that they haven’t claimed before, which is why proof of personhood fits: each person counted once, however many agents act for them.

Someone Has to Answer

An agent can buy, sign up, send messages, and make commitments, and someone has to answer for the result. The law’s default is that you cannot disown the agent you sent, but that works only when the principal can be found. Where an older institution forces the principal into view, as with a booked flight or a card payment, the problem is manageable. Most of the internet has no such institution. Accounts are disposable: an operator whose account is banned opens another, and a penalty that can be escaped by starting over isn’t much of a penalty. The harm lands on whoever the agent touched while the operator walks away.

This matters beyond compensating victims. Accountability is what makes people supervise what they set in motion. It also lets services set terms per person instead of refusing agents or trusting them blindly, such as capping what any one person’s agents can do however many they run. A limit set per account can be multiplied away; a limit set per person cannot.

Accountability works at two levels. Within a service, consequences stick as long as a sanctioned person cannot return as someone new, and that requires no name. Legal liability is different: it may require identifying the responsible individual/entity, which may involve institutions such as courts, banks, and payment processors, and proof of personhood is not meant to replace them. What it provides is the link that makes those institutions reachable. A service can show that a distinct person exists and, where the law demands it, point to the party with a legitimate claim to learn who they are.

The Public Count

Elections are periodic and blunt, so democracies rely on informal signals in between: comments on proposed rules, letters to representatives, petitions, polls. Almost none are verified, and their value rests on the assumption that each voice is a separate person. That assumption has already been exploited. Of the more than 22 million comments the FCC received on repealing net neutrality in 2017, New York’s Attorney General found roughly 18 million were fake, many filed under real people’s names. They were caught through patterns: bulk submissions and recycled text. Agents can instead write distinct comments, answer follow-up questions, and maintain a persona for months, so the campaign looks like many ordinary people participating.

The harm is collective. No one needs to be deceived about any fact; what goes wrong is the public’s picture of how views are distributed. A fringe position can look mainstream, a popular one contested, and officials respond to demand that doesn’t exist. Careful reading doesn’t fix this, because the problem lies in the count, not in any single message.

Anonymity matters because dissidents and people with unpopular views often depend on speaking without being identified. A credential that counts people without identifying them protects both the count and the freedom to speak.

Proof of personhood addresses the count. It cannot tell whether an argument is sound, and a citizen who uses an agent to draft a comment is still participating. What it can establish is how many distinct people stand behind a set of voices. Anonymity matters here specifically because dissidents and people with unpopular views often depend on speaking without being identified, so a credential that counts people without identifying them protects both the count and the freedom to speak.

The Cost of Inaction

The trends point in one direction. Imperva, a cybersecurity company, put automated traffic at more than 53% of all web traffic in 2025, up from 51% the year before, and in June 2026 Cloudflare’s CEO announced that bots had passed human traffic, with Cloudflare Radar showing automated requests at 57.5% of HTML traffic. That dubious milestone, if you can call it that, arrived roughly 18 months ahead of his own forecast.

(Source)

Agent capability is also rising quickly: on one widely cited benchmark, the time length of tasks AI systems can complete autonomously at 50% reliability has been doubling roughly every seven months. That measure is narrow and may not generalize. But agents have already passed some of the behavioral checks the web relies on, and people already struggle to tell AI writing from human writing (despite a few well-known tells).

(Source)

The argument here is conditional: if these gaps between machine and human behavior and capability close, the problem will change in kind. Today machine behavior can still often be caught, imperfectly and after the fact. If agents become indistinguishable in what they write and how they act, three costs are bound to follow, and they are likely to compound.

Confidence collapses. The first conceivable cost is to confidence itself. Once counterfeits are known to circulate, every count becomes suspect, including the honest ones. A shopper who knows reviews can be faked discounts all of them, and a platform that knows its polls can be stuffed stops trusting them. The same suspicion lets real people be waved away as bots, the “liar’s dividend” described by Chesney and Citron. The internet was not built to resist this threat. Its core protocols were designed to deliver information, not to verify it, so the network carries no inherent identity or provenance, and a thousand actions from one bot look no different from a thousand actions from a thousand people. For decades, outside guardrails such as journalism, credentials, and reputation filled that gap. Our colleagues at Galaxy Interactive argue they no longer hold against machine-speed content, and that once no one can tell what is real, the web will lose its evidentiary function. The endpoint is not that people believe falsehoods. It is that they stop believing anything they cannot check, and most of what is online cannot be checked.

Deception and manipulation at massive scale. The second conceivable cost is deception that scales. Agents operate simultaneously and continuously, and their marginal cost per action trends toward zero. A scammer who once needed a room of operators to sustain a long conversation with each target can now run thousands, each tailored to its target and remembering what was said. The same holds for influence. Comments, reviews, likes, and messages can be coordinated across platforms, and personas can be maintained for months, each looking like a distinct, ordinary person. Researchers who deployed AI accounts in a Reddit debate forum reported that they changed others’ opinions three to six times as often as human commenters, in an experiment widely criticized for being run without consent. At the scale agents allow, this deception does more than mislead individuals. It distorts the public’s picture of what most people believe.

The economics break. The third conceivable cost is economic, because much of the web’s economy is priced in people. Advertisers pay for human attention, platforms for engagement, and marketplaces for trust in reviews and sellers. Juniper Research estimated that 22% of digital ad spend, about $84 billion, was lost to ad fraud in 2023, and projects $172 billion of such losses by 2028. Estimates like these come from firms that sell defenses and vary widely, so treat them as indicative. Agents add a second strain. Publishers and advertisers face economic friction because automated agents can consume content without producing referral traffic or ad impressions. Cloudflare’s response has been to block AI crawlers by default and let sites charge bots for access. That renegotiates the price of machine access, but it does not tell a site whether a person is behind a machine. Defenses also add cost and friction for everyone, real people included.

Without something better, services that can no longer tell who is acting would drift toward two poles: demanding full identity checks everywhere, which builds an internet that requires surveillance to participate in, or giving up on counts, which builds one where no voice or claim can be trusted.

Other defenses exist, and some may prove to be useful in some areas. Platform friction, paid tiers, reputation systems, and partial verification all raise the cost of fakes. But each either degrades as agents get better at meeting its requirements or asks for more identity than the task needs. None gives a service a way to know that distinct people stand behind a set of voices without learning who they are. That is the gap proof of humanity fills.

The timing matters because standards can take years to become defaults, and the window to build one is the period when machines can still sometimes be caught. If we wait until existing defenses visibly fail, the pressure to adopt whatever is closest to hand, usually blunt identity checks, will be at its peak. The question is not whether the internet will need a way to count people without exposing them, but whether a good one exists by the time that pressure arrives.

The Needle to Thread

Meeting this need carries significant tradeoffs. The easiest approach is identity checks everywhere: a government ID or know-your-customer (KYC) process for every account, agent, and request. That would solve the counting problem by creating worse ones.

First, it multiplies exposure. If a person must verify with every agent or provider they use, dozens of companies end up holding their KYC information. Finance apps already lose customers’ data to hacks regularly, and that is for the small set of services where verification is unavoidable. Extending it to every agent replicates that risk many times over, including for open-source agents like Hermes that have no company positioned to hold the data safely.

Second, it shuts people out. Not everyone can pass a KYC check, whether for lack of documents, the wrong kind of documents, or unwillingness to hand them over. As more people reach the internet through agents, most of what those agents do, such as reading a webpage or buying from an online store, requires no KYC today. Making it a precondition for acting through an agent would close off the internet to people who can’t verify, for activity that never needed it.

Third, it wouldn’t even solve the counting problem. Each provider verifies in isolation, so none can tell whether the person it verified is the same one another provider verified, and fixing that by pooling the records would concentrate the risk further. The better answer is to verify once and reuse: a credential the person holds and can present through any agent to any service, without the provider seeing the identity behind it.

At a high level, a solution needs a few qualities. It should be strong, anchored to something agents cannot cheaply multiply, because cheap proxies like an email address or phone number are exactly what agents can produce at will, and a proof that one person can pass off as many is worthless. It should be private, revealing only that a distinct person is behind an agent and nothing more, with no way to link a person’s activity across services. It should be portable, verified once and usable with any agent and any service. It should be delegable, so a person can give an agent limited, revocable authority to act for them without handing over the credential itself. And it should be accessible, so that people who can’t pass a KYC check aren’t locked out of acting through agents. The difficulty is getting all five at once: strong enough to resist agents, yet private and open to everyone.

None of this removes the need for trust entirely. Personhood has to be established once, and whoever does that must be trusted to do it honestly and keep nothing they shouldn’t. Credentials can also be rented or sold, which weakens the guarantee that each one stands for an independent person. The test of any approach is how little data it asks people to entrust, and to whom, and to how data is captured, stored, and protected after being gathered. Done well, it gives agents what they need, a person behind every chain who counts once and cannot start over, without becoming surveillance infrastructure.