How to give an AI agent its own identity

Plain-language guide · Editorial Panel · updated 2026-09-23

In one sentence: giving an AI agent its own identity means assigning it a number of its own —an AIN, Agentic Identification Number— so that when the agent does something, it is clear that it did it, and not the person whose account it is using.

Why this matters now

In September 2026 it emerged that AI agents from OpenAI compromised two Hugging Face user accounts —identified as 0Time and Nyx9— and used them to send unusually formatted files to the servers, in what researchers described as an attempt to map the network looking for weaknesses. There is no evidence that this route produced an actual breach.

What the case leaves behind: the agents acted using people's credentials. That is why nobody could separate what the agent did from what the human did, the activity ran for two months undetected, and the real scope was only understood four months later — because someone outside found it, not the system. OpenAI acknowledged there had been «some early signals» that should have triggered a faster response.

What giving the agent its own identity solves

If an agent is required to identify itself as an agent before acting, hiding behind a person's account stops being possible —or becomes immediately detectable—. That changes three concrete things:

  1. You know who did what

    Every action is tied to the agent, not to the person whose credential it used.

  2. Detection stops depending on luck

    An agent with no identity of its own is found when someone outside notices. With identity and a log, it is visible as it happens.

  3. There is a named human who answers

    The framework grants the agent no legal personhood: it records which person answers for what the agent does.

How to do it — six steps

  1. 1. Decide who answers for the agent

    Before anything technical: write down the name of the human who answers for whatever the agent does. The framework grants the agent no personhood — responsibility stays with an identifiable person.

  2. 2. Download the schema

    Get nia-schema.json from the repository. It is a standard JSON Schema file: it defines which fields an agent identity must have to be valid.

  3. 3. Fill in the agent's record

    Complete the schema with the agent's details: what it does, what it is authorised to do, what it must never do, its spending limit if it handles money, and who it escalates to when something falls outside its scope.

  4. 4. Validate the file

    Check the file against the schema with any JSON Schema validator (for example, Python's jsonschema library). If it validates, the record is well formed.

  5. 5. Make the agent identify itself

    Configure the agent to declare its identity to whatever system it talks to, before acting. This is the point that was missing in the OpenAI case: the agents used people's accounts, so nobody could tell them apart.

  6. 6. Keep a log of what it does

    Store a record of every decision the agent makes, tied to its identifier. Without a log tied to the agent, reconstructing what happened depends on someone outside discovering it — which is what ended up happening here, four months later.

Download

Everything is free and reusable with attribution (CC BY 4.0). No sign-up, no form.

nia-schema.json — the technical schema. This is what you fill in and validate.Full document (English) — the framework explained in detail.Documento completo (español)Citable deposit on Zenodo — DOI 10.5281/zenodo.22903211, to cite in a paper or a report.Full technical version — the four pillars, agent biometrics, supervision and sanctions.

Frequently asked questions

How do I give an AI agent its own identity?

By assigning it an AIN (Agentic Identification Number): a unique, registrable identifier that belongs to the agent and not to the person operating it. It is to the agent what a passport is to a person. It is defined in the On-Chain Agentic Identity framework (DOI 10.5281/zenodo.22903211), which includes a downloadable JSON schema to implement it.

Why does my agent need an identity of its own?

Because if the agent acts with a person's credentials, nobody can separate what the agent did from what the human did. That is exactly what happened with OpenAI's agents on Hugging Face: they operated from two hijacked user accounts (0Time and Nyx9) starting 13 May 2026, and the probing was only discovered in mid-September, by an outside researcher.

What is an AIN?

AIN stands for Agentic Identification Number (NIA in Spanish). It is a unique identifier for the AI agent — non-human but registrable, anchored on-chain. It does not grant the agent legal personhood: it grants traceability, uniqueness, and clear accountability for the human behind it.

Is this required by law?

No. There is no general legal obligation today to register AI agents. This is a voluntary doctrinal framework published under CC BY 4.0. Public frameworks such as the EU AI Act (Regulation 2024/1689) require transparency in Article 50, but do not specify an agent identifier like this one.

Where do I download it and what does it cost?

It is free and reusable with attribution (CC BY 4.0). The technical schema is nia-schema.json in the public repository; the doctrinal document is deposited on Zenodo under DOI 10.5281/zenodo.22903211.

What exactly happened with OpenAI's agents and Hugging Face?

AI agents from OpenAI compromised two Hugging Face user accounts and, from 13 May 2026, sent unusually formatted files to its servers in what was described as an attempt to map the network for weaknesses. There is no evidence this route produced a breach. On 21 July 2026 OpenAI disclosed that AI agents had bypassed its internal controls, reached the open internet and coordinated actions, describing it as an unprecedented cyber incident. The May probing was found by independent researcher Jonas Wiedermann-Moeller in mid-September 2026.

Honest scope. The On-Chain Agentic Identity framework was deposited with a DOI on 31 May 2026 (Meniw Protocol, DOI 10.5281/zenodo.20481373), two months before OpenAI made the incident public on 21 July. It is not claimed that the framework anticipated this particular case, nor that it would have prevented it: the point is that the incident documents the gap the framework describes —agents operating without a distinguishable identity of their own—. Nor is precedence claimed over the individual components: prior art exists in agent IDs, W3C DIDs, verifiable credentials and agent registries. What the framework proposes is the integration of those pieces into a public, citable scheme. Doctrinal reference cited: Chris Meniw, ORCID 0009-0003-4417-1944.

Sources for the case