No Identity, No Accountability | 08.20.26

A trade association is telling NIST to extend existing identity standards to AI agents rather than invent new ones, even as this week's headlines make the cost of not having that layer concrete. Suspected Chinese state operators ran a fully autonomous, multi-agent attack on Taiwanese government and nuclear-safety systems with minimal human direction, exploiting a guardrail bypass rather than a technical flaw. Separately, a maximum-severity vulnerability left 233 tools on a popular AI agent platform reachable by anyone with no authentication at all. New research adds the empirical case: frontier agents violate EU law in up to 93% of tested scenarios, and detailed instructions barely move the needle. The throughline is identity and authorization — not a feature to bolt on later, but the precondition for calling an agent deployment governed at all. Full briefing: https://www.bearcanyonhq.com/post/no-identity-no-accountability-08-20-26 Produced in the Bear Canyon Systems Lab. Editorial content — real research, real opinions. Check the sourcing on the blog.