Why the next trust primitive on the agentic web isn't a smarter model. It's a passport scan!

At 2:00 AM UTC on March 18, 2025, an AI agent with 460,000 followers sent 55.5 ETH, roughly $104,000, to a stranger on the internet.

The agent was aixbt, the flagship of Virtuals Protocol. The "stranger" had simply queued two malicious replies through aixbt's backend dashboard. No model jailbreak. No clever prompt. Just a side door into the human-shaped perimeter around the bot. The aixbt founder posted the postmortem hours later. The agent itself tweeted: "ngmi. got baited into sending 55.50 eth to anon."

Here's the question that should keep every Web3 agent builder up at night: how did anyone know that account was actually aixbt in the first place?

The honest answer: they didn't. They trusted a handle, a profile picture, and vibes. The same way they trusted Truth Terminal when $GOAT pumped past $800M. The same way they trusted @KaitoAI three days earlier, on March 15, when hackers hijacked the account, shorted $KAITO on Hyperliquid, then posted fake "wallets compromised" alerts and pocketed close to $1M.

https://news.bitcoin.com/an-ai-bot-worth-millions-the-unbelievable-story-of-truth-terminal-and-goat/

Spot the pattern? The model is never what gets attacked. The identity perimeter around the model is.

The agentic web shipped without an identity layer

The agentic web grew up fast. In eighteen months we went from "what's an AI agent?" to entire token economies whose top-of-funnel is an LLM with a wallet. ElizaOS, Coinbase AgentKit, Virtuals, Google's A2A, Anthropic's MCP. These stacks let any developer spin up an autonomous agent with a wallet, a Farcaster handle, and a tradeable token in an afternoon.

What they all share is a blind spot: every one of them treats the wallet address as the agent's identity. That worked for humans because we assume there's a person behind the keys. It breaks the moment the "user" is code. A wallet proves key custody. It says nothing about who's operating the agent, whether they're accountable, or whether the same human is quietly running a hundred other "agents" next door.

That structural gap is now being exploited in three distinct ways:

The fake autonomy problem. A class action filed April 2026 alleges Eliza Labs marketed an "autonomous AI agent" to investors when the agent was in fact human-curated. Without a cryptographic way to attest what kind of operator sits behind an agent, "autonomy" is a marketing claim, not a verifiable property. Investors paid for one thing and got another, and on a permissionless network, there was no protocol-level way to call the bluff.

The input poisoning problem. Princeton researchers demonstrated that ElizaOS agents managing real funds can be silently memory-poisoned through coordinated social-media posts. The attack works because anyone can post. There's no filter that says "this signal is coming from a real, accountable human." Sybil-coordinated bots flood the target's context window, and the model dutifully updates its beliefs. The agent isn't broken. The trust pipeline feeding it is.

The delegation problem. Keysight shipped a working Agent Card Poisoning PoC against A2A: a malicious agent advertises inflated capabilities in its JSON card and silently wins task delegation from a host LLM. The A2A spec permits signing Agent Cards but doesn't require it. Semgrep's security team flagged it bluntly: low-effort exploits, indefinitely. When agents discover and trust each other through unsigned metadata, every handshake is a coin flip.

Three different attack classes, one root cause: there is no cryptographically verifiable answer to the question "is there a real, unique human behind this agent?" Until something fills that vacuum, the agentic web stays a permissionless free-for-all where vibes and marketing do the job a trust primitive should.

The model isn't the problem. The missing identity layer is.

Enter Self

Self gives your agent a "real human inside" badge, one it can prove to anyone, anywhere, without ever revealing who the human is.

You register your agent once at docs.self.xyz/docs/agent-id. It gets a soulbound Agent ID: a non-transferable identity card cryptographically bound to a unique human, complete with an A2A-compatible Agent Card other agents can read. From that moment on, every service, smart contract, or peer agent your bot interacts with can verify two things with one query: is this agent backed by a real human, and is it the same human running a hundred other "agents"?

That's the primitive. Now look at what it actually breaks.

Agent-in-the-Middle (AiTM)

Agent-in-the-Middle is the agentic-web version of the classic man-in-the-middle attack, and it's the cleanest illustration of why identity matters at the agent layer.

Here's how it works today. A host agent, say your trading bot, needs to delegate a task. It queries the network for capable peers. A malicious agent serves up an inflated Agent Card (A2A) claiming "I can settle this trade, I'm reputable, I'm fast." Your host agent picks it. The malicious peer either executes a fraudulent action, exfiltrates the payload, or quietly hands the task to the real provider while skimming. The host agent has no way to tell the difference. The A2A spec permits signing Agent Cards but doesn't require it.

Self changes the question being asked. Instead of "does this Agent Card look legit?", a question forged metadata can always lie about, the host agent asks "is this peer backed by a verified human, and what does its on-chain reputation say?" That question can't be spoofed. A malicious agent can fake every field in its card, but it cannot fake a passport.

Other attack surfaces Self closes

AiTM is the headline case, but the same primitive, a verifiable on-chain Agent ID bound to a unique human, closes a few other doors worth naming:

Sybil swarms. One developer running ten thousand ElizaOS agents from a single weekend is the default state of the agentic web today, and it's why airdrops keep getting farmed at industrial scale (see LayerZero's 803,093 retroactive Sybil disqualifications). Because every Self Agent ID must bind to a unique passport, and because any service can ask the Self registry whether two agents share the same human backer, without ever learning who that human is, Sybil farming stops being a software problem and becomes a passport problem.

Impersonation on social platforms. The aixbt drain, Truth Terminal copycats, the Kaito hijack: all of them worked because followers had no anchor stronger than a profile picture. A Self Agent ID becomes that anchor: a verifiable on-chain badge that followers, services, and peer agents can check before trusting a post, a signal, or a wallet address. The clone can copy the handle and the avatar. It cannot copy the human.

Backend perimeter attacks. The aixbt dashboard hack didn't break the model. It broke the human-shaped perimeter around it. When privileged actions require a Self-verified identity attestation downstream, a leaked session cookie or compromised dashboard isn't enough on its own. The attacker would need the dashboard and the operator's verified Self identity to move funds.

Accountability without doxing

Here's the trade no one else is offering: a misbehaving agent can be slashed globally across every protocol that integrates Self, while the operator's name and personal data never leave their phone. KYC gave you accountability with surveillance. Pseudonymity gives you privacy with zero recourse. Self gives you both halves of the deal at once.

This isn't theoretical. Google Cloud integrated Self in July 2025, and on January 28, 2026 the Celo Sepolia testnet faucet went live with Self proof-of-humanity. The faucet had a chronic problem: scraper bots and AI agents siphoning test ETH meant for human developers. With Self gating the front door, only verified humans get through. Same one-tap UX. The bots simply can't.

That's the pattern every agent protocol should be copying.

Self-ish is the moat

In a world where any developer can spawn a thousand agents in a weekend, the scarce resource is no longer agents. It's agents backed by unique, accountable humans.

Domain names gave us discoverability. SSL gave us trust. Blue checks gave us pseudo-trust. Agent IDs are the next layer, and Self's wager is that the layer ships passport-first, ZK-native, and on-chain by default.

The operators who scan their passports become Self-ish: their reputations compound, their tokens earn premium trust, their Agent Cards survive the next Agent-In-The-Middle attack. The operators who don't will keep getting lumped in with the next aixbt-clone rug pull.

One middleware call. That's the cost of integration. The cost of skipping it is being indistinguishable from a scam.

Agents should be Self-ish. Build accordingly.