A new arXiv paper out of Ben-Gurion University and Northeastern proposes a concrete mechanism for solving one of agentic AI's stickiest problems: when an autonomous agent causes harm, who's actually behind it. The paper, "Who Owns This Agent? Tracing AI Agents Back to Their Owners," frames the issue as one of structural anonymity — agents can act at scale with no reliable link back to the human or organization that deployed them. The authors describe their contribution directly: this research addresses the structural anonymity of AI agents by proposing a protocol for agent attribution. Their argument for why this matters is straightforward: attribution is a prerequisite for meaningful accountability, since without a way to connect harmful agent behavior to the responsible operator, victims can't seek recourse, platforms can't intervene, and authorities may lack the evidence needed to act. This is a different framing from most of the identity work circulating right now, which tends to focus on issuing agents credentials or certificates up front. This paper leans instead on canary-based tracing — embedding identifying markers that let an agent's actions be traced back after the fact, rather than relying purely on a pre-registered identity token that could be stripped, spoofed, or simply absent. That's a meaningful distinction: registration schemes assume cooperation from whoever deploys the agent, while a tracing mechanism is designed to work even when an operator has no incentive to make themselves known. The authors are also careful to flag the double edge here. In their ethics section, they note that attribution mechanisms introduce risks if deployed without safeguards — the same tracing capability that lets a victim identify a malicious operator could, in the wrong hands, be used to deanonymize legitimate agents or their operators for surveillance rather than accountability purposes. That tension between attribution-for-recourse and attribution-as-surveillance is one the paper doesn't fully resolve, but it's the correct tension to name rather than skip past. The timing matters. Enterprises are shipping agents that call other agents, hit external APIs, and touch customer data with minimal oversight of which specific instance did what. Most current proposals — certificates, registries, ID cards — assume a cooperative deployment pipeline where operators willingly attach identity to their agents. A tracing protocol is a hedge against the case where they don't, whether from negligence or intent. That's a narrower but arguably more realistic bet than schemes that assume universal buy-in to a registration standard. What's missing from the public materials so far is a threat model against adversarial evasion — an operator motivated to hide will also be motivated to strip or forge canary markers, and the paper's own framing acknowledges this cuts both ways. Whether the tracing signals survive that kind of adversarial pressure, rather than just accidental loss of identity, is the open question worth watching as this work moves past the preprint stage.