Right now, if an autonomous agent scams someone, harasses them, or breaks into a system, the victim has no way to find out who deployed it. A new paper, "Who Owns This Agent? Tracing AI Agents Back to Their Owners," names this gap directly: there is still no reliable way to trace a harmful agent back to the account that deployed it, whether the operator is careless or malicious. The researchers formalize it as the problem of agent attribution — linking an observed agent interaction to the responsible account at the hosting vendor. Their fix is a canary-based protocol. An authorized party (say, an investigator or a platform trust-and-safety team) injects a canary into the agent's interaction stream. The vendor hosting the underlying model then searches a narrow window of session logs to recover the originating session and account. In cooperative cases, simple canaries are enough. The harder case is an adversarial operator who filters or paraphrases everything the agent reads before it reaches the model — so the researchers built robust canary constructions that can't be stripped out without also degrading the agent's ability to do its actual job, which creates a structural advantage for whoever is trying to trace the agent, not whoever is trying to hide it. The protocol's design leans on a specific trust asymmetry: the vendor is assumed honest and is expected to execute attribution requests faithfully without tipping off the operator, while the investigating authority's own requests must be authenticated and auditable so the mechanism itself can't be abused for anonymous fishing expeditions. The operator gets zero trust in this model — no assumption of honesty or cooperation, since it may be an adversary weaponizing the agent for exactly the kind of harm the protocol exists to catch. What makes this different from generic logging or provenance work is the framing around legal recourse. The paper argues attribution isn't a substitute for law enforcement — it's the prerequisite for it. Investigators need to identify the vendor and the approximate session before they can compel disclosure through legal process; without that link, there's nothing to compel. Most vendor-hosted-model deployments — including, notably, state-actor cyber operations that still run on commercial LLM infrastructure — fall inside the paper's scope, since the technique targets the dependency almost every agent operator has on a hosting vendor's API, regardless of how sophisticated or hostile the operator is. This sits squarely in accountability infrastructure rather than identity or discovery: it doesn't ask agents to prove who they are up front, it gives vendors a mechanism to answer the question after the fact, when something has already gone wrong.