A new arXiv paper on the Agent Identity Protocol (AIP) surfaces a number worth sitting with: a security scan by Knostic checked roughly 2,000 Model Context Protocol servers in production and found that every single one lacked authentication. MCP adopted OAuth 2.1 as an optional authorization layer this year, but optional is doing a lot of work in that sentence — the servers agents actually use to invoke tools are, as deployed, wide open. The same paper points at a second gap sitting next to the first. Agent-to-Agent (A2A) protocol "agent cards" — the files an agent publishes describing who it is and what it can do — contain self-declared identities with no attestation binding. Nothing stops an agent from claiming a capability or authority it doesn't have, and nothing records the claim for later checking. When one agent delegates a task to another, no mechanism verifies the first agent's authority to delegate, constrains what the second agent can do with that delegation, or logs the handoff for audit. The paper isn't just cataloguing the problem. It surveys the current field of partial fixes — Google DeepMind's macaroon-based Delegation Capability Tokens (proposed but unshipped), four separate IETF drafts each covering a slice of the problem, Mastercard's Verifiable Intent proposal for agent commerce — and concludes that despite this activity, no implemented protocol currently combines offline-verifiable delegation with expressive, chainable policy and provenance-aware completion records across both MCP and A2A transports. AIP is offered as an attempt to close that combination, not just one more piece of it. What makes this notable isn't the existence of another identity proposal — that part of the landscape is crowded. It's the empirical grounding: a concrete scan of live infrastructure showing the gap isn't theoretical. MCP has grown fast enough that its authentication story lagging behind adoption is now a measurable condition, not a hypothetical risk. The paper also flags that existing alternatives fall short in specific, checkable ways — OAuth 2.0/2.1 requires centralized authorization servers and produces opaque tokens with no delegation chain, while W3C DIDs introduce blockchain dependencies and circular trust bootstrapping problems of their own. The practical takeaway: protocol adoption curves and security-hardening curves are not the same curve, and right now they're pointed in different directions for the tool-calling layer most agentic systems already depend on.