A new paper on agent delegation across MCP and A2A opens with a number worth sitting with: a Knostic security scan of roughly 2,000 Model Context Protocol servers found that every single one lacked authentication. Not most. Not a concerning majority. All of them. MCP, the protocol Anthropic introduced in 2024 for connecting agents to tools and data sources, added OAuth 2.1 as an optional authorization layer this year. The word "optional" is doing a lot of work in that sentence. A2A, Google's protocol for inter-agent collaboration, has its own gap: agent cards contain self-declared identities with no attestation binding, so an agent's claimed identity is just a claim. Put those two facts together and the failure mode is obvious. When Agent A delegates a task to Agent B, nothing verifies A's authority to delegate, nothing constrains what B is allowed to do with that delegation, and nothing records the handoff for later audit. The paper's authors call this out directly: the two dominant protocols enabling agents to call tools, spend money, and delegate work define how agents communicate but not who they are. This isn't a hypothetical gap being filled preemptively — the scan is a snapshot of what's already deployed. Nearly 2,000 real MCP servers, running today, answering requests from whoever asks, with no check on who's asking. In a world where MCP servers increasingly sit in front of databases, payment systems, and internal tools, that's not a rounding error in a spec; it's an open door. The paper surveys what's been proposed to close it: Google DeepMind's Delegation Capability Tokens built on macaroons (a design, not a shipped protocol), four IETF Internet-Drafts published this year covering different slices of the problem — AIMS, WIMSE, Agentic JWT, and SCIM for agents — and Mastercard's Verifiable Intent proposal aimed narrowly at commerce. The authors' own contribution, called AIP, tries to combine offline attenuable delegation, chained policy, and provenance-aware completion records into something that actually binds to MCP and A2A transport. Whether it or one of the IETF drafts ends up mattering, the diagnostic point stands on its own: the industry built the pipes for agents to act on each other's behalf before it built the locks. The scan numbers are the evidence; the fixes are still drafts.