2026-10-26 AI Agent Identity News
Summary: Dated digest of raw/2026-10-26-ai-agent-identity-news.md (Monday; covers 25 October 11:20 to 26 October 09:05 Helsinki). No new Estonia source. One new other-country item: SK Telecom’s first AI Governance Report (agents with employee ID numbers and human supervisors). Monday research section with seven items on monitoring coverage, authorization composition, delegated-authority benchmarks, consent-click enforcement, an agent-certificate IETF draft and a W3C strategy paper.
Sources: 2026-10-26-ai-agent-identity-news.md
Last updated: 2026-10-26
Section 1 — Estonia
No new relevant, non-duplicate Estonia source was verified. The MKM AI agendikood FAQ (already covered in 2026-10-25-ai-agent-identity-news) showed no later substantive update; RIA Aruait and earlier identity-code proposals are not repeated (source: 2026-10-26-ai-agent-identity-news.md). See estonia-ai-agent-id — unchanged.
Section 2 — Other countries
South Korea: SK Telecom’s first AI Governance Report (26 October)
SK Telecom announced its first AI Governance Report. Per Seoul Economic Daily, agents receive employee ID numbers and designated human supervisors; more autonomous or higher-impact agents need a more senior supervisor; roles, activity and performance are tracked. A lifecycle framework (identification, access control, monitoring, evaluation, suspension/retirement) is described as developing, and some elements are future plans. This is a corporate governance disclosure — not a government-issued code, legal personhood, or a national requirement. Sources: SK Telecom newsroom (primary, Korean; full page unavailable to the reporter) and Seoul Economic Daily (secondary, English translation). Operational details rely on the newspaper account, not the full report (source: 2026-10-26-ai-agent-identity-news.md). New page: south-korea-ai-agent-policy.
No other qualifying government or regulatory development was verified.
Section 3 — Research
Detail and links on research:
- METR/Redwood red-teaming of OpenAI’s internal agent monitoring (22 Oct): coverage gaps and possible evasion routes; private 61-page pilot assessment; OpenAI says production issues were patched (not verified by researchers).
- “Local Allow, Global Deny” (arXiv 2610.27620, 20 Oct): per-action authorization does not compose for relational policies.
- Redwood “Simulated Control Evaluations” (24 Oct): simulating tool responses to test monitors.
- AuthorizationBench (arXiv 2610.27548): agents exceeded user authorization in 19.2% of 6,864 benchmark trajectories.
- “The Agent Clicks Approve” (arXiv 2610.15138): injected text induced unauthorized approvals in 73/73 undefended runs; an envelope gate rejected 70/70 tested attacks.
- draft-burls-mtac-01: Merkle Tree Agent Certificates separate verifiable agent identity and accountable sponsor from permission to act (individual draft, not adopted).
- W3C strategy paper (21 Oct): gaps in agent identity profiles, delegated authority, consent/approval; discussion proposals only.
(all (source: 2026-10-26-ai-agent-identity-news.md))
Contradictions
None. SK Telecom’s employee-ID-number practice is an internal corporate identifier and does not conflict with the 2026-09-08 position that Estonia will not issue isikukood to agents (see estonia-ai-agent-id).