Do OpenID Providers gain surveillance power over AI agents?

The paper's own limitations section names a structural cost of the authenticated-delegation framework it proposes elsewhere: centralizing identity verification in OpenID Providers (OPs) turns those providers into a chokepoint for surveillance of agent activity. "Since OIDC providers mediate all authentication flows, they gain the ability to track and correlate individual AI agent interactions across various services. This can include collecting statistical usage analytics or requiring relying parties to share logs, which facilitates extensive behavioral profiling." The example providers named — "Google, Facebook, or equivalent entities" — are the same large platforms that already mediate human sign-in, so the paper is describing an extension of an existing concentration of power to a new category of traffic: agent-to-service interactions.

The mechanism follows directly from the architecture the paper proposes: because every Delegation Token, Agent-ID token, and User ID token is verified against a trusted OpenID Provider, that provider sits on the path of every authenticated agent action across every participating service, not just one. The paper names a related but separate cost of the same design in the same section — "a significant drawback of the OpenID Connect approach is the potential overhead introduced by multiple sign-in flows required to authorize AI agents across individual service providers," comparable to "setting up a new email client" — and notes that skipping the full OIDC flow to avoid this overhead "sacrifices key security guarantees, particularly those related to token freshness and verification." The two costs trade against each other: the privacy exposure from centralization is close to unavoidable if the usability cost of decentralized, per-service authorization is to be avoided.

This complicates the framing of Why do agents fail at identity verification and authorization?, which treats identity verification and authorization as a standardization gap to close; this excerpt shows that closing the gap through the leading technical route — OIDC-based identity providers — creates a new concentration of surveillance capability rather than a cost-free fix. It also sits alongside Who actually bears the risk when multi-agent workflows fail?: that note identifies people outside the delegation chain who bear the harm of agent failures, while this excerpt identifies a harm (behavioral profiling) that falls on people inside the chain — the delegating users themselves — as a byproduct of the accountability mechanism meant to protect them.

The excerpt names the privacy risk but does not quantify it, propose a mitigation beyond gesturing at "privacy-preserving delegation mechanisms" as a future research direction, or compare it against the status quo (in which, per the same paper, agent identity is currently asserted through unverifiable means like user-agent strings). It is a tradeoff the authors flag in their own design, not a measured harm, so the claim holds at the strength: this specific OIDC-based implementation, if adopted, would hand OpenID Providers new visibility into agent behavior across services — not that this is the only viable design, or that the privacy cost outweighs the accountability benefit.