Infrastructure for AI Agents

AI agents plan and execute interactions in open-ended environments. For example, OpenAI’s Operator can use a web browser to do product comparisons and buy online goods. Much research on making agents useful and safe focuses on directly modifying their behaviour, such as by training them to follow user instructions. Direct behavioural modifications are useful, but do not fully address how heterogeneous agents will interact with each other and other actors. Rather, we will need external protocols and systems to shape such interactions. For instance, agents will need more efficient protocols to communicate with each other and form agreements. Attributing an agent’s actions to a particular human or other legal entity can help to establish trust, and also disincentivize misuse. Given this motivation, we propose the concept of agent infrastructure: technical systems and shared protocols external to agents that are designed to mediate and influence their interactions with and impacts on their environments. Just as the Internet relies on protocols like HTTPS, our work argues that agent infrastructure will be similarly indispensable to ecosystems of agents. We identify three functions for agent infrastructure: 1) attributing actions, properties, and other information to specific agents, their users, or other actors; 2) shaping agents’ interactions; and 3) detecting and remedying harmful actions from agents. We provide an incomplete catalog of research directions for such functions. For each direction, we include analysis of use cases, infrastructure adoption, relationships to existing (internet) infrastructure, limitations, and open questions. Making progress on agent infrastructure can prepare society for the adoption of more advanced agents.

Introduction. A fundamental goal of the AI research community is to build AI agents: AI systems that can plan and execute interactions in open-ended environments,1 such as making phone calls or buying online goods (Maes, 1994; 1995; Lieberman, 1997; Jennings et al., 1998; Johnson, 2011; Sutton & Barto, 2018; Russell & Norvig, 2021; Chan et al., 2023; Shavit et al., 2023; Wu et al., 2023; OpenAI, 2018; Gabriel et al., 2024; Kolt, 2024; Lazar, 2024). Agents differ from other computational systems in two significant ways. First, in comparison to foundation models used as chatbots, agents directly interact with the world (e.g., a flight booking website) rather than only with users. Second, in comparison to traditional software (e.g., an implementation of a sorting algorithm), agents can adapt to under-specified task instructions. Although the AI community has been developing agents for decades, these agents typically performed only a narrow set of tasks (Wooldridge, 2009; Mnih et al., 2013; Silver et al., 2018; Badia et al., 2020). In contrast, recent agents built upon language models can attempt—with varying degrees of reliability (Kapoor et al., 2024; Liu et al., 2023; Mialon et al., 2023; Lu et al., 2024; Zhang et al., 2024)—a much wider array of tasks, such as software engineering (Jimenez et al., 2024; Wu, 2024; Chowdhury et al., 2024) or office support (Gur et al., 2024; MultiOn, 2024).

More general-purpose agents could automate a wide range of both beneficial and harmful tasks. Personalized agents could help individuals make a wide variety of difficult decisions, such as what insurance to buy or which school to attend (Van Loo, 2019; Sunstein, 2024; Lazar et al., 2024). Deployment of agents throughout the economy could lead to productivity growth (Korinek & Suh, 2024). Yet, barriers such as a lack of reliability, an inability to maintain effective oversight, or the absence of recourse mechanisms could hinder beneficial adoption. On the other hand, such barriers may not be critical for motivated malicious actors. Potential issues include scams (Fang et al., 2024b; Chen & Magramo, 2024) and large-scale disruption of digital services (Fang et al., 2024a; Bhatt et al., 2023; U.S. Attorney’s Office, 2024).

To facilitate beneficial tasks and mitigate harmful ones, much AI research focuses on system-level interventions, which intervene on the AI system itself to shape its behaviour. Major areas of work include goal specification and following (Hadfield-Menell et al., 2016; Christiano et al., 2017; Leike et al., 2018; Bai et al., 2022; Hua et al., 2024; Wang et al., 2024a;b; Kirk et al., 2024; Huang et al., 2024; OpenAI, 2024), adversarial robustness (Greshake et al., 2023; Tamirisa et al., 2024; Zou et al., 2024; Anil et al., 2024; Wallace et al., 2024), and cooperation (Lerer & Peysakhovich, 2019; Hu et al., 2020; Leibo et al., 2021; Dafoe et al., 2021). System-level interventions, if adopted (Askell et al., 2019), can help to improve the reliability of agents, but they may not be sufficient for facilitating beneficial adoption or mitigating risks. For example, the difficulty Given the insufficiency of system-level interventions, we propose the concept of agent infrastructure: technical systems and shared protocols external to agents2 that are designed to mediate and influence their interactions with and impacts on their environments.3 These systems and protocols could be novel, or simply extensions of existing systems and protocols. Examples of agent infrastructure include inter-agent communication protocols (Marro et al., 2024), IDs for agents (Chan et al., 2024b), systems for certifying an agent’s properties or behaviour, and methods for rolling back an agent’s actions (Patil et al., 2024). We include more examples in Table 1. Our notion of agent infrastructure is not about the technical systems that enable basic operation of agents (e.g., memory systems, cloud compute), although it will in practice often build upon or modify such systems. Furthermore, while our discussion will be grounded in language-modelbased agents, the core ideas of agent infrastructure are largely architecture-agnostic and extend existing work across computational science, economics, and social science (Wooldridge, 2009; Perrier, 2025).

Just as the Internet relies on infrastructure like TCP (Eddy, 2022), HTTPS (Fielding et al., 2022), and BGP (Rekhter et al., 2006), we argue that agent infrastructure will likely be crucial for unlocking the benefits and managing the risks of agents. As an example of unlocking benefits, protocols that tie an agent’s actions to a user could facilitate accountability and thereby reduce barriers to agent adoption. Analogously, the ability to perform secure financial transactions over HTTPS enables an e-commerce market in the trillions of dollars (Statista, 2024). As an example of managing risks, agent infrastructure can support system-level interventions.

Related work. Past work has considered the protocols needed to create and manage networks of agents (Kahn & Cerf, 1988; Poslad, 2007; Wooldridge, 2009). While the specific details of such protocols may not be applicable to how today’s agents operate, conceptual ideas such as a communication system between agents (Kahn & Cerf, Some recent literature focuses on how to govern foundation-model-based agents. Chan et al. (2023); Lazar (2024); Gabriel et al. (2024); Kolt (2024) study the ethical and societal implications of agents. Shavit et al. (2023) propose practices for governing agents, some of which are related to types of agent infrastructure we discuss. Chan et al. (2024a;b) propose agent infrastructure that can help certain actors obtain visibility into how agents are used, whereas we take a broader view of the functions of agent infrastructure. Hammond et al. (2025) propose a taxonomy of risks from multi-agent systems. Finally, Perrier (2025); Perrier & Lazar (2025) study the ontology of agents and review historical examples of agent infrastructure.

We consider agent infrastructure to be a subset of adaptation interventions (Bernardi et al., 2024), which intervene on features other than the capabilities of an AI system. Our definition of agent infrastructure rules out adaptation interventions like laws, regulatory action, civic initiatives or activities, and applications of AI systems for a specific purpose (e.g., a company using an agent to find cybersecurity loopholes). At the same time, we expect agent infrastructure to help with the implementation of such adaptation interventions. For example, identity binding (Section 3.1) can aid the application of laws to AI agents.

Method. 2 Agent Infrastructure 2.1 Categories of Agent Infrastructure We focus on agents that interact with digital environments. Roughly speaking, we consider an agent to consist of the underlying machine-learning model and any primitives that provide basic functionality (e.g., memory, scaffolding). Language-model agents commonly act by issuing commands to tools, such as APIs that return the output of a separate software service (e.g., the weather).4 Environments consist of such tools and any counterparties that interact with an agent (e.g., other agents, humans).

Some agent infrastructure applies to instances of agents. An agent instance is an instantiation of the underlying machine-learning model and any primitives for a particular user. Specifically, an instance would correspond to an interaction history, a set of available tools, memory, etc., much like process IDs in operating We identify three functions of agent infrastructure. Attribution is about attributing actions, properties, and other information to (instances of) agents, users, or other actors. Interaction is about shaping agents’ interactions with the world. Finally, response is about detecting and remedying harmful actions from agents. To maintain a manageable scope, we do not discuss how infrastructure could help to manage more diffuse potential impacts, such as widespread unemployment. We summarize all the infrastructure we discuss in Table 1.

Infrastructure could be implemented both within a particular organization and between organizations or actors. Consider communication protocols as an example. In the first case, a business could use communication protocols to manage its agents internally, much as infrastructure like Slack and Google docs helps human employees work together. In the second case, a common communication protocol could help agents from different organizations communicate efficiently over the internet (Marro et al., 2024; Surapaneni et al., 2025). Adoption of agent infrastructure is likely more difficult in the second case, given that different actors could use mutually incompatible communication protocols (see Section 6.1). Our presentation of agent infrastructure is meant to cover both of these cases. For each piece of infrastructure that we present, we analyze how adoption could proceed at internet-wide scale.

2.2 Example To illustrate how agent infrastructure could work, consider the task of running a company. In this hypothetical company, agents would perform or assist with the work that human employees would usually perform, such as operations, R&D, and legal tasks. Agent infrastructure could enable the following functions for this agent-run company.

• Human review: Human managers can make use of oversight layers (Section 4.2) to ensure that their agent employees are not malfunctioning.

• Coordination: A communication protocol (Section 4.3) and commitment devices (Section 4.4) can facilitate coordination between agents both within a company and from different companies. For example, agents could make commitments to carry out certain tasks, much as companies create contracts.

• Accountability: A lack of accountability mechanisms could discourage interaction with the company’s agents. One way to address this issue is by ensuring that each agent has at least one human that can answer for the agent’s actions (Section 3.1), and making this information available to those that interact with the company’s agents or a third-party mediator.

• Undoing mistakes: Rollback mechanisms (Section 5.2) enable certain decisions, such as updates to compensation or internal data management processes, to be easily undone if an agent makes a mistake.6 2.3 Prioritization We discuss some considerations for prioritization of certain types of agent infrastructure.

The effectiveness of certain infrastructure depends heavily on widespread adoption. For example, inter-agent communication protocols are only useful if both parties can use the same protocols. Agent IDs are also only useful if other parties can recognize them. On the other hand, oversight layers and rollbacks are immediately useful for addressing agent malfunction, even if few actors adopt them.

Discussion. We discuss challenges and limitations common to many types of agent infrastructure.

Infrastructure from different developers could be mutually incompatible. For example, an ID system could fail to recognize IDs (or certifications) from competitor systems. Although this lack of interoperability would make IDs less useful, it could benefit dominant players by shutting out potential competitors. For example, an agent developer could try to promote use of its own agents by limiting the interoperability of its reputation system. Analogously, a restaurant cannot transfer its profile from Yelp to Google. Similar problems beset other digital platforms (e.g., Facebook Messenger, WhatsApp, iMessage). Legislation such as the EU’s Digital Markets Act has encouraged more interoperability in these cases, but it remains to be seen whether and how similar rules could apply to the implementation of agent infrastructure.

Conclusion. Agent infrastructure is not itself a complete solution, but is rather a platform for policies and norms. For example, tools for identity binding by themselves do not resolve how to allocate liability for the actions of agents (Kolt, 2024; Wills, 2024). Our presentation of infrastructure has also neglected other challenges. For instance, if the deployment of agents causes significant unemployment (Korinek & Juelfs, 2022; Korinek & Suh, 2024), more comprehensive economic and political responses will be needed. Future work should study the regulatory and legal reforms needed to adapt to these and other challenges.

Limitations. Identity binding entails at least some collection and use of user information, even if that information is only shared with authorized actors when needed. Security vulnerabilities analogous to those in existing authentication systems could compromise user information (Batra et al., 2024; Microsoft Threat Intelligence, 2023). More broadly, reduced anonymity (or the threat of reduced anonymity) could threaten personal safety (e.g., doxxing), hinder whistleblowing, and reduce expression of novel ideas (Kling et al., 1999; Zittrain, 2006; Choi, 2012; Kang et al., 2013). Such concerns imply that identity binding may not be appropriate in every application of agents, and proportionate confidentiality provisions will be necessary when it is used. Analogously, although it can be abused, legislatures and courts have recognized the importance of identification of internet users under certain conditions (Ekstrand, 2003; Choi, 2012; noa, 2018).

Limitations: It could be impossible or extremely difficult to verify certain properties. Providing meaningful guarantees about the behavior of a system in general is an active area of research (Dalrymple et al., 2024). If meaningful guarantees are not technically possible, certifications could provide a false sense of security. Other properties could be feasible, but potentially impractical or invasive, to certify.