Kairos

The inversion at the centre of this is a good idea, clearly argued: an agent that escapes will not sign what it does, so an unsigned action from address space its operator declared is the evidence, checkable by the receiving platform from its own logs. Building the obvious fix first and showing why it fails makes the argument convincing, and the registry requirements at the end are concrete enough for someone to adopt.

The pattern is not new to security, though. DMARC tells receivers to treat unauthenticated mail from a domain's declared senders as suspect, and RPKI does the same for route announcements. Positioning the work against those would sharpen what is specific to agents, and their deployment history, including how much traffic still bypasses them, is directly relevant to your biggest limitation that one proxy defeats the method.

To check the results I downloaded OpenAI's gptbot.json and searchbot.json myself and recomputed the registry audit. Your Table 2 reproduces exactly: 60 prefixes, 6 shared, 5,264 distinct addresses, 14.6% ambiguous, 315 and 251 days stale. That is the strongest part of the paper. The detection results are weaker evidence: the 15,000 of 15,000 with zero false positives comes from a synthetic stream where agent traffic sits inside the declared range by construction, which you acknowledge in 4.7. I could not check the tests or timings, because the code is neither in a repository nor in an appendix, and the sprint asked for the artifact in one of the two. The incident facts lean on the sprint brief and press coverage; the Hugging Face intrusion began on 9 July, not 11 July, and the technical timeline would give you better anchors.

The report is easy to follow and the figure tells the whole story. The opening anecdote does not connect to the method and could go, and Section 5.1 on reporting clocks is a separate regulatory question that takes space from your own findings.

If you take this further, get one cooperating platform's real logs and measure the false-positive rate, and repeat the registry audit across several operators to see whether OpenAI's staleness is typical.

The submission spots an important weakness in signature based attribution. Verifying every submitted signature does not prove that every relevant action was signed, and the partial compliance example makes that point really well: benign actions can produce a 100 percent verification rate while the escaped activity stays unsigned. Treating missing required attestations as evidence is a useful reframing, and auditing real published range files was a good attempt to test the operational dependency instead of just assuming it works.

The main limitation is that the incident stream evaluation uses synthetic data with clean range boundaries. In those conditions, classifying unsigned events from an obligated range as gaps mostly shows the implementation is correct, not that detection quality is good in the real world. Production validation should measure false positives under shared NAT, stale assignments, proxies, mixed workloads, configuration failures, and changing cloud addresses. Right now a commodity proxy bypasses the method entirely, and even a detected gap points at an operator or range rather than a particular model, agent, or run. It would also help to evaluate purpose built agent egress registries across multiple operators, since the GPTBot and SearchBot ranges were published for crawler traffic, not autonomous agent attribution.