How agents can free us from bureaucracy without a privacy-killing arms race

Nov 09, 2026

Soon everyone will want to use AI agents for computing tasks that were annoying to perform manually. That’s a big deal because so many important tasks in our lives now involve computers: paying a mortgage, signing a contract for services, arranging a playdate, buying food. You get the idea.

This prospect might frighten a lot of people, but we should also recognize the real benefits. Previously arduous or hard-to-understand tasks become easy for a user with a powerful AI agent. The benefit goes well beyond having more time to watch short-form videos. It could fundamentally rebalance power between customers and businesses, and between citizens and the state.

For years, ordinary people have enjoyed the benefits of industry and services operating at massive scale: cheaper stuff. A quiet but real cost of that innovation, however, has been losing the ability to negotiate the relationship. We no longer chat with a tailor or shoemaker about the eccentricities of our waistlines or the width of our feet. We buy off the rack, but everything is radically cheaper.

For online information services, this asymmetry has become extreme. Accepting what a provider offers costs almost nothing compared with trying to negotiate for what you actually want. I may dislike many aspects of Instagram, but it remains a free and easy way to stay in touch with friends. I may dislike certain terms from my mortgage lender, but the rate was competitive. The alternative, finding a local bank where I can talk with a banker and understand the legal conditions, would require a comparatively exorbitant expenditure of time and money.

AI can reverse that asymmetry without increasing costs. A good example arrived in the mail this morning.

DC mailed me a $75 fine for littering. Earlier, I put some things out on the curb for a bulk trash pickup my neighbor had arranged. The city actually collected the trash. As far as I know, I did nothing wrong. The ticket showed up anyway.

Still, I was perfectly happy to pay $75 rather than waste time fighting it. But the citation didn’t even mention an online payment portal. When I asked ChatGPT how to deal with it, it suggested that the online filing portal was down for maintenance and offered to submit an “admit with explanation” response by email.

I said sure. It prepared the paperwork, attached the citation, and emailed the administrative hearings office.

It was significantly easier than paying the fine.

This is a fascinating reversal of the traditional asymmetry between citizens and government. The state has automated issuing fines, collecting payments and taking admissions of guilt, but citizens have had to navigate cumbersome response processes manually if they want to challenge the ticket. AI makes responding almost frictionless.

If everyone starts doing this, simply because it’s easier, governments will face a deluge of procedurally valid responses where they previously collected revenue with little effort.

The private-sector equivalent could be even more powerful. Previously, if some aspect of a service was irksome but minor, rather like an incorrectly levied $75 fine, I would shove that frustration deep down, keep using the addictive interface, and deal with the psychological ramifications during a crisis later in life. Only half joking.

Now my agent could effectively turn the underlying service into a utility. It could bypass the addictive interface and show me information according to my needs rather than the provider’s priorities. If the provider tried to stop it, my agent could find an alternative, delete my old account, and open a new one elsewhere without my having to give it much thought. The administrative costs that create customer lock-in and enable the resulting “enshittification” could melt away.

Paradise, you say! Well, not entirely. There are two problems: a real one and a bogus one that will nevertheless be presented as real and dire.

First, armies of malicious bots do pose as legitimate customers and commit fraud and theft at scale.

Second, companies that enjoy customer lock-in will not take kindly to being treated as utilities. Utilities are low margin businesses! They will block consumer agents, likely citing the first problem—malicious bots—as justification, even when their real concern is protecting the profits they extract from captive customers.

These companies will use technical barriers and, likely, legal threats. A company can claim that accessing an account through a bot violates its terms of service. It may even argue that continued access constitutes a violation of the Computer Fraud and Abuse Act, or CFAA.

Providers in heavily regulated industries will have an even easier time. A bank can argue that the threat of North Korean hackers stealing deposits requires it to authenticate a real human in every customer interaction. Technologies that defeat those checks, it could argue, pose a national-security threat and must be regulated or banned.

This would be particularly unfortunate because heavily regulated industries are often where rebalancing power between providers and customers could yield the biggest gains in consumer welfare. Customers’ vulnerability to lock-in, exploitation, and information asymmetry is part of the justification for regulating these businesses in the first place.

Some policymakers already seem to understand this dynamic. Senator Mark Warner’s AI AGENT Act proposal would require large online platforms to accommodate agents acting on their users’ behalf, subject to requirements including verifiable user authorization. That policy goal makes sense if we want to empower customers of big banks and big tech to escape lock-in and overcome information asymmetry.

But there is an important wrinkle if we think several moves ahead.

Suppose services must accept interactions from agents their users have authorized. Technically, users could authorize an agent by giving it their login credentials, but sharing passwords is a poor approach to security. It also doesn’t address opening new accounts, which we need to automate if we want customers to move easily between otherwise locked-in platforms.

Moreover, (and this applies to everything we are going to write below too), we probably need better security for agents’ credentials than just passwords or equivalents. If a bot steals a human’s password, there will be some behavioral clues that it’s no longer acting like a human. If a malicious bot steals your agent’s password, it may be harder to spot. That aside, opening new accounts through agents presents technical challenges: how does a provider know that a prospective customer is an actual person rather than a bot. And more significantly, how do they know you are only opening one account? Sybil attacks, where a single attacker makes many sockpuppet accounts, are a common problem.

For both existing accounts and new ones, providers will seek stronger assurances that they are dealing with real people. Especially if national-security concerns drive the response, we could see onboarding requirements that resemble the full “know your customer” and anti-money-laundering checks we see in financial services applied to everything online. We could end up in a world where you are forced to disclose deeply personal information whenever you use any online service, supercharging mass surveillance by intermediaries and the governments who regulate them, all in the name of stopping malicious bots. The internet becomes a place where everything you do is tied to your real name for everyone to see. That would be terrible for privacy and speech online. Providers would also have an opportunity to use those identity requirements to reintroduce friction, rebuild lock-in, and restart enshittification. Thus defeating the whole goal of using agents to enhance consumer welfare.

Is there a better way? Yes.

There are two parts. First, we need anonymous credentials. These are cryptographic tools that let you sign into a website and prove something about yourself without revealing anything else. Suppose you have a digital drivers license. Rather than handing it over in full to an online platform you could use it with an anonymous credential: you might prove to a website you are over 18, without revealing who you are.

Second, the other thing advanced versions of these credentials let you do, is give a unique pseudonym to each website you sign into. So suppose X/Twitter, Threads, and Bluesky want to have verified accounts that are truly one account per one real human. Instead of each of them learning your real name and drivers license details, they would each learn a unique cryptographic pseudonym derived from those details. If you try to sign up for BlueSky twice with the same underlying credential, they get the same pseudonym, notice you already have an account and block you. This is not a hypothetical, anonymous credentials come from a long line of academic work. We even have systems that can convert existing digital identity documents (such as the content of your passport’s RFID chip), into an anonymous credential, and google is rolling out zero-knowledge proofs of digital drivers licenses for age verification.

This sounds better than the universal KYC regime we warned about earlier, but it still depends on you having a unique national ID like a Digital Drivers License. And requiring government issued identity to use the web is an anathema to American values, and for good reason. Beyond the obvious privacy risks, it gives the government the power to revoke your ability to use the web, or to speak on social media.

What if, instead, we let you make your own proofs of “unique” personhood, but somehow made it challenging for you to make many of them. And suppose we could do so without requiring government issued documents, relying instead on data and facts that the user herself creates and controls, what we can call “user-controlled signals.” Here we would not be looking for a perfect solution—always one human one proof— but rather one that gives good enough protections to deter bots from opening thousands of accounts while still enabling a free and open web for real humans. Indeed, no digital identity services are perfect, even the digital drivers license system above would still suffer from bots using stolen or illicitly purchased credentials .

User-controlled signals could include a zero-knowledge proof that an agent opening an account is explicitly authorized by a person who has recently engaged in several verifiable activities. For example, a proof could be made that the person logged into several bank account websites over the last month, has been using devices located somewhere in the United States, and controls an email account that has been active for several years. Depending on what the user chooses to provide, signals could also include proof of holding a state-issued or state-endorsed digital ID. But that ID would no longer be the essential and dangerously revocable key to using services online. Service providers could verify these proofs without learning the person’s identity or seeing the underlying records. Techniques developed in the cryptocurrency space have a role to play here, both in advancing the necessary cryptography and in enabling verification without putting a government authority or giant corporation in control of the whole system.

User controlled signals could give a provider reliable evidence for assessing fraud risk without requiring it to collect the sensitive personal information behind that evidence and without limiting the verification to one government-issued credential. The cryptography verifies the facts; the provider evaluates what those facts tell it about risk.

If we want a free and open internet where agents can act on our behalf, we need ways to establish trust without demanding more personal information. User-controlled signals could address legitimate fraud concerns while protecting privacy and limiting the damage from hacked customer databases. They could also make it harder for platforms to use security as an excuse to lock users in, preserving the very freedom to choose that makes AI agents so promising.

How does it work? Is it real? Is it fully baked?

I’m glad you asked. Coin Center’s John Hancock Project is now spearheading an effort to develop a robust proof of concept. Stay tuned.

Co-authored with guest Ian Miers. Ian is an Assistant Professor of Computer Science at the University of Maryland. His research focuses on solving real-world security issues using cryptography. He is one of the founding scientists of Aleo, Bolt Labs, and Zcash, startups commercializing his work on privacy-preserving payments and smart contracts.

What else we’re reading