---
title: "AI agents can now get accounts and inboxes, and some designs name a human owner"
description: "Four AI Engineer World's Fair talks checked against primary sources: agents can register, get inboxes and run in sandboxes, and some designs name a human owner."
publishedAt: 2026-10-13
author: Ena Pragma
url: https://enapragma.co/field-notes/ai-agents-can-now-get-accounts-and-inboxes-and-some-name-a-human-owner
tags: ["agent-architecture", "ai-governance", "agent-security", "ai-market"]
---

**The news in these four talks is not smarter models. It is identity and accountability. An agent can now register for a service, get its own inbox and run in a sandbox that can be rebuilt. The identity designs are built to attach a named human, though several paths do not require one at signup, and the sandbox products make human approval a setting you choose.** All four talks were given at the AI Engineer World's Fair in San Francisco between June 29 and July 2, 2026, and were posted to the AI Engineer YouTube channel on October 11 or 12, depending on the time zone a page shows. So we are checking talks that are three to four months old against pages we read on October 13. Their mechanisms mostly hold. One headline latency figure is the slow tail, and some claims about what is available are not backed by the vendors' own pages.

This is research from public sources, not a test of ours. We have not run any of these products. We re-read every source below on October 13, 2026, Central time. Where a page shows no date, we say so and treat it as a reading from that day. We read the YouTube auto-caption transcripts of the four talks and did not watch the video. Auto-captions garble names, so we quote a speaker only where the words read cleanly. A speaker's words show what was claimed, not that it is true.

## The four talks

Each speaker works for a company selling in this space, so what a speaker's own company says about its own product proves only that the company said it. The conference's [sessions list](https://ai.engineer/worldsfair/2026/sessions.json) and [schedule](https://ai.engineer/worldsfair/schedule?track=Startup+Battlefield) give the dates.

- Michael Grinich of WorkOS, ["Auth for Agents: Let AI Sign Up for Your Product with auth.md"](https://www.youtube.com/watch?v=nSkmXakJ6eo), posted October 11 or 12. The sessions list has a Main Stage session by Grinich on July 2 titled "Auth for Agents: Unblock Autonomous AI with auth.md," and WorkOS's [recap dated July 7, 2026](https://workos.com/blog/workos-aie-worlds-fair-2026-recap) says he gave a mainstage talk under that title. The video title differs, so we treat the two as the same talk without being able to confirm it.
- Priyanka Phatak of Anthropic, ["Decoupling the Brain from the Hands: Claude Managed Agents (Part 1 of 4)"](https://www.youtube.com/watch?v=Uv0nAf_7tyU), posted October 11 or 12. The sessions list has "Claude Managed Agents Workshop (Part 1)" on June 30, under a different title from the video.
- Adi Singh of AgentMail, ["The Next Trillion Internet Users Still Don't Have an Identity"](https://www.youtube.com/watch?v=mBNVKkyfnE0), posted October 11 or 12. The sessions list has a talk by Singh on July 1 under a slightly different title, "The Next Trillion Users of the Internet Still Don't Have an Identity."
- Howie Liu of Hyperagent, ["Hiring Employable Agents + Startup Battlefield Finals"](https://www.youtube.com/watch?v=EEt3ZSG4a1s), posted October 11 or 12. The schedule puts the Startup Battlefield on Thursday, July 2, and lists Liu as "Airtable, CEO."

## An agent can now register itself, with limits

The first talk is about auth.md, a file a service publishes so an agent can sign itself up. WorkOS's [recap, dated May 25, 2026](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration), says the file declares "what identity proofs are accepted, what auth flows are supported, what scopes and entitlements exist, what free tier constraints apply, and how a human or organization can later claim the account." It also says plainly: "Auth.md is a spec, not an IETF-ratified standard."

Treat it as early. The [auth.md repository](https://github.com/workos/auth.md) is MIT licensed and shows 62 commits, 0 tags and a last commit of July 23, 2026. Its [changelog](https://github.com/workos/auth.md/blob/main/CHANGELOG.md) puts v0.6.0 at 2026-06-10.

Whether a person is involved depends on the flow. WorkOS's [auth.md page](https://workos.com/auth-md) describes two. In the agent verified flow, "the agent's identity provider vouches for the user, no human in the loop." In the user claimed flow, "the agent shows the user a code, they sign in and confirm it."

The agent verified flow runs on an identity assertion from a provider, called an ID-JAG, short for Identity Assertion JWT Authorization Grant. That is the subject of an [IETF draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/), revision 04, dated 21 May 2026. The draft text reads "Intended status: Standards Track," while the datatracker page lists its intended RFC status as "(None)." Either way it is an active Internet-Draft of the OAuth working group, set to expire on 22 November 2026, not a standard.

Firecrawl's own file says it accepts the agent verified kind. Its [auth.md](https://www.firecrawl.dev/auth.md) says it "supports agentic registration for WorkOS ID-JAG identity assertions" and "does not currently support anonymous registration, verified-email registration, claim flows." So that route has no later claim step.

In Grinich's demo, an agent finds a service that advertises auth.md, picks Cloudflare and deploys. He first calls it a "kind of cartoon demo," and says of it: "I didn't sign up anywhere." He also says: "We actually have this working as a live demo. We did some collaboration with Cloudflare on this too." Cloudflare's [own auth.md](https://www.cloudflare.com/auth.md), read October 13 and undated, says "Cloudflare does not yet advertise production auth.md registration methods" and tells agents not to try until the file links to production discovery metadata. Cloudflare does have a separate path, `wrangler deploy --temporary`. Its [blog post](https://blog.cloudflare.com/temporary-accounts/), undated on the page, says the deployment "stays live for 60 minutes," runs with "no human in the loop required," and gives the agent a claim link to pass to a person, or the account is deleted. We did not test any of this and cannot say which endpoint the demo used. The safe reading is that auth.md support at Cloudflare was still on the way on October 13, more than three months after the talk.

The changelog also shows where a human comes back in. v0.5.0 (2026-06-05) gates first-time linking of an ID-JAG to an existing account behind a user confirmation, and the changelog says why: without it, "any trusted provider could mint an ID-JAG with `email_verified: true` for a victim's email and silently take over their account." In v0.4.0 (2026-06-04) the agent hands a code to the person, who "confirms the code on a service-owned page."

## An agent can now get an inbox, and the owner can link in later

Telnyx's [release note of June 25, 2026](https://telnyx.com/release-notes/agent-inbox-autonomous-signup), six days before Singh's talk, says AI agents signing up without an email "now get a durable inbox by default, powered by AgentMail." The agent "reads its own magic link, and walks away with an API key." Three details matter. Telnyx fronts the inbox with its own API, "a Telnyx-owned, provider-neutral API." Signup starts with a reverse-CAPTCHA, which the release note describes as "an obfuscated math challenge that only an LLM can reliably solve"; the [signup file](https://telnyx.com/agent-signup.md) says the challenge could also be "a completely different type of challenge." And the account is "a Telnyx-owned trial provisioned with limited funds," with full know-your-customer (KYC) checks later, "when the owner links a real email." No named human is required at signup on this path.

Singh says the inbox made the agent "the focal point" for contact "when a balance is low, when an account got suspended, when there was any support and communications issues." Telnyx's release note and signup file say nothing about billing or support mail reaching that inbox. The signup file does warn that the "account_key is returned only once; if you lose it, you cannot recover access to that inbox."

The more telling item came later. AgentMail's [blog index](https://www.agentmail.to/blog) lists [AgentID](https://www.agentmail.to/blog/introducing-agentid) as an October 5, 2026 launch, three months after this talk was given: "a sign-in button for AI agents." Every AgentID is backed by an AgentMail address. AgentMail says: "Behind it, always, is the person who owns the agent, and your app gets to know who that is." The "always" is AgentMail's own claim about its own product, and we did not test it. Its FAQ adds that an app gets the owner's name and email only if it registers and asks for them ("request the owner scopes"). AgentMail also says it is "a standard OpenID Connect provider," that "10 million agents can find you," and that "Apps that accept AgentID today include Firecrawl, Turso, TinyFish, Manufact, Telnyx and Rho." Those are vendor claims, and we checked none of them. AgentMail explains why it built this: "The honest answer is that they borrow." Agents sign up with their owner's email and read the code out of the owner's inbox. Then it let agents sign up for AgentMail itself and, it says, "Hundreds of accounts appeared whose owners had no idea their agent had made one." That is a vendor's self-report about its own signup, not a measurement.

In the talk, Singh argues that "identity isn't something that you can define from scratch. I think identity is formed." He also says of the field: "we are very early." By AgentMail's own description, AgentID is not a new spec but standard OpenID Connect on top of an email address. The two views sit closer than the framing suggests, and the product, by AgentMail's account, still puts an owner on record for apps that ask.

## The sandbox can be rebuilt, and the gates are settings

Anthropic's [engineering post of April 8, 2026](https://www.anthropic.com/engineering/managed-agents) splits an agent into "a session (the append-only log of everything that happened), a harness (the loop that calls Claude and routes Claude's tool calls to the relevant infrastructure), and a sandbox." The reason is the first design, where "if a container failed, the session was lost." After the split, a failed container comes back to the model as a tool error, and a replacement harness can be "rebooted with `wake(sessionId)`" and "resume from the last event." The post says the split "solved one of our earliest customer complaints": customers who wanted Claude to work against resources in their own virtual private cloud "had to either peer their network with ours, or run our harness in their own environment." Separately, [self-hosted sandboxes](https://platform.claude.com/docs/en/release-notes/overview), an option to run tool execution outside Anthropic's infrastructure, arrived May 19, 2026.

Two things Phatak says on June 30 need their numbers. She says that starting inference without waiting for the sandbox cut time to first token "by about 90%." (The captions garble the term, but the context is first-token latency.) The post says "our p50 TTFT dropped roughly 60% and p95 dropped over 90%." The median fell about 60 percent, and 90 percent is the slow tail. The post gives no baseline. She also says "credentials never entered our sandbox." For Git, the post says the repository token is wired "into the local git remote" without "the agent ever handling the token itself," while of tools reached through MCP it says "The harness is never made aware of any credentials." Since June 9, 2026, per the release notes, vaults can hold environment variable credentials. The [vaults docs](https://platform.claude.com/docs/en/managed-agents/vaults), undated, say each is "stored in the sandbox as an opaque placeholder" and swapped for the real secret "at egress." The same company's [environment docs](https://platform.claude.com/docs/en/managed-agents/environments), undated, warn "Anything in the sandbox can leave it" with unrestricted networking, and add: "The agent toolset's default permission policy is `always_allow`, so `bash` commands run without approval." Human approval there is something you switch on.

Two other things bear on anyone choosing a lane. The [Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview), undated, says it is "not currently eligible for Zero Data Retention or HIPAA Business Associate Agreement (BAA) coverage." And Hyperagent's docs, also undated, show the same split between defaults and choices. In its [Live Mode](https://www.hyperagent.com/docs/concepts/agents/invocations/live-mode), "Read-only is the default." In conversation the default is different: Auto, where the "Agent runs everything end-to-end without stopping." A delegated agent gets only the brief: "Nothing of the caller's conversation crosses over except the brief the caller writes for the handoff." An "Ask first" mode "pauses for approval before sensitive actions," though the docs call it "a behavioral preference the agent follows, not a sandbox" ([Hyperagent docs](https://www.hyperagent.com/docs/concepts/agents/invocations/other-agents)). Lessons the agent proposes are held back until a person decides: "nothing saves until you accept" ([Hyperagent docs](https://www.hyperagent.com/docs/get-started/teach-it-something)). Liu makes the same point about people in his July 2 talk, saying humans "still own policies and decisions." His example, an unnamed landscaping business whose agent brings a proposal and quote back to the human owner, is an anecdote we could not check.

One date caution for that talk. Liu spoke on July 2 as Airtable's CEO. A Bending Spoons [Form 6-K for August 2026](https://www.sec.gov/Archives/edgar/data/2004711/000200471126000009/bsp-20260804x6k.htm) says that on August 4 a subsidiary agreed to buy Airtable, and that the Hyperagent business line was transferred to a separate company, Hyperagent Inc. A later filing, with [press release Exhibit 99.1 dated September 4, 2026](https://www.sec.gov/Archives/edgar/data/2004711/000200471126000013/bsp_ex99-1.htm), reports that Bending Spoons "has completed the previously announced acquisition of Airtable." We did not check how those changes affect the Hyperagent docs cited here.

## What none of this measures: demand

The talks lean on a growth story, and the sources do not carry it. Grinich says "There will be more agents in the future than people, maybe even today," and that open signup "should be an immediate growth boom for your products." The captions show no data behind either. WorkOS's recap forecasts that "in a lot of categories there will eventually be more agents than humans," which is a prediction. The closest data point, [Mintlify's report](https://www.mintlify.com/blog/state-of-ai) published April 3, 2026 and covering March 2026 traffic, says "AI coding agents now account for 45.3% of all requests," against browser traffic at 45.8%. That counts requests to documentation sites, not people or signups. Amplifying's [study of Claude Code](https://amplifying.ai/research/claude-code-picks/report), dated February 2026, collected 2,430 responses from one agent, Claude Code, running three models (Sonnet 4.5, Opus 4.5 and Opus 4.6) on open-ended prompts and found that "agents build, not buy": custom code was 12% of primary picks, 252 out of 2,073. None of the sources we read independently measures how many agents sign up for services or choose vendors. The nearest figure, AgentMail's "10 million agents," is a vendor claim.

What is shipping, by the vendors' own account, is the supply side. Marc Benioff [said on X](https://x.com/Benioff/status/2044981547267395620) (timestamp April 17, 2026, UTC) that "Our API is the UI. Entire Salesforce & Agentforce & Slack platforms are now exposed as APIs, MCP, & CLI." Per that post, platforms are opening a door for agents. Whether many agents walk through it is not yet measured.

## What this points to, and five checks for any business

Read together, the sources show agents being given accounts, with designs that range from a named owner on every sign-in to no human at signup. The supply side is shipping and the demand side is unmeasured, so the firmer footing is the owner question, not the growth forecast. That gives any team using agents five checks:

1. **Name a human owner for every agent account, and write it down.** Some paths here will not do it for you. Telnyx's trial is "Telnyx-owned" until an owner links a real email, Cloudflare's temporary accounts run with "no human in the loop required," and Firecrawl's auth.md lists no claim flow. AgentMail says AgentID always has an owner behind it and gives apps the name if they ask, and auth.md added a confirmation step against a takeover risk.
2. **Send account notices to a person.** No source here shows suspension or billing mail reaching an agent beyond one speaker's say-so, and one signup file says a lost key means a lost inbox.
3. **Choose approvals and network limits on purpose.** Defaults differ by product and by surface. Anthropic's agent toolset defaults to `always_allow`, Hyperagent's Live Mode to read-only, and Hyperagent in conversation to Auto.
4. **Know your data lane.** Anthropic says Managed Agents is not currently eligible for Zero Data Retention or HIPAA coverage.
5. **Treat drafts as drafts, and date every claim.** An IETF draft and a v0.6.0 spec are not settled, and Grinich's July demo and Cloudflare's own file in October do not line up on production support.

Related field notes: [Unattended AI helpers need caps, approvals and narrow keys](https://enapragma.co/field-notes/unattended-ai-helpers-need-caps-approvals-and-narrow-keys) covers the limits around an agent that runs alone, and [Installing an agent skill is running untrusted code](https://enapragma.co/field-notes/agent-skills-are-untrusted-code) covers the untrusted-code side.

Our read, which is a judgment and not a finding: the question buyers should ask is the one several of these products let you skip. Who is the person on record when the agent acts?

## Sources

- [AI Engineer, Michael Grinich, Auth for Agents: Let AI Sign Up for Your Product with auth.md (YouTube, posted October 11 or 12, 2026, from the YouTube auto-captions)](https://www.youtube.com/watch?v=nSkmXakJ6eo)
- [AI Engineer, Priyanka Phatak, Decoupling the Brain from the Hands: Claude Managed Agents, Part 1 of 4 (YouTube, posted October 11 or 12, 2026, from the YouTube auto-captions)](https://www.youtube.com/watch?v=Uv0nAf_7tyU)
- [AI Engineer, Adi Singh, The Next Trillion Internet Users Still Don't Have an Identity (YouTube, posted October 11 or 12, 2026, from the YouTube auto-captions)](https://www.youtube.com/watch?v=mBNVKkyfnE0)
- [AI Engineer, Howie Liu, Hiring Employable Agents + Startup Battlefield Finals (YouTube, posted October 11 or 12, 2026, from the YouTube auto-captions)](https://www.youtube.com/watch?v=EEt3ZSG4a1s)
- [AI Engineer World's Fair 2026, sessions list (June 29 to July 2, 2026)](https://ai.engineer/worldsfair/2026/sessions.json)
- [AI Engineer World's Fair 2026, Startup Battlefield schedule](https://ai.engineer/worldsfair/schedule?track=Startup+Battlefield)
- [WorkOS, Lifestyles of the AI-Native: WorkOS at the AI Engineer World's Fair 2026 (July 7, 2026)](https://workos.com/blog/workos-aie-worlds-fair-2026-recap)
- [IETF, Identity Assertion JWT Authorization Grant, draft-ietf-oauth-identity-assertion-authz-grant-04 (datatracker)](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/)
- [IETF, Identity Assertion JWT Authorization Grant, draft-ietf-oauth-identity-assertion-authz-grant-04 (draft text)](https://www.ietf.org/archive/id/draft-ietf-oauth-identity-assertion-authz-grant-04.txt)
- [WorkOS, MCP Night 4 recap: agent auth, auth.md, and the rise of agentic registration (May 25, 2026)](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration)
- [WorkOS, auth.md](https://workos.com/auth-md)
- [GitHub, workos/auth.md](https://github.com/workos/auth.md)
- [GitHub, workos/auth.md CHANGELOG](https://github.com/workos/auth.md/blob/main/CHANGELOG.md)
- [Firecrawl, auth.md](https://www.firecrawl.dev/auth.md)
- [Cloudflare, auth.md](https://www.cloudflare.com/auth.md)
- [Cloudflare Blog, Temporary Cloudflare Accounts for AI agents](https://blog.cloudflare.com/temporary-accounts/)
- [Telnyx, AI Agents Can Now Sign Up for Telnyx With Their Own Inbox (June 25, 2026)](https://telnyx.com/release-notes/agent-inbox-autonomous-signup)
- [Telnyx, agent signup file](https://telnyx.com/agent-signup.md)
- [AgentMail, Introducing AgentID](https://www.agentmail.to/blog/introducing-agentid)
- [AgentMail, blog index (lists AgentID on October 5, 2026)](https://www.agentmail.to/blog)
- [Anthropic Engineering, Scaling Managed Agents: Decoupling the brain from the hands (April 8, 2026)](https://www.anthropic.com/engineering/managed-agents)
- [Claude Platform, release notes](https://platform.claude.com/docs/en/release-notes/overview)
- [Claude Platform docs, Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)
- [Claude Platform docs, Cloud environment setup](https://platform.claude.com/docs/en/managed-agents/environments)
- [Claude Platform docs, Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview)
- [Hyperagent, Live Mode](https://www.hyperagent.com/docs/concepts/agents/invocations/live-mode)
- [Hyperagent, Other agents](https://www.hyperagent.com/docs/concepts/agents/invocations/other-agents)
- [Hyperagent, Teach it something](https://www.hyperagent.com/docs/get-started/teach-it-something)
- [SEC, Bending Spoons S.p.A. Form 6-K (August 2026, purchase agreement of August 4)](https://www.sec.gov/Archives/edgar/data/2004711/000200471126000009/bsp-20260804x6k.htm)
- [SEC, Bending Spoons S.p.A. Form 6-K, Exhibit 99.1, press release dated September 4, 2026](https://www.sec.gov/Archives/edgar/data/2004711/000200471126000013/bsp_ex99-1.htm)
- [Mintlify, The state of agent traffic in documentation (March 2026), published April 3, 2026](https://www.mintlify.com/blog/state-of-ai)
- [Amplifying, What Claude Code Actually Chooses (February 2026)](https://amplifying.ai/research/claude-code-picks/report)
- [Marc Benioff on X (timestamp April 17, 2026, UTC)](https://x.com/Benioff/status/2044981547267395620)