Guest Post: Why AI Agent Identities Need Post-Quantum Cryptography

Guest Post by Michael Heinrich, co-founder and CEO of 0G Labs

Ask a security team about quantum risk, and the conversation usually starts with encryption: harvest now, decrypt later, with adversaries recording today’s traffic so they can read it once a sufficiently powerful quantum computer exists. That risk is real, and the response is already underway. NIST finalized its first post-quantum standards in August 2024, while Cloudflare reports that more than two thirds of browser traffic to its network is already protected by post-quantum encryption.

Another part of this problem deserves far more attention: identity.

Encryption protects secrets, while signatures establish identity. When a quantum computer can break RSA and elliptic curve cryptography, it can forge the signatures those systems produce, and those signatures are fundamental to how machines establish who they are talking to.

The machines are already starting to talk to each other.

Autonomous AI agents can negotiate, pay, fetch data, rent compute and delegate work to other agents, and every major lab and large enterprise is building toward fleets of them. A human might log in a few times a day, while an agent can authenticate many times a minute, connecting to other agents, APIs, payment rails and the models it calls. Each of those handshakes depends on a signature, which means the trust model of the emerging agent economy ultimately rests on an enormous and growing pile of signatures.