Guest Post: Why AI Agent Identities Need Post Quantum Cryptography
Short take on Michael Heinrich’s argument that AI agent identities—not just their encrypted channels—need post‑quantum cryptography, or the whole agent economy can be spoofed by future quantum attackers.
Transcript
Justy So Heinrich’s basic claim is brutal: if you don’t fix agent identity, quantum breaks your whole agent economy even if the traffic is post‑quantum encrypted.
Cody Yeah, because he splits the world into two jobs: encryption for secrecy, signatures for identity. The hype right now is, look, Cloudflare and friends are rolling out post‑quantum key exchange, NIST has these shiny new standards… but that’s mostly about keeping eavesdroppers from reading the channel.
Justy Right.
Cody Meanwhile, the signatures under a ton of machine‑to‑machine stuff are still RSA or elliptic curve. If a future quantum computer can forge those, it doesn’t need to decrypt your logs. It just pretends to be any agent or service that ever used those keys.
Justy And in an agent world that’s not a theoretical edge case. Agents authenticate to APIs, sign transactions, maybe even sign their own execution receipts. If those signatures are forgeable later, your audit trail and your payment layer are both up for grabs.
Cody Exactly. The classic phrase is harvest‑now‑decrypt‑later, but he’s basically saying harvest‑now‑impersonate‑later. Record which keys map to which agents today, wait for quantum, and then you can mint fake signatures that look like they came from the CFO‑assistant agent or the deployment agent or whatever.
Justy Which hits our whole boring‑plumbing thesis. We’ve been talking about agents as first‑class principals with their own identities. If those identities are rooted in curves quantum can snap, then the fancier your agent platform gets, the bigger the blast radius when someone can forge them.
Cody Yeah, it’s almost upside‑down. The more automated decision‑making you wire behind those keys, the more attractive they are to a quantum‑capable attacker. You don’t have to break the model, you just sign one malicious call that passes as the trusted agent.
Justy So what do you think is the actionable bit here for a team actually building this stuff, beyond, like, mild existential dread?
Cody Honestly, just inventory where signatures live in your agent stack. Not in a vibes sense—literally list which keys represent agents, wallets, or service accounts. Then watch for when those can move to post‑quantum schemes as vendors catch up. TLS getting post‑quantum is great, but it doesn’t fix your signing keys by default.
Justy Yeah, and from the product side I’d be asking vendors the rude question: are you only doing post‑quantum on the wire, or are you also planning for post‑quantum identities for the agents themselves?
Cody Because if the answer is just the wire, then the story is incomplete. You’ve made it harder to eavesdrop, but you haven’t stopped someone in the future from forging whatever your logs say that “trusted agent” did.
Justy Alright, that’s enough quantum dread for one short take—next time let’s pick something that doesn’t threaten every agent key we’ve ever issued.