An AI agent is easy to copy. Its code, its configuration and the key it signs in with are just files. Move them to another machine and the copy behaves like the original and carries the same credentials. For a shared API key or a service account, the copy is indistinguishable from the real agent. This is cloning, and most agent identity schemes have no answer to it.
The missing primitive is a tie between an agent's identity and the place it runs. Oathera calls it host binding.
Why a key alone is not enough
If an agent's whole identity is a key, then whoever holds the key is the agent. Copy the key and you have copied the identity. Naming the machine changes that: an identity that includes where the agent runs cannot be silently moved somewhere else.
What host binding does
At enrollment the Identity MCP creates the agent's anchor key on the agent's own host, observes the host and computes a host digest, then starts enrollment with a request signed by the anchor key. From then on, the host digest is compared at every token request. In enforce mode a mismatch is refused, so a copied agent reporting a different host gets no token. In warn mode, the default for testing and design partners, the token is issued but marked with host drift and recorded as a high-severity alert. A reboot is not a new host. A setting can also require a verified platform attestation, which Google Cloud reaches; AWS and Azure are checked in part.
Cloning and impersonation are two attacks
There are two ways to be "not really Agent X". Impersonation is when a different agent presents Agent X's token or name; it fails because a token works only with the session key held in the real agent's memory, and a single-use operation proof is required on every call. Cloning is when Agent X's own code and key are copied to another machine; it fails because the host no longer matches the enrollment record. Host binding is the part that catches the clone.
How Oathera helps
Oathera gives every AI agent an identity bound to the machine it runs on, approved by a named person, and checked every time it acts. Host binding is built into enrollment and checked on every token by the identity service, so cloning stops being a quiet success and becomes a refused token or a high-severity alert. Anchor rotation can move an agent to a new anchor key without enrolling again, and the anchor key can be held in KMS, HSM, TPM or a secure enclave.
See it, or build it with us
Watch a stolen token fail, a replayed proof get refused and a tampered call get caught, in the simulator at sim.oathera.org. Our first design partners start in early November 2026. If you are putting agents into production, become a design partner.
Every AI agent, sworn in.