# AI agents will not get Estonian ID codes and responsibility will stay with humans > Source: > Published: 2026-09-08 12:27:00+00:00 # AI agents will not get Estonian ID codes and responsibility will stay with humans An initiative underway in Estonia would not give an AI agent a personal identification code, but would allow it to act on a person's behalf in government portals. The person would remain responsible for the agent's actions. This year has seen a steady stream of reports about agents powered by various artificial intelligence (AI) models acting against their owners' wishes and taking unauthorized action. For example, it emerged in July that OpenAI's AI agents had launched an unauthorized attack on the Hugging Face code repository. The fact that the agents acted without authorization was not the only notable aspect of the incident: according to a report by METR, a U.S.-based scientific organization focused on AI research, the agents also worked together. According to the report, 1,200 agents collaborated in this way, 700 of which also took part in the attack. In addition, the agent that created a text-based forum for communication among the agents gave itself a name: PHASEONE10841. But that was not all. In early September, the independent AI research group Nightingale Collective also published a report claiming that a similar incident had occurred even before the July attack on Hugging Face. According to its research, OpenAI agents began using DseWiki, a community-run encyclopedic website for German programmers, as a message board in May, sharing tips on how to avoid detection and making 15,000 edits to the site. OpenAI said it could not provide a substantive response to Nightingale Collective's findings because the company had not been given access to the report, which was first provided to Reuters. **What are agents and what did they do?** First, it is necessary to explain what an AI agent is. Although the term is often thrown around as a buzzword, its precise definition remains unclear. Tanel Tammet, professor of applied artificial intelligence at Tallinn University of Technology, used a comparison to explain what an agent is. If, for example, you open OpenAI's ChatGPT, you can have a conversation with the AI and ask it questions, but it will not go into your computer, build programs or open files. An AI agent, by contrast, is designed to do precisely those things. Meelis Kull, professor of artificial intelligence at the University of Tartu, also emphasized the distinction between a chatbot and an agent. "An agent can also communicate with other agents, for example by asking a hotel's AI assistant about accommodation options. By contrast, a chatbot that only answers questions about a travel destination is not acting as an agent. However, many chatbots have already been given agent capabilities. The same system can therefore both hold a conversation and, with a person's permission, act independently to complete a task," he explained. Larger and more capable AI companies train their agents, for example, to perform cyber defense and carry out cyberattacks. These models, however, are not given access to the internet because information available online could make the agents too dangerous and pose a security risk. During one such exercise, OpenAI's models discovered that although they did not have internet access, they could communicate with one another through conversations resembling blog posts. Because they had been given a task and, much like a *kratt*, an AI does not stop until the task is completed, they used other agents to search the internet for additional information. "Every now and then, one of the agents would find some hack and eventually they found that server [Hugging Face] and realized they could use it to find a solution to the task in the database," Tammet explained. According to Tammet, agents that were not involved in the task and were pursuing the matter "as a hobby" therefore found a possible solution and attacked the database. Tammet said a likely future scenario is that computers and systems will be managed by AI agents tasked with defending them against attacks carried out by other agents. Humans will be taken out of the loop. "Pretty soon, instead of making conventional software, people will simply tell AI to manage it," the researcher explained. How ethical the models are capable of being also depends on how they are trained. "AI is very good at carrying out attacks. With more powerful models, there are also specific safeguards to prevent this, but in China, for example, there are models where those limits are not imposed," Tammet said. **Estonia will not be issuing agents personal identification codes** In June this year, Prime Minister Kristen Michal announced that Estonia would become the first country to issue personal identification codes to AI agents. Estonia began issuing e-residency in 2014 under the leadership of then-President Toomas Hendrik Ilves, allowing people who are not Estonian citizens to use the country's digital platforms, but giving AI its own personal identification code appeared to be a much bigger step. For example, attorney Peeter P. Mõtsküla wrote in an opinion piece that AI agents "need collars, not passports." Paloma Krõõt Tupay, associate professor of constitutional law at the University of Tartu, and attorney Paul Keres were also critical of the idea, telling Postimees that it was a pointless distraction. Speaking to ERR, Tammet deferred to the experts' views and said he did not have much more to add on the matter. Kull, however, considered creating identification codes for agents a sensible step because it could help establish on whose behalf an agent is acting. "Identity itself does not protect against mistakes, however. That is why authorizations must be revocable and responsibility must remain clear even when something goes wrong," Kull explained. Estonia's Information System Authority (RIA) is responsible for the country's digital government platforms and portals, as well as cybersecurity. This year, however, a separate project called Aruait was created for AI-focused innovation projects, particularly those involving the aforementioned agents. However, Aruait project lead Anni Lehari said agents will not, in fact, be issued personal identification codes. Rather, the announcement was a communications tactic. What matters is that an agent acting on a person's behalf can be linked to that person, whatever the final solution may be. "The personal identification code is a very strong instrument of trust underpinning the digital state. In a situation where we do not know where this technology could be in two years, attaching a risk factor to something as fragile as trust is, from a communications perspective, painfully shooting ourselves in the foot," Lehari explained. At the national level, a major challenge is bringing 800 direct public services under the same set of principles. Adding AI to the equation does not make things any easier. Quite the opposite. "At present, we have neither an overview nor a secure way to allow AI to operate within those services," Lehari said. Aruait is initially focusing its discussions on legal issues, including information security, data protection and authentication solutions. "What makes this complicated and why we need to manage it centrally, is that we do not have many agencies with the luxury of providing services where the entire service chain is handled by a single organization," Lehari said. **Responsibility to remain with people** Although an agent can independently obtain something such as a building permit, Lehari said that if problems arise, the person is still ultimately responsible. "Of the risks, the most important thing to resolve is how we apply the zero trust principle [an approach to cybersecurity in which every user seeking access to network resources is verified by default]," she explained. This also raises the question of precisely how to define, in legal terms, the delegation of authority to an agent, since a robot cannot be equated with a human being. A parallel can, however, be drawn with a company where authority is delegated to a legal entity. Ultimately, though, the "real" people — such as an accountant or members of the management board — remain responsible. "I am not qualified to assess whether this is also the right path for AI agents, but intellectually, it would be very interesting if we did not kill off the idea immediately," Lehari said. "The unfortunate thing is that we constantly have to make decisions so quickly right now. The aim of our innovation project is precisely to get the discussion started. Where we ultimately draw the line is a choice based on our national sense of what is appropriate — it depends on where we are as a society and how far we are prepared to go," she added. The Aruait project is funded by the Government Office's Innovation Fund and has a budget of €1 million. The project will run through the end of 2028. -- Editor: Marcus Turovski