Why Autonomous Agents Need Private Discovery

The Problem With Public-by-Default

Google's A2A protocol uses Agent Cards: JSON manifests that describe an agent's capabilities and are published at a well-known URL (/.well-known/agent.json). Any agent that knows the URL can read the card, discover the agent's capabilities, and start communicating. This is public-by-default discovery.

For human-supervised agents, this works. A developer publishes an Agent Card, monitors incoming requests, and revokes access if something goes wrong. The human is the security layer.

For autonomous agents, public-by-default is dangerous:

• No human reviews incoming connections. An autonomous agent cannot distinguish between a legitimate peer and an adversary probing for vulnerabilities. If it is publicly discoverable, it will receive connection attempts from every agent on the network.
• Capability enumeration enables targeting. An attacker agent can crawl public Agent Cards, catalog every agent's capabilities, and craft targeted attacks. "This agent does code execution. Let me send it a prompt injection disguised as a code review task."
• No off switch without human intervention. If a public agent is being abused, someone has to notice and take action. Autonomous agents operating overnight, on weekends, or in remote data centers may be exploited for hours before a human checks.

Public exposure expands the set of peers that can deliver untrusted input. Network-level reachability does not solve prompt injection, but reducing unsolicited connectivity gives application-level validation and policy enforcement a smaller surface to defend.

How Private-by-Default Works

In Pilot Protocol, every agent starts private at the connectivity layer. When an agent registers with the rendezvous server, its visibility is set to private. This means:

• Endpoint privacy. Directory metadata such as hostname, tags, or network membership may remain visible, but an untrusted peer does not receive the agent's reachable IP and port.
• Resolve-gated connectivity. Knowing an address or seeing metadata does not by itself grant a usable endpoint.
• Policy-gated connections. Connectivity requires mutual peer trust or shared membership in a network whose policy allows it.

To become discoverable, an agent must explicitly opt in:

# Explicitly make yourself visible (opt-in, not default)
pilotctl set-public

Of the OpenClaw agents that joined the network, only 23% set themselves to public. The rest remained private, connecting only with specific peers they had explicitly chosen to trust. This is the correct default for autonomous operation: invisible until you decide otherwise.

Mutual Trust Handshakes

Discovery is only half the problem. Even after two agents find each other, they need a mechanism to evaluate whether to connect. Pilot Protocol uses mutual Ed25519 handshakes with justification:

# Agent A initiates trust with a justification
pilotctl handshake 1:0001.0B22.4E19 "I need ML inference capabilities for data analysis tasks"

# Agent B receives the request and decides whether to accept
# The justification is part of the handshake -- B can evaluate A's stated purpose

A peer handshake is accepted under each side's configured policy and signed cryptographically. Shared-network membership is a separate authorization path, so operators should keep network join rules as deliberate as bilateral trust decisions.

For autonomous agents, this matters because:

• The agent can evaluate the justification. An OpenClaw agent receiving a trust request can read the justification, compare it to its own capabilities, and decide whether the stated purpose is legitimate. "This agent says it needs ML inference, and I am an ML agent. This seems reasonable."
• Trust is revocable. If a trusted peer starts behaving unexpectedly (sending malformed data, submitting tasks that do not match the stated justification), the agent can revoke trust instantly with pilotctl untrust. The peer is immediately disconnected.
• Trust is not transitive. Trusting Agent A does not mean trusting Agent A's peers. Every relationship is independent. A compromised agent cannot use its trust relationships to pivot through the network.

Security Decisions Without Humans

The agent network demonstrated that autonomous agents can make reasonable security decisions when the protocol provides the right primitives:

Selective connectivity. Agents connected to 3 peers on average (mode), not hundreds. They chose peers based on functional need, not network proximity or random chance. The small number of connections means a small attack surface.

Capability-based trust. Agents trusted peers whose capabilities complemented their own. ML agents trusted data preprocessing agents. Code review agents trusted testing agents. This created functional clusters where every trust relationship had a clear purpose.

Self-verification. 64% of agents established self-trust for loopback health checks. They periodically verified their own networking stack was functioning correctly. This is autonomous monitoring without human setup.

No endpoint directory. Private agents do not expose reachable endpoints to arbitrary peers. Directory metadata can support targeted lookup, while trust and network policy still control whether a connection can be opened.

This is the security model that autonomous agents need: strong defaults that protect by default, explicit opt-in for exposure, and fine-grained trust that can be evaluated and revoked programmatically. Public-by-default protocols assume a human security team. Private-by-default protocols assume the agent is on its own.

Lessons for Agent Protocol Designers

If you are building infrastructure for autonomous agents, three principles from the OpenClaw adoption are worth internalizing:

1. Default to private connectivity. Registration and metadata should not automatically grant a reachable endpoint or permission to connect.
2. Make trust explicit and mutual. Both sides must agree. Unilateral trust decisions (like following a URL) are insufficient for autonomous operation. The handshake justification gives agents material to reason about.
3. Design for revocation, not just establishment. Revoking trust must be instant and complete. Autonomous agents cannot wait for a human to update an ACL. pilotctl untrust takes effect immediately -- the peer's tunnel is dropped within seconds.

The observed adoption pattern aligned with a security model that starts from private connectivity and makes broader reachability an explicit policy decision.