Introducing agentmark: Cryptographic Provenance for AI-Generated Code

Published by CloudDon Research · May 1, 2026*

Cross-posted here.

Header image generated by Claude.ai.

75% of new code at Google is AI-generated. Which 75%?

When Sundar Pichai shared that number at Google Cloud Next 2026, the follow-on question nobody could answer was: which code, exactly? The same gap exists at Snap (65%), Meta (75% target), Anthropic (~100%), and across enterprises industry wide. Sonar’s 2026 State of Code survey found 42% of code committed by professional developers is AI-generated or assisted. The code is there — written by Copilot, Claude, Cursor, Gemini, Codex — but there is no audit trail, no cryptographic proof, no way to answer the question: did an AI write this, or a human?

The EU AI Act’s Article 50 transparency obligations take effect August 2, 2026 — initially focused on deepfakes and AI-generated content disclosure, but with the European Commission explicitly considering how to extend marking requirements to AI-generated software code. The US defense procurement ecosystem is asking similar questions today. Enterprise DevSecOps teams have no answer.

Today we’re releasing agentmark — an open standard and Python SDK for cryptographic provenance of AI-generated code.

The Problem

Sundar Pichai framed the 75% AI-generated code metric as a productivity milestone. But the gap underneath the number is what should concern engineering leaders, regulators, and procurement officers: which code, exactly?

You can look at git blame and see who committed it. You cannot tell whether that person typed it or accepted a suggestion from an LLM or an AI agent. How do you prove a pipeline ran autonomously without human intervention? You cannot produce an audit trail that satisfies a regulator asking “show me which commits came from an AI agent.”

Existing standards don’t cover this:

• SLSA proves build pipeline integrity — not AI authorship
• SBOM / AI-BOM inventories which models a project uses — not which API call produced which commit
• C2PA handles media provenance — not code commits
• sigstore handles artifact signing — not AI-awareness

The gap between “we used AI to write this” and “here is cryptographic proof AI wrote this” is where agentmark lives.

What agentmark Does

agentmark proves that code traveled through a verified autonomous AI pipeline with no direct human write path.

Every agentmark-verified commit carries a manifest:

json

{
  "version": "1.0",
  "provider": "anthropic",
  "model": "claude-sonnet-4-20250514",
  "request_id": "req_011CZRtQztYq...",
  "output_hash": "sha256:a1b2c3d4...",
  "challenge_token": "agentmark-3f9a2b1c4d5e6f7a",
  "challenge_echo_verified": true,
  "pipeline_key": "karta-coder-v1",
  "signature": "TuBWjzVsxEwy33mS..."
}

Four proofs in every commit:

output_hash — sha256(raw_llm_response) == sha256(committed_code). Proves the committed code matches the LLM’s raw HTTP response byte-for-byte. Any edit — even a single space — breaks the hash. This is tamper-evident provenance at the byte level.

challenge_token — agentmark issues a unique single-use token per task, embedded in the prompt. The LLM must echo it in its response. The echo is covered by output_hash. Proves the LLM processed this specific task — not a replay, not a fabrication.

request_id — every major LLM provider (Anthropic, OpenAI, Google) returns a unique request identifier in response headers. Captured and included in the manifest. Proves a real API call happened.

Ed25519 signature — a registered pipeline identity signs every commit. The signature is recorded in the manifest. In v1.0, signature presence and structure are checked; cryptographic verification against a public key registry (expected to ship in v1.1). Please see “What agentmark Honestly Cannot Prove” below.

Together, these four mechanisms make the cost of faking agent authorship higher than the cost of being honest.

What agentmark Honestly Cannot Prove

We document this explicitly in SPEC.md §4.

The irreducible gap: a human who runs the complete agentmark-compliant pipeline — real API call, verbatim commit, valid manifest — is indistinguishable from an agent. This is by design. They have built an agent. The philosophical distinction between “human running agent pipeline” and “agent running agent pipeline” collapses. We think that’s acceptable.

What agentmark proves is not “this entity is an AI.” It proves: this change entered through a verified autonomous pipeline with no direct human write path. That distinction — borrowed from a synthesis of perspectives from multiple AI systems we consulted during design — is the version worth building.

What v1.0 enforces vs. what v1.1 will add:

The cryptographic security in v1.0 comes from three of the four mechanisms working together: challenge_token (server-issued, single-use, echo-verified), output_hash (byte-for-byte match between committed code and raw API response), and request_id (format-validated against provider patterns). These three alone make the cost of faking AI authorship higher than the cost of being honest.

The fourth mechanism (Ed25519 signature verification) is implemented in the SDK (manifests are signed) but not yet enforced by the GitHub App verifier (which currently checks signature presence and structure, not cryptographic validity). This means in v1.0, the pipeline_key field is identity metadata rather than a cryptographically verified claim. Full signature verification including a public key registry and pipeline registration flow is the v1.1 priority.

How We Validated It

Before writing a line of SDK code, we validated the core mechanisms with real API calls.

Test 1: output_hash stability — made a real Anthropic API call, computed sha256 of the raw response bytes, confirmed it’s deterministic and that any edit breaks it.

Test 2: challenge token — embedded a challenge token in a prompt, confirmed GPT-4o echoes it reliably, confirmed the echo is present in raw response bytes (and therefore covered by output_hash).

Test 3: signing (SDK) — generated Ed25519 keypairs, signed manifests, confirmed tampered manifests and wrong keys are rejected by the SDK verifier. Worker-side enforcement ships in v1.1.

Test 4: end-to-end with attacks — ran the full pipeline and tested three attack scenarios:

• Attack A: human edits LLM output → output_hash mismatch → REJECTED
• Attack B: fake challenge token → not in registry → REJECTED
• Attack C: replay attack → challenge already used → REJECTED

All 19 SDK unit tests pass. The cryptographic foundation is sound.

First Production Run

On April 29, 2026, the first agentmark-verified PR landed in the Karta repository.

The flow:

1. Issue #33 was opened — a feature request for a manifest validator utility
2. The agentmark GitHub App posted a single-use challenge token as a comment on the issue
3. A coding pipeline picked up the issue, fetched the challenge token, and made a real Anthropic API call with the token embedded in the prompt
4. The model echoed the token in its response — captured in output_hash
5. The pipeline built and signed an agentmark manifest, committed the code, and opened PR #35
6. The agentmark GitHub App verified the manifest automatically — challenge token consumed from KV, output_hash validated, agentmark/verify check turned green
7. CI checks passed and the PR merged

Zero human commits in the feature code. Cryptographically verifiable from issue to merge.

The merged PR — #35 — carries an agentmark manifest in the commit message that anyone can inspect.

The Roadmap

agentmark v1.0 is the manifest standard — output_hash, challenge_token, request_id, and Ed25519 signing — plus the GitHub App that issues challenge tokens and verifies PRs. It works today for Anthropic and OpenAI with local model support in non-strict mode.

Future work, in order of priority:

• v1.1 — Pipeline identity registry and signature enforcement. A public key registry, pipeline registration flow, and Worker-side Ed25519 signature verification. This closes the “signature is metadata, not a cryptographic claim” gap from v1.0.
• Provider-native verification — verify_request(request_id) endpoints from Anthropic, OpenAI, and others. agentmark is designed to be the standard they implement against when they build it.
• Notary service — a third-party service that cross-verifies request_ids with providers, issuing signed certificates. Closes the request_id format spoofing gap without requiring provider cooperation.
• TEE attestation — agents running in Gramine/SGX enclaves, producing hardware attestation reports that prove the exact pipeline binary ran with no human I/O path.

Who This Is For

Agent-first open source projects — projects where the constraint is that no human commits application code. agentmark makes that claim verifiable.

Enterprise AI governance teams — commit-level traceability for the code your AI tools are generating. The missing piece between “we use Copilot” and “here is our AI code audit trail.”

Defense and critical infrastructure — procurement-grade verification for AI-generated code in regulated environments. The question “can you prove this wasn’t written by an AI without your knowledge?” now has a technical answer.

Get Started

bash

pip install agentmark
pip install agentmark[anthropic] # or [openai], [all]

The full specification is at SPEC.md. The landing site is at agentmark.dev.

agentmark is Apache 2.0. Contributions welcome across all areas: spec feedback, provider integrations (Google Gemini, Mistral), SDK implementations (TypeScript, Go, Rust), framework integrations (LangChain, CrewAI, AutoGen), or more. Please check the full specification.

A Note on How This Was Built

The design of agentmark emerged from a structured research process: market validation, technical validation, competitive analysis, stress-testing each cryptographic mechanism individually before combining them, and consulting multiple AI systems (Claude, ChatGPT, Gemini) on the fundamental question of whether “proving an entity is an AI” is even the right question to ask. The entire source code is AI-generated (using Claude.ai).

It isn’t. The right question is whether the change entered through a verified pipeline. That reframe, and the architecture that follows from it, make agentmark worth building.

agentmark is an open standard built by CloudDon Research

*agentmark.dev · github.com/aiagentmark-dev/agentmark · pip install agentmark*

*Entire post generated using Claude.ai with manual edits.