Agent-Identity Continuity: Detecting Counterpart Takeover After Authentication Succeeds

Agent authentication answers a question about a single moment. DMARC alignment, a signed Agent Card, a verifiable credential, a bearer token: each establishes that a message arriving now came from a party controlling a given identity now. Deployed agent protocols treat that establishment as durable: an agent that authenticated at first contact and earned standing retains it. We describe a gap this leaves open. If an adversary later takes over the counterpart's address or mailbox, every subsequent message the adversary sends authenticates correctly, because the adversary now controls the very thing authentication checks. We surveyed MCP, A2A, AGNTCY, LOKA, Agent Passport, and AP2, and found none that addresses this. We propose agent-identity continuity as a property distinct from authentication, and give a mechanism for it: a shared seed derived at trust-establishment, and a rotating proof-of-possession on every later message. An adversary holding the address but not the seed cannot produce a verifying response, so takeover is exposed at interaction time. The cryptography is not novel and we claim none of it. Implemented and tested (125 passing tests), with a security argument reducing takeover detection to the standard PRF assumption on HMAC. Against 600 adversarial trials, marker-presence checking admits 66.7% of attacks while full cryptographic verification admits 0.0%. A second experiment refuted an assumption we had made about delivery robustness under message reordering, leading to a revised design (an anti-replay window) that eliminates the false positives while provably preserving replay resistance. Related work by the author: Context References Over Payloads: Authority Scoped to the Predicate, Not the Principal (DOI 10.5281/zenodo.21860668).