AC2 协议：人工智能体缺失的安全层

AC2 协议：人工智能体缺失的安全层
AC2 Protocol: The missing security layer for AI agents

AC2 协议是 Algorand 基金会推出的一个开源项目，旨在通过硬件绑定认证和点对点通信来解决人工智能的信任挑战。作为一款非托管钱包，AC2 确保用户能够独享对其助记词和资产的控制权。用户需自行负责个人安全；Pera 钱包无法找回丢失的密钥或账户。由于加密货币交易不可逆，且资产具有波动性和流动性风险，用户务必谨慎行事，并自行管理相关的税务与法律义务。此外，智能代理商务（Agentic Commerce）的集成带来了一些特定风险，包括潜在的欺诈行为和身份验证问题。强烈建议用户和商家核实所有代理身份，并遵循既定的安全与合规最佳实践，以降低这些风险。

AC2 Protocol is an open-source security layer designed to secure AI agents by replacing vulnerable chat-based approvals with hardware-bound, phishing-resistant signatures. By leveraging WebAuthn/FIDO2, DIDComm, and WebRTC, the protocol enables users to provide verifiable proof of intent for AI actions—such as API calls, git commits, or payments—without exposing private keys or session tokens to the agent's runtime. The project has sparked debate on Hacker News, primarily due to its association with the Algorand blockchain and Pera Wallet developers. Critics expressed skepticism regarding the necessity of cryptocurrency, fearing the protocol may be a "crypto-faded" tool. The developers clarified that while the reference implementation supports Algorand for payment use cases, the core protocol is blockchain-agnostic. For most applications—such as securing API access or code deploys—AC2 functions entirely without cryptocurrency, relying solely on standard cryptographic primitives. Proponents argue that such cryptographic barriers are essential for governing autonomous agents, while the project team has acknowledged community feedback regarding their branding and is considering de-emphasizing blockchain references to highlight the protocol’s utility as a standalone security standard.

原文

Solving the AI trust problem with hardware-bound authentication and peer-to-peer communication.

Disclaimer: AC2 is a self-custodial Algorand wallet. You — and only you — hold your seed phrase, your keys, and your crypto-assets on your own device. Pera Wallet, Lda does not hold, custody, or have access to your seed phrase, your keys, or your crypto-assets, and cannot recover them on your behalf.

If you lose your device or your recovery phrase, your access to anything you have linked through AC2 may be permanently lost. Your recovery phrase is the only way to restore access to your wallet. Pera cannot recover it for you. If you lose it, your crypto-assets and account associations are lost permanently. Do not share it with anyone, including anyone claiming to be Pera support.

Crypto-asset transactions are irreversible once confirmed on the Algorand network. Crypto-assets are volatile, may lose value, and may become illiquid or unavailable. You are responsible for any tax or other legal obligations arising from your use of crypto-assets.

The use of agentic commerce involves risks, including potential fraud and identity verification issues. Users and merchants should ensure they are using verified agents and follow best practices for security and compliance.

AC2 协议：人工智能体缺失的安全层 AC2 Protocol: The missing security layer for AI agents

Solving the AI trust problem with hardware-bound authentication and peer-to-peer communication.

AC2 协议：人工智能体缺失的安全层
AC2 Protocol: The missing security layer for AI agents