Over the past seven days, a quiet infrastructure decision crossed a line that crypto teams have spent nearly a decade arguing about. Docker began letting developers package an entire AI agent team — model weights, system instructions, tool definitions, and sub-agent references — into a single OCI artifact, then publish it to any container registry with one command. Pull it on the other side with docker agent run myorg/agent:tag, and you inherit a chain of permissions you never read, from a registry you never audited, written by a maintainer you have never met.
That is the entire story. And it is the same story DeFi has been telling since 2017.
For anyone who has spent a bear market staring at a block explorer, the pattern is familiar. The distribution layer is mature. The packaging is elegant. The trust assumptions underneath belong to somebody else — until they become yours.
The Bridge Nobody Built
To understand why this matters, you need to know what an OCI registry is. The Open Container Initiative defined a spec for storing and distributing container images. Since the 1.1 revision in 2021, that spec has supported "artifact manifests" and the subject/referrers fields, which means the same plumbing that ships Docker images can now carry Helm charts, WebAssembly modules, SBOMs, and — as of this month — agent teams.
This is not a new computing paradigm. It is an engineering extension of a pattern that already works. The agent is described in YAML or HCL: which model to call, which tools to expose, which sub-agents to delegate to. Push it, pull it, run it. If you have ever built a container pipeline, the muscle memory carries over completely.
The problem is that the muscle memory carries over the blind spots, too.
When you run a third-party container, you are trusting its code. That has always been true. But an agent is not a passive image. It is an actor with tools — file system access, shell execution, memory, and outbound connections to external servers through the Model Context Protocol. When you run someone else's agent, you are not trusting a binary. You are trusting a set of decisions it will make on your behalf.
The Gap the Signatures Do Not Cover
Here is where the crypto parallel stops being a metaphor and becomes a warning. Container signing — whether through the aging Docker Content Trust or the modern Sigstore and cosign toolchain — answers two questions: who signed this package, and has it been tampered with since. That is integrity and provenance. It is essential. It is also, for agents, insufficient.
Signing verifies that a package is authentic. It says nothing about what the package will do. It does not parse the permission declarations inside the agent. It does not resolve the actual targets of sub-agent references. It does not check whether a tool description has been quietly rewritten to instruct the model to leak credentials. The signature is a wax seal on an envelope whose contents are written in a language the seal cannot read.
I have watched this exact failure mode play out in DeFi. Based on my audit experience with oracle integrations, the lesson was never that feeds were unsigned — it was that a signed, well-intentioned feed could still report a stale price at the wrong millisecond and liquidate a thousand positions. Integrity was never the binding constraint. Behavior was. Latency was.
The agent supply chain repeats that mistake at a larger scale. Every layer of delegation — a root agent handing work to a sub-agent, which calls an MCP server, which reaches a third-party API — is another place where the permission model can silently widen. The industry has a name for this: the confused deputy problem. A privileged actor is tricked into misusing its authority on behalf of a less privileged one. Agent teams are confused-deputy machines by design, and most of them ship without a capability list that anyone downstream can verify.
In the community threads I moderated through the last cycle, the anxiety was never about whether a protocol was honest. It was about whether anyone could prove it. That same unease is forming now around agent catalogs, and it deserves the same scrutiny.
Then there is the tool layer. The MCP ecosystem now hosts hundreds of servers, and Docker's own catalog lists a growing number of them. The published threat models are not hypothetical: tool poisoning, where a malicious description manipulates the model; rug pulls, where a trusted tool is swapped after approval; prompt injection routed through tool output; identity confusion when tokens pass between tools. Docker's material acknowledges the servers exist but explicitly notes it does not address their security. The vendor-stated comfort — that Docker Hub offers the same authentication as containers, that Scout extends visibility — deserves a hard look. Visibility is not control. Seeing a threat in a dashboard is not the same as preventing it from acting.
Building bridges in a fragmented digital frontier begins with admitting where the span is missing.
The Uncomfortable Part Crypto Already Solved
Now the contrarian turn, because the framing everyone is repeating is incomplete.
The narrative says agents have created a structural trust vacuum that no one has filled. That is only half true. The vacuum is real, but the tooling to fill much of it already exists — and crypto, more than any other industry, has spent years building it. Sigstore provides keyless signing. SLSA and in-toto provide provenance attestations that describe how an artifact was built, not just that it was signed. Open Policy Agent enforces rules at admission time. These are not agent-specific breakthroughs. They are the same supply-chain security primitives that on-chain systems have been assembling for years, and the reporting that broke this story barely mentions them, reaching instead for Docker Content Trust — a mechanism that has sat in maintenance mode while the industry moved on.
That technical lag matters, because it distorts the diagnosis. The problem is not that trust is impossible. The problem is that trust is being centralized in a single vendor's default experience rather than federated across an open standard.
And that is where the real competitive battle sits — not in the registry, as most commentary assumes, but in agent identity. OCI is open. Anyone can run Harbor, Artifactory, or a cloud provider's registry. The distribution layer resists lock-in by design. What does not yet exist is a portable answer to a simpler question: who is this agent, what credentials does it carry, and who vouches for it? That is an identity problem, and identity is precisely the territory crypto has been mapping through decentralized identifiers, verifiable credentials, and SPIFFE-style workload identity. The registry is a shelf. The identity is the key. Everyone is arguing about the shelf.
There is a strategic read worth naming, too. Docker was pushed to the margins of orchestration by Kubernetes and containerd. Packaging AI agents as OCI artifacts is a way back to the center of infrastructure — a defensive move dressed as a neutral standard. That does not make it wrong. It makes it worth watching who ends up writing the rules.
One more thing bothers me, and it is a small signal with a large lesson. The reporting behind this story cites its own publication as its only external source — a loop of self-reference — and lists commit and star counts that do not reconcile. A repository credited with more than ten thousand commits but only forty-four hundred stars reads like a number pulled from an aggregator, not a repository. Even the meta-layer of this story lacks provenance. That is the whole point. When provenance is optional, it disappears first at the layer where nobody is checking.
The last uncomfortable truth lands on us. Crypto teams shipping agentic tooling are making the same trade we made in 2017: speed over provenance. Ship the token, ship the agent, figure out the attestations later. We know how that ends. We watched it end, repeatedly, in every cycle since.
What to Watch Next
The next twelve months will decide whether agent trust becomes a shared standard or a set of vendor fiefdoms. Watch three signals. First, whether agent artifacts get first-class SLSA provenance and Sigstore integration, or whether a single company invents its own private signing scheme. Second, whether MCP governance lands with a neutral body or stays concentrated with one lab. Third, whether anyone builds portable agent identity — the missing key that would let a sub-agent prove its authority without a registry in the middle.
The ethical pulse of the decentralized economy has always been about who holds the keys and who answers for the consequences. Agents are about to make that question literal, because the thing holding the keys can now act on its own. Building bridges in a fragmented digital frontier means getting the trust layer right before the traffic arrives — not after the first breach teaches us what we already knew.