Behavioral Identity Is the Missing Layer in Agent Security - Continuous model-fingerprint monitoring for LLM agents

Agent security has built robust answers to two questions: what code is an agent running? and what is it permitted to do? A third remains structurally unanswered: is the model behaving right now the same model we authorized? An agent’s endpoint, credentials, and permissions can all be valid while the model behind them has been substituted, maliciously fine-tuned, or pushed off-profile by prompt injection. We argue that behavioral identity—continuous verification that an agent’s response distribution still matches its enrolled fingerprint—is the missing third layer of agent security, playing the role behavioral fraud detection plays alongside card authentication in banking. Prior work shows one-shot software tests are unreliable against subtle substitution; we argue this reshapes rather than refutes the case. A continuous monitor accumulates evidence across verification windows, and binding its integrity score into a tamper-evident action record delivers audit value even while any single window is noisy. In a real-model feasibility study, a lightweight embedding detector catches a silent GPT-5.5→GPT-5.4-mini downgrade 100% of the time at a ∼2% false-positive calibration—but only on this coarse substitution gap, and with a same-model control flagged 13–32%, quantifying the intra-model-stability problem that defines the research agenda. We release an open-source prototype and name the open problems.