The report
An unknown automated visitor can reveal which model and software harness are behind its requests even when it refuses to name them reliably. Shibboleth uses controlled services and task prompts that capture an agent's declarations, response patterns and tool behavior. In its paper, combined identification reached roughly 90% to 92% top-one accuracy in the tested MCP and agent-to-agent settings.
Which signal carried the result?
The paper's headline figures should not be described as pure behavioral identification. Declarative responses alone correctly named the model in 84% to 90% of runs, while behavior-only inference was much weaker, roughly 36% to 54% in the reported comparisons. Combining them filled gaps but also introduced wrong model attributions that the exact valid declarations had not produced. Timing, redaction style and action order can still matter, especially when a model is instructed to lie, but a closed candidate list is an important condition of the measured accuracy.
The study used a fixed collection of model versions, task environments and harness families. An unseen model, customized wrapper or intentionally shaped traffic can make a forced-choice fingerprint incorrect. The Shibboleth Case therefore treats the technique as triage evidence rather than proof of who operated an intrusion.
The attribution boundary
A fingerprint can narrow the likely software stack and help investigators decide which logs or protocol behaviors to inspect. It cannot establish the human operator, employer, country or sponsor. Nor did the experiments require a successful prompt injection or a real hostile access. Independent session evidence, credential origin and infrastructure traces would be needed before connecting a recognized harness to a particular actor.