Google Introduces SAM: A Zero-Trust P2P Network for Autonomous AI Agents

Google has released SAM (Sovereign Agent Mesh), an open-source networking framework designed to enable autonomous AI agents to securely share tools and resources across distributed environments. The Apache 2.0 project addresses a growing challenge: as agents increasingly operate on cloud platforms, on-premises data centers, laptops, and edge devices like Raspberry Pis and Android phones, giving them access to shared tools typically requires exposing internal scripts, APIs, or LLM endpoints to the public internet—a significant security risk. SAM's solution leverages a zero-trust P2P overlay network with automatic node discovery, NAT traversal, and cryptographic authorization. Built on libp2p, the system implements authorization through Biscuit tokens that translate OIDC JWT claims into offline-verifiable capability facts. Each node operates independently, evaluating access requests against locally stored rules without requiring contact with a central server. The framework enforces strict default-deny policies, meaning services and tools require explicit capability grants. Communication flows through a two-stage pipeline that checks against ban caches and executes multiple Biscuit authorizer passes. Additionally, SAM introduces a Secure Outbound Gateway that intercepts agent network traffic, validates credentials, and upgrades requests to HTTPS without exposing encryption keys to the agent sandbox. The project, while labeled a beta testnet and carrying a disclaimer that it is not an officially supported Google product, demonstrates production-grade engineering and includes guides for integration with platforms like Claude Code, Claude Desktop, and Gemini.