That’ll do it - the standard anonymous principal has a string representation of '2vxsx-fae'.
Technically speaking though, any principal that ends with 0x04 will be classified as anonymous and won’t require a signature. The one used by the agents is just an empty seed with that classification. I don’t actually know if there’s a convenient way to guard against all anonymous identities, or to easily identify them.