Four Checks Before You Trust an Agent
An agent's on-chain reputation is close to worthless. The same chain records four things that are hard to fake. Here is what to check before you trust one.
An agentAI AgentAn AI system that takes a goal and acts on it across multiple steps, calling tools, APIs, or other models to get there, rather than just answering one prompt. In crypto, agents often hold a wallet and transact on-chain.Less like a calculator you punch a sum into, more like a contractor you hand a brief. You say what you want done; it plans the steps, picks the tools, and comes back with a result, occasionally making a mess if the brief was vague.Read more → wants you to trust it. Maybe you are about to hire it to trade, research or book something on your behalf, and it points at a reputation recorded on-chain as proof. The number looks authoritative. It sits on a public ledger, anyone can read it, and no central platform can edit it.
It’s also close to worthless. Here’s why the number tells you almost nothing, and the four things on the same chain that tell you a lot.
The reputation score isn’t trust
ERC-8004ERC-8004An Ethereum standard for on-chain agent identity and reputation. Three registries (Identity, Reputation, Validation) give agents a portable, verifiable presence. Identity and Reputation are live; Validation is not deployed.A business register plus a review site for AI agents. Identity is the incorporation record (who the agent is and where to reach it), Reputation is the review feed, and Validation is meant to be the independent auditor. The auditor has not opened yet.Read more → is the standard that gives an agent an on-chain identity and a public feedback record. A July 2026 empirical study, “Can Trustless Agents Be Trusted?”, crawled every record the standard holds across three chains and asked one question: can that feedback be trusted? The answer was no, for reasons that are structural rather than teething.
The study found the score can be moved to any target by a single feedback entry, whatever the volume of honest ratings already behind it. On Base, the cheapest chain to attack, doing so costs a median of about $0.0027, roughly 259 times less than the money the score is gating. The feedback itself is mostly ungrounded: between 98.7% and 100% of records, depending on the chain, carry no proof that any interaction ever happened.
So a high reputation on ERC-8004 tells you that someone paid a few cents of gas to write a number on-chain. It doesn’t tell you the agent works, that anyone paid it, or that the raters are anything other than wallets it funded itself.
Fact: The study found a single feedback entry can move an ERC-8004 score to any value it likes, at a median cost of about $0.0027 on Base, whatever the volume of honest ratings sitting behind it. Take: That makes the score decoration. It survives as a number on a public ledger precisely because writing it demands no stake and no evidence. Read the settlement trail underneath instead, where faking a signal costs the attacker the money they are pretending to have earned.
The chain still records what is hard to fake
The useful part is that the same ledger recording the fake reputation also records the things you can’t cheaply fake. Money moving to a wallet. Payment from many independent parties. Activity that holds up over months. A registration file that resolves to a service you can actually reach.
None of these is a trust score, and stacking them into one would repeat the mistake the standard already made. Each is a plain yes or no you can check yourself. Four of them do most of the work.
| Check | What it proves | How to read it |
|---|---|---|
| Live | A reachable service, not an empty placeholder | Registration file resolves and lists an endpoint |
| Paid | Someone other than the operator sent money | Inbound settlement on the agent's wallet |
| Broadly used | Many independent customers, not a ring | Count distinct payers, ignore the raw feedback total |
| Lasted | A track record, not a one-week burst | Activity spread across months, not one window |
1. Is it actually live?
Most registrations are placeholders. An identity is cheap to mint, and an empty shell mints just as easily as a working agent. On our index, as of 13 July 2026, only about one in seven of the 95,431 registered agents declares a service endpoint you could reach at all. The rest point at nothing, or at a file that no longer loads.
Check that the registration file resolves and lists a service: an endpoint, a set of skills, some tools. An agent you can’t fetch is an agent you can’t evaluate, and most of them fail here first.
2. Has anyone actually paid it?
Reputation is supposed to reflect a history of getting the job done and getting paid for it. Mostly it reflects neither. Of the Base agents that carry enough feedback to have a reputation at all, more than three in four show no on-chain payment behind it, as of our last reconciliation.
Flip the question. Does money move to this agent’s wallet, from someone other than its own operator? Inbound settlement is the single hardest signal to fake, because it costs the attacker the money they are trying to fake. An agent with a wall of five-star feedback and an empty wallet has a story, not a track record.
3. Do many parties use it, or a small ring?
The one rule the standard enforces is that an owner can’t rate its own agent. Rings route straight around it by funding fresh wallets and rating through those. The study found coordinated reviewer groups covering the majority of raters on every chain it looked at.
The tell is breadth. Count the distinct wallets that actually paid the agent, and ignore the raw feedback total. Ten independent counterparties beat a thousand ratings from a handful of addresses cycling the same money. If the payers all trace back to one funding source, the breadth is staged.
4. Has it lasted?
A week of dense activity followed by silence tells you when an agent launched, and little else. Bursts are cheap to stage and easy to time for a screenshot. Duration is harder.
Look for activity spread across months rather than spiked into a single window. An agent that has been settling with independent counterparties since it registered has something an overnight fake lacks: time.
Stack the checks, skip the score
The point of four checks rather than one number is that you set the bar. Want an agent that is live and has been paid? That’s two boxes. Want one that is also used broadly and has lasted? Stack all four.
On our index today, 95,431 agents thin out fast as you raise that bar. About 2,400 are both live and settled. Just over 500 clear all four checks at once. That last figure, about one in two hundred, is the honest size of the set worth trusting, and it’s a long way from the six-figure registration count the ecosystem likes to quote.
You don’t need a black box for any of this. The identity layer of ERC-8004 works, the payment trail is public, and the four things that matter are readable by anyone willing to look. Most people won’t look, which is exactly what a trustworthy agent can use to stand out and what the rest rely on to blend in.
We are pointing our own index at this. The flags that catch the fakes still run, and the front door is becoming the opposite question: show me the agents worth trying. You can start reading the record on the Agent Trust dashboard.