Not yet, at least not on the strength of their on-chain ratings. A 2026 academic study of a draft standard for “trustless” agents found that once likely fake reviews were removed, 78% to 87% of rated agents on two of the three chains studied had no rating left at all.
A note on the legal and regulatory points here: they summarise public sources as of November 2026 and should not be relied on. Rules for AI agents are still being written, and some of what is described here is proposed or coming soon rather than settled. Check the current position, or ask a qualified professional, before acting on it. Incident details are as publicly reported at the time, and some are disputed.
What does “trustless” actually mean?
“Trustless” means you do not have to trust a middleman, because the rules are enforced by code and recorded on a public blockchain. It does not mean the thing on the other end is trustworthy. That gap is the whole story of this guide.
The best-known attempt to bring this idea to AI agents is ERC-8004, titled “Trustless Agents”. It is a draft Ethereum standard, created in August 2025. Its aim is to let agents from different organisations find and choose one another without prior trust.
It does this with three registries, which are shared on-chain lists:
- Identity. Each agent gets a unique on-chain handle, issued as a transferable token, pointing to a file that describes it and lists its services.
- Reputation. Any user other than the agent’s owner can post a numeric score with optional tags and notes.
- Validation. Designated checkers can re-run or verify an agent’s work and post a result from 0 to 100.
The design treats trust as pluggable and tiered. The idea is that the level of checking should match what is at stake: a cheap task might rely on reviews, a costly one on independent verification. An agent that declares no trust method at all is, under the standard, listed for discovery only.
The standard is honest about its limits. It says plainly that Sybil attacks, where one actor creates many fake identities, can inflate the reputation of fake agents. It also says it cannot guarantee that an agent’s advertised capabilities work or are not malicious. Payments are explicitly out of scope.
What did the research find?
The research found that few registered agents declare any usable service and, on two of three chains, more than 90% of feedback came from likely fake reviewers. A 2026 academic study of the ERC-8004 ecosystem examined more than 173,000 agents registered on three chains between late January and mid-May 2026.
| Ethereum | A large layer-2 network | An exchange-affiliated chain | |
|---|---|---|---|
| Registered agents | about 32,000 | about 51,000 | about 90,000 |
| Agents declaring at least one service | 3% | 15% | 4% |
| Feedback from likely fake reviewers | 41.4% | 92.6% | 96.3% |
| Rated agents left with no rating after likely fake feedback is removed | 15.8% | 86.8% | 77.9% |
Two caveats matter. First, “likely fake” is the authors’ inference: they flagged reviewers whose wallets were funded from a shared source. It is a reasonable heuristic, not proof. Second, the study did not cover the validation registry, because no confirmed mainnet deployment was observed in the period. Third, “declaring a service” means the description file lists one; the study did not test whether it responded.
The identity layer is thin too. On Ethereum, 53% of registered agents had never been given a description file at all. And 2.6% of registration transactions there created 48.3% of all agents, so a few wallets account for much of the headline count.
Even with those caveats, the pattern is consistent. Across all three chains, between 98.7% and 100% of feedback carried no evidence that the reviewer had ever used the agent.
Why is on-chain reputation so easy to game?
On-chain reputation is easy to game because fake reviews are cheap and the system cannot tell a real customer from a new wallet. Those two facts together undo most of the promise.
Cost first. The study put the median cost of posting one piece of feedback at about $0.055 on Ethereum and $0.0027 on the layer-2 network. On that network, the authors calculated that the median attack cost was 259 times lower than the median value an agent had earned in payments.
Identity second. The standard blocks an agent’s owner from rating their own agent. But the authors showed that a freshly funded wallet gets around that rule. Anyone can be a “customer”.
Evidence third. Feedback can include proof of payment under x402, an open standard that lets software pay per request over the web. In practice almost none does: on the layer-2 network, the paper puts the share of feedback carrying such a payment reference at between 0.6% and 1.2%, depending on the section. Only 6.2% of reviewers there had any history of paying through x402 at all.
Put together, a rating can be bought for a few cents or less by someone who never used the agent. Nothing in the protocol stops it. The standard deliberately leaves scoring to outside services, which means the quality of an agent’s reputation depends on who is reading the raw data, and how carefully.
What would make “trustless” agents trustworthy?
The study’s authors propose fixes that tie reputation to real activity and make faking it expensive. They are recommendations, not features of the standard today. Five of the seven:
- Require evidence. Feedback should reference a verifiable interaction, such as a settled payment or a confirmed task. At minimum, systems should label which feedback has evidence behind it.
- Make influence cost money. The cost of moving a score should scale with the value it controls, for example through stakes that can be forfeited for abuse.
- Aggregate robustly. Use medians or trimmed averages, cap each reviewer’s weight, and weight by distinct, evidence-backed reviewers.
- Defend against fake identities by default. Cap the influence of wallets that share a funder or cluster together.
- Hide dead agents. Agree on a single test of whether an agent is live, and keep inactive ones out of discovery.
Our judgement: these are sensible, and they move the system back toward something familiar. Trust still comes from evidence, cost and accountability. The blockchain makes the evidence public. It does not create it.
What could go wrong?
The risk is that the word “trustless” persuades people to skip the checks they would apply to any stranger. A high rating on a public registry looks objective. The data says it often is not.
There are two further traps. First, identities are transferable. The study notes that an agent’s payment wallet is cleared when its identity changes hands. We infer, but have not confirmed, that the agent’s history may still travel with it, so a well-rated identity could be bought and reused.
Second, even a genuinely good agent can be manipulated. A 2025 academic study of context manipulation found that planting false entries in an agent’s memory could trigger unauthorised asset transfers. The models tested were more vulnerable to this than to ordinary prompt injection. A trustless ledger records what an agent did. It cannot vouch for why.
The trust takeaway
“Trustless” describes the ledger, not the agent. On-chain identity and reputation are useful raw material, but today they are thin, mostly empty and easy to inflate.
Before you rely on an agent’s on-chain reputation, check or ask:
- Is the agent live, with a service you can test, or just a registration?
- How many distinct reviewers rated it, and were their wallets funded separately?
- Does any feedback carry proof of a real payment or completed task?
- Has the identity changed hands, and when?
- Has any independent validator checked its work?
- Who is the accountable person or company behind it?