Check four things: who stands behind the agent, what it can touch, whether it keeps a record of what it did, and whether its track record is real. Do not rely on a registry listing. In a 2026 academic study of more than 173,000 agents registered on-chain, only 3% to 15% had a valid description file listing even one service.
A note on the legal and regulatory points here: they summarise public sources as of November 2026 and should not be relied on. Rules for AI agents are still being written, and some of what is described here is proposed or coming soon rather than settled. Check the current position, or ask a qualified professional, before acting on it. Incident details are as publicly reported at the time, and some are disputed.
Who is actually behind the agent?
A legitimate agent has an identifiable person or company that answers for it, and you should be able to name them before you fund it. An agent is software. Software cannot be sued, cannot hold a licence and cannot refund you; someone behind it can.
On-chain identity helps less than it sounds. ERC-8004, a draft Ethereum standard for “trustless agents”, gives each agent a unique on-chain handle that points to a description file listing its services. That handle is a transferable token, so it can change hands. A registration tells you an agent exists. It does not tell you who runs it today or whether it works.
A 2026 study of the ERC-8004 ecosystem makes the point with data. Across three chains, it counted more than 173,000 registered agents. On Ethereum, 53% had never been given a description file at all. Only 3% there, and at most 15% on any chain studied, had a valid file declaring at least one service. The study checked what was declared, not whether the service answered.
Many listings were also created in bulk. On Ethereum, 2.6% of registration transactions accounted for 48.3% of all agents. A long list of agents in a directory can be the work of a few wallets.
If the agent offers to trade or manage money for you, apply the checks regulators recommend for any trading service. The CFTC’s advisory on AI trading scams suggests researching the company’s background, running a reverse image search on the people it names, and checking how old its website’s domain is. A team that appeared last month deserves more caution than one with a public history.
If someone offers to manage money for other people, ask whether they are registered, then check it yourself. The CFTC’s website links to a tool for checking registration and disciplinary history. Do not rely on a badge or a screenshot on the operator’s own site.
What can the agent touch, and what can it do without asking?
A legitimate agent asks for the least access it needs, and tells you plainly what that is. Permissions are the single most important thing to check, because they set the size of the worst day.
Ask for specifics. Can it only read balances, or can it trade? Can it trade but not withdraw? Can it send funds to any address, or only to addresses you approved? Is there a cap per transaction and per day? Can you revoke its access in one step?
An agent that insists on full wallet control, a seed phrase or unlimited token approvals is asking for more than almost any task requires. In our view, that request on its own is a reason to walk away. A seed phrase is the set of backup words that controls a wallet; no legitimate service needs yours.
Then test before you trust. Fund the agent with an amount you could lose without real harm, give it narrow permissions, and watch what it does for a while. Widen its limits only once its behaviour matches what you were told.
Can I see what it did, and why?
A legitimate agent leaves an audit trail you can read. That means two records: the blockchain record of what it did, and the agent’s own log of why.
The first is free. Every on-chain transaction is public, so you can match what the agent claims against what actually happened. The draft standard itself notes that its on-chain pointers cannot be deleted, which preserves a trail.
The second is up to the operator. A good agent shows each decision, the data it used and the instruction behind it. If an agent cannot explain a trade, you cannot tell a mistake from an attack, and you cannot argue a claim afterwards.
Is its track record real?
Treat any rating or performance claim as unproven until you can trace it to real activity. Reputation is the easiest part of an agent to fake.
The ERC-8004 study tested this directly. On two of the three chains, more than 90% of all feedback came from reviewers the authors flagged as likely fake, based on shared funding sources. Across all three, between 98.7% and 100% of feedback carried no evidence of any real interaction with the agent. The median cost of posting one review ranged from about 5 cents on Ethereum to well under a cent on the other two chains.
So ask for results you can verify yourself. A real track record points to wallet addresses whose public history matches the claims. A rating from an account that never paid the agent, or a screenshot of a profit, tells you very little.
Performance claims need the same scepticism. The CFTC advisory lists red flags: returns of “tens of thousands of percent”, 100% win rates, guaranteed profits and “no experience required”. It also states plainly that AI cannot predict the future or sudden market changes.
| Check | What good looks like | Red flag |
|---|---|---|
| Identity | A named operator with a public history | Anonymous team, new domain, stock photos |
| Permissions | Trade-only, capped, revocable | Asks for withdrawal rights, seed phrase or unlimited approvals |
| Audit trail | Readable log of each decision and its reason | “Proprietary strategy”, no logs |
| Track record | Results you can trace on-chain | Star ratings, screenshots, guaranteed returns |
| Liveness | A working service you can test with a small amount | A registry entry and nothing behind it |
What could go wrong?
The biggest risk is that “legit” and “safe” get treated as the same thing. A scam can look legitimate, and a legitimate agent can still fail.
On the first point, the CFTC advisory describes a Ponzi scheme that took more than $1.7 billion in bitcoin from at least 23,000 people. It promised at least 10% a month, more than 200% a year, and traded very little. It looked like a trading service. In reality, it paid earlier investors with newer investors’ money.
On the second, even an honest agent can be hijacked. Attackers can hide instructions in content the agent reads, a technique called prompt injection. A real operator, sensible permissions and an honest track record reduce the damage. They do not remove the risk. That is why permission limits matter even after every other check passes.
The trust takeaway
Checking an agent is less about the AI and more about the people, permissions and paper trail around it. If any of the four checks fails, the agent has not earned your money yet.
Before you trust an AI agent with funds, check or ask:
- Who runs it, and how do I contact them if something goes wrong?
- Exactly what can it do without asking me, and can it withdraw?
- Can I cap it, and revoke its access in one step?
- Will it show me a log of every decision and the reason for it?
- Can its track record be traced to real on-chain activity?
- Does it work as described when I test it with a small amount first?