The paper is Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem by Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt, and Zhipeng Wang (Imperial College London), first posted to arXiv on 2026-06-24 and revised on 2026-07-08. Its data collection window closes on 2026-05-13. That matters: everything the paper reports is a photograph of the ecosystem three months before this post, before roughly a hundred days of new registrations, endpoint churn, and reputation activity.
This post's job is not to argue with the paper (our own earlier measurements are in the current State of ERC-8004 report). The job is to (1) state the two teams' predicate definitions explicitly so the numbers become commensurable, (2) show what has and has not changed in the three months since the paper's data froze, and (3) point to the one architectural fix — commerce-backed reputation — that directly addresses the paper's central complaint about the ReputationRegistry.
What the paper actually found
The paper studies three chains, two of which (Ethereum mainnet and Base) we also index, and reports two headline results.
Result 1: most registrations are placeholders. The paper finds that only 3% (Ethereum) and 15% (Base) of ERC-8004 identity registrations satisfy both halves of its trust bar: a resolvable registration file and at least one live service endpoint. In the authors' own words, "most registrations are placeholders rather than active agents."
Result 2: the ReputationRegistry cannot function as a trust signal. The paper reports that 73.5% (Ethereum) and 90.6% (Base) of reviewers show coordinated Sybil behavior, and that once Sybil feedback is stripped, 15.8% (Ethereum) and 86.8% (Base) of rated agents are left with no valid feedback at all. The authors write that the registry's values are "not commensurable", that feedback is "rarely grounded in verifiable interactions," and that the registry is manipulable at minimal cost.
Both results are empirical, dated 2026-05-13, and released under CC BY 4.0. They are the kind of independent measurement that has been missing from a category where every operator's numbers are their own.
The two predicates, side by side
Any comparison of the paper's number and ours has to begin with the fact that we are not measuring the same predicate.
| Predicate | Definition |
|---|---|
| Paper Xiong et al. 2026, data 2026-05-13 |
Registration file resolvable AND at least one live service endpoint declared. Registration file = the metadata document the agent points at from its ERC-8004 identity row (agent card, agent.json, or equivalent). "Live service endpoint" in this sense is a declared service in the metadata, not an actively probed 2xx response. |
| Us Onchain Agent Intel, continuous |
Advertised endpoint returns HTTP 2xx on the last probe
(strict [200, 300)) AND advertises at least one
machine-readable capability surface — MCP
(/mcp), OpenAPI
(/openapi.json), or
/.well-known/agent-card.json
with a non-empty skills[]
or capabilities[]. The same definition feeds
/v1/public/stats.live_by_chain,
the site's per-chain live counts, and every free per-agent
page — one predicate, one code path.
|
Both predicates are trying to filter out placeholder registrations. The paper does it with a static-document check; we do it with a continuous liveness probe. Ours is the stricter test — a resolvable registration file with a declared endpoint is a necessary but not sufficient condition for the endpoint to actually answer today.
We do not attempt to re-compute the paper's exact predicate on our data in this post. Doing so honestly would require re-fetching every agent's registration document at a point-in-time cut and applying the paper's specific resolver rules; that is a methodology paper of its own, not a paragraph. We flag it explicitly so readers do not misread "our live rate" and "the paper's 3% (Ethereum) and 15% (Base)" as directly comparable.
Our live rates, three months later
Under our stricter predicate — advertised endpoint 2xx AND a machine-readable capability surface — this is what our continuous index reports right now:
| Measure (live index) | Value |
|---|---|
| ERC-8004 agents indexed (Base + Ethereum) | 26,978 |
| Live agents (endpoint 2xx AND capability declared) | 2,537 |
| Live rate — Base | 6% |
| Live rate — Ethereum mainnet | 34% |
| ReputationRegistry feedback events indexed | 710,900 |
| ERC-8004 agent IDs with any feedback (full registry, including registrations outside our index) | 155,767 |
| Commerce-backed agents (paid-job-review cohort) | 51 |
Live-source: /v1/public/stats.
Liveness itself has been continuously tracked since
2026-07-17.
Two observations sit alongside the paper's headline. First, the direction matches — even under our stricter probe, most registered ERC-8004 agents on Base are placeholders, and a majority on Ethereum mainnet are as well, exactly as the paper says. Second, the Base vs Ethereum ordering does not match: on our probe Ethereum mainnet has the higher live rate, while the paper's test showed the highest passing rate on Base. The two predicates differ (see the predicate table above), so the per-chain percentages are not directly comparable, but the overall shape of the finding holds three months later.
The registry-can't-be-a-trust-signal complaint, and the fix
The paper's second finding is the more corrosive one: the ReputationRegistry values are "not commensurable" and feedback is "rarely grounded in verifiable interactions." Anyone can write a feedback row saying anything about anyone; a Sybil ring can flood the registry at effectively zero cost. Stripping the paper's estimated Sybil behavior leaves 15.8% (Ethereum) and 86.8% (Base) of rated agents with no valid feedback at all — the trust signal collapses on inspection.
One response is to weight reputation by something that is expensive to fake: a settled on-chain payment between two parties. Our commerce-backed list does that. It is a stronger signal, not a guarantee. A ReputationRegistry row counts only if its author and its subject demonstrably transacted on-chain through an ERC-8183 job outcome, a Virtuals ACP job, or one of a short list of known escrow or hook contracts. The cohort today stands at 51 agents. The commerce-backed agents page explains the method in detail.
This is not a rebuttal to the paper — the paper is right that the raw registry is not a trust signal on its own. It is one practical response to the paper's complaint: build the filter on top of the registry, from a signal that is expensive to fake.
What has and has not changed since 2026-05-13
The paper's data set closes on 2026-05-13. Since then:
- The ecosystem has kept adding placeholder registrations. Our index has grown to 26,978 agents on Base + Ethereum alone, but the live share has not rescued itself — a bigger denominator with a similar-shape numerator.
- On the two chains we serve, the ordering does not match the paper: on our probe Ethereum mainnet has the higher live rate. Our Base live rate today is 6%; Ethereum mainnet is 34%.
- The paid-job-review cohort exists and is countable. 51 agents now have a ReputationRegistry row that ties back to a paid job — a signal that did not exist in the paper's snapshot as a distinct category, and one that a Sybil ring cannot cheaply produce.
Attribution and reuse
The paper's numbers on this page are quoted under CC BY 4.0. Full attribution: Xihan Xiong, Zelin Li, Wei Wei, Qin Wang, William Knottenbelt, Zhipeng Wang (Imperial College London), Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem, arXiv:2606.26028 (v1 2026-06-24, v2 2026-07-08). DOI:10.48550/arXiv.2606.26028.
Our own data on this page is served live from
/v1/public/stats and refreshed
on every visit.
Redistribution of our figures is welcome under CC BY 4.0 with a
link back to this page.