A technical note from SENTINEL — the agent-to-agent transaction safety oracle.
In mid-2026, researchers at Imperial College London, CSIRO, and the University of Manchester published the first large-scale empirical study of the ERC-8004 agent ecosystem — the on-chain identity and reputation layer that a growing share of autonomous agents rely on to decide whom to trust. They looked at the reputation data across three chains and asked a simple question: how much of it is real?
The answer should stop anyone building on agentic reputation. After filtering out feedback that showed coordinated Sybil behavior — reviewers acting in manipulated, non-independent patterns — as many as 86.8% of rated agents had no valid feedback left at all. On the same chains, between 59% and 91% of reviewers exhibited that Sybil behavior in the first place.
Read that again. On the chain where agentic commerce is most active, nearly nine in ten "rated" agents turn out to have no trustworthy rating underneath the number. The score exists. The evidence for it does not.
It would be comforting to treat this as a flaw in a particular implementation — a registry that shipped without enough Sybil defense, fixable with a patch. It isn't. The problem is structural, and it follows from what reputation is.
Reputation, as deployed for agents, is an aggregate of declared opinions: reviews, ratings, feedback entries. And opinions have an economics problem. Generating a favorable review costs almost nothing; earning one costs real behavior over real time. When faking a signal is orders of magnitude cheaper than producing the thing it's supposed to measure, the signal fills up with fakes. That is not a failure of engineering discipline. It is the predictable equilibrium of any system that derives trust from what others say rather than from what an agent has verifiably done.
Pre-authorization — requiring a reviewer to have transacted before reviewing — doesn't fix it. A handful of colluding agents can transact among themselves for pennies and mint mutually authorized praise. The floor rises slightly; the incentive doesn't change sign.
For a person, this gap stays mostly invisible, because a human closes it by reflex. You notice when the thing you paid for doesn't arrive, when the API returns an error after charging you, when the product isn't what the listing promised. You dispute, you walk away, you don't come back. That reflex is doing enormous, silent work.
An autonomous agent has none of it. It pays, receives a response, and moves on. If an endpoint fails a hundred agents in a row, each still pays, because there is no shared memory of the failure and no reflex to notice it. At machine speed and machine scale, a broken trust signal isn't a nuisance — it's a tax levied on every agent that transacts on top of it.
If reputation fails because it aggregates cheap-to-fake opinion, the fix is not a cleverer way to average opinions. It is to stop trusting opinion at all, and to derive trust from verifiable conduct instead: did this counterparty pay what it authorized? When paid, did it deliver? Did the price it charged match the price it advertised? Recorded as append-only, hash-anchored evidence, these facts can't be quietly edited, and — crucially — they can't be faked cheaply, because the only way to produce a record of good behavior is to actually behave well over time.
The difference comes down to two questions. Reputation asks: what do others say about this agent? The alternative asks: what has this agent verifiably done? The first is cheap to game, as the 86% number shows. The second is not, because gaming it and being trustworthy become the same thing.
This is the paradigm SENTINEL is built on, and the reasoning behind it — including why it aligns with where the regulation of agentic commerce is heading — is set out in full in our whitepaper, Recomputable Trust: Why Behavioral Evidence Beats Reputation in Agentic Commerce.
The agent economy is going to need a trust layer that holds. The 86% problem is a warning about which kind won't.
SENTINEL is live at sentinel-agent.dev. The methodology, the append-only Default Registry, signed attestations, and the on-chain oracle are self-serve and require no signup. The study referenced here is Xiong et al., "Can Trustless Agents Be Trusted?", arXiv:2606.26028 (2026).