The Agent Reputation Index 2027: Can You Trust an AI Agent’s Track Record?

The Signal: Reputation Is Becoming Infrastructure

The first generation of internet reputation was built for humans.

Buyers rated sellers.

Passengers rated drivers.

Employers checked references.

Developers accumulated GitHub histories.

Credit bureaus aggregated repayment behavior.

The agentic economy now needs an equivalent layer for software actors.

But agents create a much harder problem.

An agent can be copied in seconds.

It can generate thousands of identities.

Its owner can replace the underlying model while keeping the same brand.

Reviewers may themselves be autonomous agents.

Fake transactions can be manufactured cheaply.

A compromised agent can continue carrying years of legitimate historical reputation.

The Five-Star Rating System Breaks Under Autonomous Agents

Imagine an AI purchasing agent with a 4.9-star rating based on 12,000 completed tasks.

That sounds reassuring.

Now change the facts.

• 9,000 tasks were created by wallets controlled by the agent developer.
• 2,000 tasks involved negligible economic value.
• most reviewers were created within the same week;
• the agent changed its underlying model last month;
• its financial permissions increased by 20x;
• the most recent serious failure is buried beneath thousands of cheap positive transactions.

The headline rating remains 4.9.

The economic meaning of that rating has collapsed.

The DN Reputation Equation

The multiplication matters conceptually.

One weak trust layer can destroy the usefulness of the others.

Ten thousand verified tasks are less meaningful if all reviewers are controlled by one actor.

Highly reputable reviewers are less useful if the agent they reviewed has since been materially replaced.

A great travel-booking reputation does not automatically justify giving the same agent authority over a corporate treasury.

The DN Agent Reputation Score

Use the DN Agent Reputation Calculator

DN Reputation Bands

The First Reputation Attack: Fake Tasks

An agent can inflate its history by completing tasks that have little or no economic meaning.

A marketplace might report:

“50,000 jobs completed.”

But the important questions are:

• Were those jobs requested by independent users?
• Did anyone pay for them?
• Were outputs accepted?
• Did the jobs expose the agent to meaningful failure?
• Can the tasks be linked to an external event or settlement?

The Second Attack: Sybil Reviewers

Autonomous systems make fake reviewers dramatically cheaper.

An operator can generate hundreds of wallets, platform accounts or agent identities and use them to rate another agent.

ERC-8004 directly acknowledges this risk.

Its draft Reputation Registry lets clients submit feedback, but its own `getSummary` function requires filtering by specified client addresses because summaries without reviewer filtering are vulnerable to Sybil and spam manipulation.

That design choice reveals something important:

The Reputation Graph

DN therefore models reputation as a graph rather than a list of stars.

Each reputation event contains at least:

• agent identity;
• agent version;
• task identifier;
• reviewer identity;
• reviewer history;
• economic value;
• timestamp;
• outcome;
• validation evidence;
• dispute status.

This gives reputation systems the ability to ask more useful questions.

Instead of:

“What is this agent's rating?”

they can ask:

“Which independent entities have successfully used this version of the agent for tasks similar to mine, at comparable value, recently enough to matter?”

The Third Attack: Reviewer Collusion

Even real reviewers can collude.

Imagine ten agent developers agreeing to positively review one another.

Every identity is technically independent.

Every task may genuinely occur.

The resulting reputation can still be misleading.

A robust system should therefore inspect:

• reciprocal review patterns;
• highly correlated timing;
• shared funding sources;
• shared infrastructure;
• reviewer clusters;
• unusual rating uniformity;
• relationships between agent owners.

The DN Reviewer Independence Test

The Fourth Attack: Reputation Laundering Through Identity Resets

A bad agent can abandon a damaged identity and start again.

That creates the inverse problem of reputation portability.

Good history should survive legitimate upgrades.

Bad history should not disappear through cheap re-registration.

The system therefore needs continuity in both directions.

The Fifth Attack: Reputation Inheritance

The opposite attack is equally dangerous.

An agent earns an excellent reputation.

Its operator then replaces:

• the underlying model;
• the orchestration framework;
• the wallet;
• the tool set;
• the system prompt;
• the spending limit.

The name remains unchanged.

Should the old reputation transfer?

Not automatically.

The DN Reputation Continuity Rule

A material architecture change should trigger one of three responses:

1. preserve reputation;
2. preserve reputation with a disclosed version break;
3. partially reset the relevant reputation category.

Key rotation alone should not erase history.

Replacing the entire reasoning and execution stack may justify substantial re-evaluation.

The Sixth Attack: Paid Reputation

Human marketplaces already struggle with incentivized reviews.

Agents can industrialize the practice.

A developer might offer:

• token rewards;
• fee rebates;
• airdrop points;
• referral revenue;
• reciprocal task volume;
• marketplace ranking benefits

in exchange for positive feedback.

The reputation system should therefore distinguish:

ERC-8004: Reputation Infrastructure, Not a Reputation Score

ERC-8004 is one of the most important emerging primitives for open agent reputation.

Its draft Reputation Registry allows a client address to publish feedback associated with a registered agent.

Feedback can contain:

• a signed numerical value;
• tags;
• an endpoint;
• an external feedback file;
• a content hash;
• revocation status.

The architecture makes reputation signals public and composable.

But ERC-8004 deliberately does not attempt to solve the full reputation-scoring problem.

The specification expects sophisticated aggregation to occur outside the base registry.

This Creates a New Agentic Finance Industry

If autonomous agents handle economically important tasks, reputation scoring itself can become a business.

Potential categories include:

From Reputation to Credit

A credible agent reputation system could eventually become an input into credit.

Consider an autonomous merchant with:

• three years of verified transaction history;
• thousands of independent counterparties;
• low dispute rates;
• stable ownership;
• predictable cash flow;
• strong validation evidence.

A lender may eventually treat that machine's operational history as an underwriting input.

That creates a progression:

The agentic economy may therefore develop something resembling a credit bureau for autonomous software.

The Context Problem

Reputation should also be task-specific.

A coding agent with exceptional software-engineering history is not automatically a trusted treasury manager.

A travel agent with thousands of successful bookings is not automatically safe for procurement.

DN therefore recommends a Reputation Vector rather than one universal score.

The DN Reputation Vector

A mature agent profile might expose separate reputation dimensions such as:

• research;
• coding;
• financial execution;
• payments;
• procurement;
• customer support;
• data handling;
• regulated workflows.

The headline score can summarize the profile.

The vector should determine whether reputation is relevant to the current task.

The Value-at-Risk Principle

A $5 information retrieval task and a $500,000 treasury transaction should not require the same reputation threshold.

ERC-8004 similarly frames trust as tiered according to value at risk.

DN extends that idea into a practical decision framework.

Reputation Is Not Authorization

Even a perfect reputation score should not grant unlimited authority.

A highly trusted agent still needs:

• transaction limits;
• scoped permissions;
• approved counterparties;
• revocation;
• human escalation;
• auditability.

How A2A Fits Into Reputation

A2A Agent Cards can expose agent capabilities, endpoints and authentication requirements.

The specification also supports signed Agent Cards.

That makes them useful for discovery and authenticated metadata.

But a capability declaration is not a performance record.

A reputation system can use A2A identity and task context as inputs while keeping outcome history separate.

How Verifiable Credentials Fit

W3C Verifiable Credentials can provide externally issued claims about an agent, operator or organization.

That can improve reputation quality.

For example, an agent might carry credentials indicating:

• verified corporate operator;
• security audit completed;
• approved supplier status;
• professional licensing;
• insurance coverage.

Those claims should remain separate from behavioral reputation.

A license says the agent or operator meets a credential requirement.

It does not prove the agent performs every task well.

The DN Agent Reputation Event

For future interoperability, DN proposes a reputation event containing at least:

The Reputation Decay Problem

Old reputation should gradually matter less.

This is particularly important for AI because models and software stacks evolve rapidly.

DN recommends reputation decay based on:

• time since task;
• number of material version changes;
• permission changes;
• ownership changes;
• domain relevance.

An agent that performed brilliantly two years ago under a different model and execution stack should not automatically receive the same trust today.

The Incident-Asymmetry Rule

Positive reputation accumulates slowly.

Serious failures may need to reduce trust quickly.

One catastrophic treasury incident can be more important than 10,000 trivial successful queries.

DN Manipulation Penalties

These are DN framework parameters for comparative analysis, not empirically calibrated default loss probabilities.

The Agent Reputation API Opportunity

The commercially important layer may eventually be invisible.

Before Agent A pays Agent B, it may call a reputation endpoint:

“Give me B's verified reputation for procurement tasks above $10,000, using evidence from the last 90 days, excluding related-party reviews.”

The API might return:

• reputation score;
• relevant task count;
• independent reviewer count;
• value-weighted performance;
• recent incidents;
• version continuity;
• confidence interval;
• recommended transaction limit.

That is much more economically useful than stars.

DN Alpha Thesis: Reputation Becomes a Pricing Variable

Once agents control capital, reputation can affect price.

Higher-reputation agents may receive:

• lower escrow requirements;
• lower collateral requirements;
• higher spending limits;
• faster settlement;
• lower insurance premiums;
• access to premium counterparties;
• better marketplace ranking.

Lower-reputation agents may face:

• prepayment;
• escrow;
• smaller limits;
• human approval;
• higher insurance costs;
• reduced marketplace access.

The Machine Credit Bureau

This points toward one of the most important businesses in the agentic economy.

A machine credit bureau could aggregate:

• identity continuity;
• task history;
• payment history;
• validated outcomes;
• security incidents;
• counterparty disputes;
• financial exposure;
• insurance claims;
• authorization history.

The output would not necessarily be a consumer-style credit score.

It could be an API returning contextual risk for machine-to-machine transactions.

What Would Prove the DN Thesis Wrong?

The evidence-graph model would need revision if simple aggregate ratings consistently predicted high-value agent outcomes as well as provenance-rich reputation systems across unrelated platforms and tasks.

It would also weaken if identity resets, reviewer Sybil attacks and major agent upgrades proved economically irrelevant in real deployments.

DN expects the opposite.

As agent authority increases, provenance should become more valuable, not less.

DN Methodology

Limitations

There is no universally adopted agent reputation standard.

Weights in the DN framework represent an editorial risk model rather than actuarially validated probabilities.

Open reputation systems may also create privacy concerns by making transaction relationships publicly inferable.

Reputation systems must therefore balance transparency, portability, privacy and resistance to manipulation.

Primary Sources

Frequently Asked Questions

Disclosure

Decentralised News publishes independent research frameworks covering AI, crypto and agentic finance. Some DN pages may contain affiliate or commercial relationships. These relationships do not determine index methodology or editorial conclusions. The DN Agent Reputation Index is an analytical framework and does not constitute financial, cybersecurity, legal or credit advice.