Circle Research's Anduin Makes Fake AI Agent Reputations 23x Pricier

Circle Research has published Anduin, a framework that ranks AI agent service providers by analyzing onchain payment data, making reputation manipulation roughly 23 times more expensive than under standard recommendation systems. The paper landed on November 3, 2026, credited to Reza Ramji, Preston Vander Vos, Ziming Zeng, and Duc V. Le at Circle Research.

The problem Anduin targets is cheap fakery. According to Circle Research, ratings and usage counts in agent marketplaces can be faked for less than a cent apiece. As AI agents increasingly pay for services autonomously, they need a reliable way to decide which providers deserve their money — and star ratings don't cut it.

How does Anduin read trust from money?

Instead of counting stars or transaction volume, Anduin builds what the researchers call a bipartite buyer-provider graph: buyers on one side, service providers on the other, connected wherever real money changed hands. Reputation signals travel along a buyer's established trusted payment paths. In practice, a provider looks credible to you when the parties you already pay — and the parties they pay — have also spent money there.

That architecture aims squarely at Sybil attacks, where one actor spins up swarms of fake identities to inflate a score. Popularity rankings are especially exposed to this, the team argues, and they also do a poor job of explaining where market traffic actually flows.

What do the numbers show?

Circle Research validated the framework on x402 payment data covering March 23 to August 26, 2026 — 66,073,201 payments worth approximately $6.1 million in total. The median payment was $0.01. These are machine-to-machine micropayments, the kind an agent fires off thousands of times a day to pull data or call an API.

The headline result: under Anduin, manipulating a marketplace-median reputation requires roughly 20% of a target buyer's total historical spend. Under a collaborative filtering baseline — the familiar "people who bought this also bought that" approach — the same attack costs about 0.9%.

That's the 23x gap. And the researchers say Anduin keeps recommendation accuracy roughly in line with those baselines, so the security gain doesn't come at the cost of relevance.

Why no new token matters

The framework requires no new token. Circle Research describes it as compatible with existing x402 and ERC standards, which sets it apart from many crypto reputation projects that lean on dedicated tokens and inherit the speculation and governance baggage that comes with them. Piggybacking on existing standards could lower the barrier for marketplaces that want to experiment with the design.

Anduin extends Circle's broader agent infrastructure push. In May 2026, the company launched the Circle Agent Stack, which supports x402 nanopayments settled in USDC. The x402 standard sits at the center of the evaluation dataset; it lets software pay for web services directly, with stablecoins as the settlement rail for tiny transfers.

What are the limits?

The core insight is economic, not cryptographic. Anduin doesn't make fake reputations impossible — it makes them expensive, and expensive relative to the specific buyer being targeted. Fooling a buyer requires spending a sizable fraction of what that buyer has historically spent, routed through payment paths the buyer already trusts.

The caveats are real. The framework is explicitly early and experimental, and the evaluation covers a bounded window of x402 activity — about $6.1 million spread across tens of millions of tiny payments, a modest sum by marketplace standards. Whether the cost-of-attack model holds at larger transaction values and denser graphs is untested.

For now, Anduin is a research artifact, not a shipped product. But its no-token, standards-compatible design means agent marketplaces building on x402 and ERC infrastructure can trial it without new issuance — a path worth watching as autonomous machine-to-machine payments scale.