SoK: Decentralized Agent Economic Infrastructure
Not on the map. Why?
Abstract (arXiv)
Decentralized agent economies increasingly build a single task from protocols that were designed and secured separately. This creates a simple problem: a workflow can look correct at each step and still produce the wrong outcome. For example, a correct escrow may release payment on an authorized approval that provides little evidence that the delivered work actually satisfied the task. We systematize this problem across the full lifecycle of an agent task. Our study organizes security and economic requirements into 17 property families over six stages, with receipt soundness and completeness assessed separately. We examine 12 systems and standards, five reusable mechanism families, and four classical baselines. We introduce guarantee closure, a task-relative criterion for determining whether guarantees established at one stage remain available and constrain the later decisions that depend on them. We apply the criterion to controlled and native workflows, covering 840 matched executions and an exhaustive 11,648-case check over a finite objective-task domain. Our results expose recurring failures between verification and settlement, where conforming work can remain unaccepted or valid evidence can be ignored. Public records and model judgments further distinguish recorded approval from evidence of task conformance, while economic analysis identifies the report, penalty, and shared-error assumptions behind these guarantees. These findings show where end-to-end guarantees fail and what must be repaired to preserve them across the workflow.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 43 of its 120 references that are in the map. First posted on arXiv 1 Oct 2026.
Builds on
43 of 120 references.
References · 43
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
- 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
- 2025Defeating Prompt Injections by Designcited by 256
- 2024HelpSteer2: Open-source dataset for training top-performing reward modelscited by 232
- 2024On the Conversational Persuasiveness of Large Language Models: A Randomized Controlled Trialcited by 105
- 2024How Well Can LLMs Negotiate? NegotiationArena Platform and Analysiscited by 93
- 2025AgentNet: Decentralized Evolutionary Coordination for LLM-based Multi-Agent Systemscited by 86
- 2024zkLLM: Zero Knowledge Proofs for Large Language Modelscited by 51
- 2022Scaling up Trustless DNN Inference with Zero-Knowledge Proofscited by 30
- 2021SoK: Decentralized Finance (DeFi)cited by 23
- 2024opML: Optimistic Machine Learning on Blockchaincited by 20
31 more
- 2025What Is Your AI Agent Buying? Evaluation, Biases, Model Dependence, & Emerging Implications for Agentic E-Commercecited by 18
- 2025Virtual Agent Economiescited by 17
- 2020BitTensor: A Peer-to-Peer Intelligence Marketcited by 15
- 2026Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundariescited by 12
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
- 2019A scalable verification solution for blockchainscited by 10
- 2018Integrating Remote Attestation with Transport Layer Securitycited by 9
- 2025Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environmentscited by 8
- 2025Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design-A2A, AP2, ERC-8004, and Beyondcited by 8
- 2026SoK: Security of Autonomous LLM Agents in Agentic Commercecited by 8
- 2024Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark Studycited by 7
- 2025How Does Cognitive Bias Affect Large Language Models? A Case Study on the Anchoring Effect in Price Negotiation Simulationscited by 7
- 2024SoK: Blockchain-Based Decentralized AI (DeAI)cited by 6
- 2026A402: Binding Cryptocurrency Payments to Service Execution for Agentic Commercecited by 6
- 2021Clockwork Finance: Automated Analysis of Economic Security in Smart Contractscited by 5
- 2025Formalizing the Safety, Security, and Functional Properties of Agentic AI Systemscited by 5
- 2026AI Identity: Standards, Gaps, and Research Directions for AI Agentscited by 5
- 2026Free-Riding the Agentic Web: A Systematic Security Analysis of x402 Paymentscited by 5
- 2026Security in LLM-as-a-Judge: A Comprehensive SoKcited by 4
- 2026Five Attacks on x402 Agentic Payment Protocolcited by 4
- 2022SoK: Preventing Transaction Reordering Manipulations in Decentralized Financecited by 3
- 2026Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injectioncited by 3
- 2026When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Paymentscited by 3
- 2022Exploring Unfairness on Proof of Authority: Order Manipulation Attacks and Remediescited by 2
- 2026A dataset of early blockchain-registered AI agents on Ethereumcited by 2
- 2026From Agent Identity to Agent Economy: Measuring the Operational Readiness of ERC-8004 AI Agentscited by 2
- 2026Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystemcited by 2
- 2014Knightian Analysis of the Vickrey Mechanismcited by 1
- 2020A Game-Theoretic Analysis of Cross-Chain Atomic Swaps with HTLCscited by 1
- 2025(Im)possibility of Incentive Design for Challenge-based Blockchain Protocolscited by 1
- 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directionscited by 1
Built on by
Not cited yet.