Circle Research unveils Anduin framework for agent trust using payment graphs

AI agents can now pay for services on their own. The problem is figuring out which services deserve their money.

Circle Research thinks the answer lies in the payment trail itself. It has introduced Anduin, a framework that reads onchain payment data to rank service providers and make reputation manipulation costlier for anyone trying to game the system.

The pitch rests on an awkward truth about the current setup. According to Circle Research, ratings and usage counts in agent marketplaces can be faked for less than a cent.

How Anduin reads the money

The paper was published on November 3, 2026. It is credited to Reza Ramji, Preston Vander Vos, Ziming Zeng, and Duc V. Le at Circle Research.

Instead of counting stars or transactions, Anduin builds what researchers call a bipartite buyer-provider graph. Picture a map with buyers on one side and service providers on the other, connected by lines wherever money changed hands.

Reputation signals then travel along a buyer’s established trusted payment paths. Put more simply, a provider looks credible to you when the people you already pay, and the people they pay, have also spent real money there.

That design targets Sybil attacks. A Sybil attack is when one actor spins up a swarm of fake identities to inflate a score, like a restaurant owner writing fifty glowing reviews under fifty different names.

Popularity rankings are especially vulnerable to this, Circle Research argues. The team also says those rankings do a poor job of explaining where market traffic actually flows.

The numbers behind the claim

Circle Research tested the framework on a dataset covering March 23 to August 26, 2026. It included 66,073,201 x402 payments worth approximately $6.1 million.

The median payment in that dataset was $0.01. These are not big-ticket purchases. They are tiny, machine-to-machine transactions, the kind an agent might fire off thousands of times a day to pull data or call an API.

The headline result: under Anduin, manipulating a marketplace-median reputation would take roughly 20% of a target buyer’s total historical spend. Under a collaborative filtering baseline, the same attack costs about 0.9%.

That makes an attack around 23 times more expensive under Anduin, according to the research. Collaborative filtering, for context, is the familiar recommendation approach behind “people who bought this also bought that.”

Crucially, the researchers say Anduin keeps recommendation accuracy similar to those baselines.

The framework also does not require any new tokens. It is described as compatible with existing x402 and ERC standards, and it remains in an early experimental phase.

Where this fits in Circle’s agent push

Anduin builds on Circle’s earlier work in agent infrastructure. In May 2026, the company launched the Circle Agent Stack, which supports x402 nanopayments in USDC.

x402 is the payment standard at the center of the dataset. It lets software pay for web services directly, with stablecoins serving as the settlement rail for these tiny transfers.

What this means for agent marketplaces

The core insight is economic rather than cryptographic. Anduin does not make fake reputations impossible. It makes them expensive, and specifically expensive relative to the buyer being targeted.

Under Anduin, fooling a buyer reportedly requires spending a sizable fraction of what that buyer has historically spent, routed through paths the buyer already trusts.

The no-new-token design is also notable. Many reputation projects in crypto have leaned on dedicated tokens, which introduces speculation and governance questions. Anduin instead piggybacks on existing standards, which could lower the barrier for marketplaces that want to experiment with it.

There are caveats worth keeping in view. The framework is explicitly early and experimental. The evaluation covers a specific window of x402 activity totaling approximately $6.1 million, a modest sum spread across tens of millions of tiny payments.