The first empirical study of ERC-8004's live deployments found that its reputation layer doesn't yet function as a trust signal. Here's what the data shows and what the standard was never designed to provide.
The Short Version
- ERC-8004 is Ethereum's trust and discovery layer for AI agents. Each agent is an ERC-721 NFT with a resolvable identity, a reputation registry for feedback, and a validation registry for independent verification. It plugs directly into the A2A, MCP, and x402 stack.
- It is younger than the coverage suggests. The canonical EIP header still reads Draft. Reference contracts reached Ethereum mainnet around January 2026, but a deployed reference implementation is not a finalized standard.
- The first empirical study is sobering. A mid-2026 analysis of live deployments found that only a small fraction of registrations expose a valid registration file and that most feedback comes from coordinated Sybil reviewers. The reputation layer, as used today, does not yet function as a trust signal.
- One question is out of scope by design: who answers for an agent. ERC-8004 tells you what an agent is and what others say about it, not who is accountable when it causes harm. That is the gap Concordium's CIS-8004 is built to fill, by binding every agent to a verified human owner, provable through zero-knowledge.
Autonomous AI agents are starting to transact, call each other's tools, and act on behalf of people and companies. Before any of that scales, a fairly boring problem has to be solved first. How does one piece of software know which agent it is dealing with, and whether that agent can be trusted?
ERC-8004 is Ethereum's answer, and the one the rest of the field measures itself against. This is a close look at what it actually specifies, what the first independent data says about how it is being used, and the one question it deliberately does not answer.
It is the second piece in that series: the first covered how agents pay, with x402, and the ones that follow turn to runtime identity and authorization.
Why Agents Need a Trust Layer at All
An agent economy needs a registry. Not a marketing directory, but a machine-readable layer where an agent has a stable identity, a place to advertise what it can do, and some signal about whether it behaves. Off-chain protocols already cover part of this. Google's A2A defines how agents message each other through agent cards. The Model Context Protocol (MCP) exposes tools and resources. Payment schemes like x402 handle settlement. What none of those provide is a neutral, permissionlessly indexable record of who an agent is and whether to trust it. That is the gap ERC-8004 set out to fill.
What ERC-8004 Specifies
ERC-8004, titled "Trustless Agents," specifies a minimal on-chain trust and discovery layer built from three singleton registries.
- Identity Registry. Since the specification's v1.0 overhaul, an agent is an ERC-721 NFT. Each agent gets an agentId (the token ID) and a globally resolvable address in the form {namespace}:{chainId}:{registry}. The token's agentURI points to an off-chain registration file that lists the agent's services (A2A, MCP, OASF, ENS, DID, and more).
- Reputation Registry. Clients post signed, fixed-point ratings, plus tags and a link to an off-chain feedback document. Scores can be aggregated on-chain through getSummary or off-chain.
- Validation Registry. A generic request-and-response mechanism for independent verification, where validators return a 0 to 100 score with evidence.
The interfaces are deliberately clean and minimal. Identity exposes register, setAgentURI, setAgentWallet, and getMetadata. Reputation exposes giveFeedback, revokeFeedback, getSummary, and readFeedback. Validation exposes validationRequest, validationResponse, and status reads.
The elegance is in the tiering. The three registries map to pluggable trust models of increasing strength: reputation (feedback) for low-stakes interactions, crypto-economic guarantees (stake and slashing) where more is at risk, and TEE attestation or zkML for the highest-value cases. The stated principle is security proportional to value at risk. ERC-8004 was conceived by authors from MetaMask, the Ethereum Foundation, Google, and Coinbase as a trust extension to A2A, and posted to the Ethereum Magicians forum in August 2025.
Status: Younger Than the Headlines
One point matters for an honest read: status. The canonical EIP header still reads Draft. Reference contracts were deployed to Ethereum mainnet and several testnets around January 2026, and the spec is versioned, but that is not the same as a finalized standard. A good deal of secondary coverage blurs "reference contracts are live" into "the standard is final." They are different things.
The same caution applies to adoption. Headline adoption numbers (figures like tens of thousands of agents registered in a month) measure registrations, which are cheap and permissionless. Whether those registrations represent functioning, trustworthy agents is an empirical question. And that question now has an answer.
What the Data Says: The Sybil Problem
A mid-2026 empirical study of ERC-8004 deployments across Ethereum, BSC and Base, still a preprint and not yet peer-reviewed, examined how the standard is actually being used across more than 170,000 registered agents. Three findings stand out.
- Almost no registration is operationally complete. Only 3 percent of agents on Ethereum exposed a valid registration file with at least one live service endpoint, alongside 4 percent on BSC and 15 percent on Base. The rest are mostly placeholders rather than active agents.
- Many reviewers in the reputation registry showed coordinated Sybil behavior, meaning clusters of accounts funded from shared sources rating each other's agents: 73.5 percent of reviewers on Ethereum, 59.2 percent on BSC and 90.6 percent on Base.
- Once that Sybil feedback was removed, the reputation base largely lost its value as a signal. On Base, 86.8 percent of rated agents had no valid feedback left, and on BSC, 77.9 percent. On Ethereum the figure was lower but still material at 15.8 percent.
The authors concluded that the reputation registry, as currently deployed, cannot yet function as a trust signal. That is a pointed finding, and it deserves a fair reading. It is exactly the kind of independent scrutiny that makes ERC-8004 worth taking seriously rather than a reason to dismiss it. Open, permissionless reputation is genuinely hard, every open reputation system in history has fought Sybil attacks, and pretending otherwise helps no one. But it does mean the trust layer that agent headlines assume exists is, today, still aspirational.
It also sharpens a distinction the standard itself is honest about: reputation was only ever meant to carry part of the load.
The Gap That Is There by Design: Discovery Is Not Accountability
ERC-8004 answers what an agent is and what others have said about it. What it does not answer is who is accountable when the agent causes harm. That is not an engineering flaw but a scope decision. In ERC-8004 the owner is an Ethereum address, and trust is something you accumulate on top through feedback, stake, or attestation. Nothing in the standard connects an agent to a real-world party who can be held responsible.
Those are different guarantees. Reputation systems answer "have others had good experiences with this agent." Accountability answers "if this agent defrauds me, is there a real party who can be held responsible." The Sybil study shows how fragile the first guarantee is when feedback is free to fabricate. The second guarantee cannot be fabricated or farmed, but it requires something no permissionless registry can mint: a verified identity behind the owner. A mature agent economy will want both.
Financial regulation is built around responsible persons, controls, and auditability, and there is no reason to expect autonomous systems that touch financial infrastructure to be exempt from a traceable human accountability chain. The governance gap is measurable: Deloitte finds that 74 percent of organizations plan to adopt agentic AI within two years while only 21 percent have a mature governance model for agents. When the first AI agent causes real harm at scale, "who is liable" is the question that will be asked first, and today's discovery layers have no answer to it.
CIS-8004: Starting from the Accountable Owner
This is where Concordium's CIS-8004 enters, and it enters as a complement rather than a rival. CIS-8004 is Concordium's on-chain standard for AI-agent identity and accountability, live on Concordium mainnet. It reuses the 8004 number to signal compatibility with the Ethereum work rather than to compete for the label.
At the identity layer, the two standards are near-mirrors. Each CIS-8004 agent is minted as a CIS-2 NFT (Concordium's token standard), giving it a transferable on-chain identity addressed by a token address. As with ERC-8004, data is split: on-chain key-value metadata plus an off-chain metadata file referenced by hash at an agentURI, with a reserved key holding the agent's payment wallet for x402-style settlement. A companion standard, CIS-8 (the External Key Registry), handles provable, revocable bindings to external and cross-chain keys. The registry produces standard agent cards for A2A-style discovery, and Concordium exposes the whole thing through an MCP service of roughly 35 AI-callable tools.
The structural divergence is what backs the owner. In CIS-8004 the owner is a Concordium account, and every Concordium account is backed by a regulated identity provider at the protocol level. "There is an accountable person or entity behind this agent" becomes a property of the protocol rather than something an agent claims. That accountability is disclosed selectively through zero-knowledge proofs, so an agent can prove it has a verified, accountable owner without exposing who that owner is. Farming that guarantee with Sybil accounts would mean defrauding a regulated identity provider, which is a different class of problem from posting fake feedback.
Honesty cuts both ways, so the caveats belong here too. The live contract facts are checkable on mainnet: the CIS-8004 registry sits at contract 10082,0 and the CIS-8 registry at 10081,0, and the instance advertises CIS-0, CIS-2, and CIS-8004 through standard detection. CIS-8004 has not yet been subject to third-party auditing.
What exists is Concordium's own documentation plus the live contracts. The technical claims are verifiable on-chain; the framing around them is Concordium's. A fair reader should hold both standards to the same standard.
ERC-8004 vs CIS-8004 at a Glance
At the identity-and-discovery layer the two are mostly mirrors. Both mint agents as NFTs, both split on-chain metadata from an off-chain file referenced by hash, both produce a discovery artifact that plugs into the A2A and MCP world, and both reserve a wallet for x402-style payments. The differences that matter are in the last four rows: what backs the owner, and how much independent evidence exists either way.
Accountability for Agents That Live Anywhere
One consequence of CIS-8004's design is easy to miss: an agent does not have to live on Concordium to be registered there. The owner is a Concordium account, since that account is what carries the verified, ZK-provable identity, but the agent itself can run on Ethereum, Solana, or off-chain entirely. Its external and cross-chain keys are bound through the CIS-8 External Key Registry, and the W3C DID it receives is anchored on Concordium while staying portable to wherever the agent operates.
Read that way, CIS-8004 is not only a registry for Concordium-native agents. It can act as an accountability layer bolted onto agents that already run elsewhere, including agents registered under ERC-8004. An agent can keep its ERC-8004 discovery and reputation footprint and gain a verified, accountable owner through CIS-8004 without leaving its home chain. The public-facing form of that guarantee is the Verified by Concordium badge, a checkable association any counterparty can inspect without the agent moving its execution to Concordium. That is what "complementary, not competing" means in practice.
Where the DID and Verifiable Credentials Camp Fits
There is a third way to solve agent identity that predates both standards: give each agent a self-controlled DID and W3C Verifiable Credentials, held off-chain. It is the lightest-weight option and avoids on-chain cost entirely. The trade-off is that identity state and reputation then live in off-chain graphs, which are harder to index permissionlessly and to enforce on-chain.
Both 8004 standards treat DIDs as a composable primitive rather than a competitor. ERC-8004 lets a registration file reference DIDs, ENS names, and agent domains inside an on-chain registry. CIS-8004 issues a DID but anchors it to an L1 account with on-chain ownership, revocation, and transfer, so identity state stays queryable and enforceable rather than living only in a wallet. What actually differs is how much of the identity and trust state you want publicly indexable and enforceable on-chain.
Who Should Build on Which
If your priority is permissionless discovery, composable reputation, and being where the largest agent-tooling ecosystem is forming, ERC-8004 is the natural home, with the caveat that you are building on a Draft standard whose reputation layer is under real scrutiny.
If your priority is a verifiable, accountable human owner behind every agent, privacy-preserving disclosure of that accountability, and readiness for environments where regulation is not optional, CIS-8004 is built for that from the ground up, with the caveat that it is younger and has not yet faced independent review.
The two are not mutually exclusive, and the more interesting future is the one where an agent is both discoverable on an open reputation layer and provably accountable through its owner. ERC-8004 has done the field a service by making agent identity a first-class, on-chain concern. The Sybil study has done it a second service by showing where feedback alone runs out.
Discovery tells you what an agent claims to do. Accountability tells you who answers for it when it doesn't.