Pith. sign in

REVIEW 3 major objections 6 minor 138 references

Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Open agent networks face a five-part trust crisis that single-agent safety and closed multi-agent coordination cannot resolve, and blockchain is the shared trust layer best positioned to address it.

desk verdict A useful organizing survey of blockchain for agent trust, with the binding of off-chain behavior to on-chain evidence as its unsolved load-bearing assumption. read the letter →

arxiv 2608.04626 v1 pith:G37DPSZI submitted 2026-08-05 cs.CR

Liehuang Zhu , Yuhang Li , Tianxing Wang , Zhihao Chen , Ke Li , Hongyi Liu , Yajie Wang , Lei Xu
show 2 more authors
Peng Jiang Zijian Zhang
This is my paper
classification cs.CR
keywords openagentnetworksblockchainAIagentstrustcrisisdecentralizedidentityverifiablecredentialsaccountabilitysurvey
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey argues that the decisive security problem for AI agents is shifting from the safety of a single model to the absence of shared trust foundations in open agent networks, where agents from different organizations discover, delegate, collaborate, and settle value without a common identity, authorization, audit, or payment infrastructure. It organizes this network-level trust crisis into five dimensions — entity and capability trust, authorization and delegation trust, information and provenance trust, coordination and group-robustness trust, and accountability and settlement trust — and shows that failures in any dimension propagate to the others. The paper's central claim is that blockchain can serve as a shared trust layer that turns selected trust objects, such as identities, credentials, authorization states, provenance records, task commitments, reputation updates, and settlement conditions, into verifiable states that mutually distrustful parties can jointly inspect. It is equally explicit that blockchain cannot determine semantic truth, capability quality, or reasoning robustness, so trustworthy agent networks require hybrid architectures pairing on-chain verification with off-chain runtime defenses. If the paper is right, the practical path to trustworthy open agent networks is not stronger sandboxes alone but a composable cross-organizational state and evidence layer on top of them.

What carries the argument

The central object is the 'shared trust layer' — the use of blockchain/DLT as a cross-organizational state substrate rather than a security replacement. The five trust dimensions form the analytical scaffold that maps each crisis to a trust object and to the blockchain mechanism that addresses it: decentralized identifiers and verifiable credentials for participant trust, smart contracts and delegation records for authority trust, hash anchoring and signed digests for information trust, collaboration traces, staking, and dispute records for collaboration trust, and verify-then-pay, escrow, and audit ledgers for settlement trust. The work this machinery does is to turn local security results into states that multiple parties can jointly read, review, and use in disputes, and to identify where on-chain mechanisms must stop so off-chain runtime defenses take over.

What would settle it

A concrete test would be to run a blockchain-anchored agent network where a compromised agent signs and submits internally consistent but fabricated execution evidence — for instance, a tool output for a call it never actually made — and check whether the attestation layer rejects it. If no deployed system can detect such false attestation, the paper's central claim is falsified in the sense that the ledger certifies records rather than behavior; if attestation layers do detect it, the shared-trust-layer thesis gains direct support.

Watch

Extended reading notes

Core claim

The paper contends that open agent networks create a trust crisis that is relational and lifecycle-shaped rather than an accumulation of single-agent vulnerabilities. As an agent's output becomes another agent's instruction, evidence, memory, or basis for payment, locally containable failures become compositional and persistent, so the unit of analysis must be the delegation chain, not the isolated model. Its five-dimensional taxonomy — participant, authority, information, collaboration, and settlement trust — is ordered by the stage of a delegated task at which trust must be established, and it treats each dimension as analytically non-collapsible: a falsified identity is an admission failure even if nothing unauthorized follows, and an unverifiable contribution record is a settlement failure even if the task itself was executed correctly. Blockchain, the paper argues, is best understood as a shared trust layer that transforms identity bindings, authorization scopes, delegation records, message digests, task proofs, reputation updates, and payment conditions into cross-organizationally verifiable states; this makes local security results inheritable, contestable, and auditable without making the ledger an oracle for correctness. The conclusion is that trustworthy agent networks require hybrid architectures in which blockchain supplies shared state, non-repudiable evidence, incentive constraints, and programmable settlement, while off-chain mechanisms retain responsibility for intent understanding, semantic verification, privacy, real-time safety, and robust reasoning.

Load-bearing premise

The load-bearing premise is that what an agent actually does off-chain can be bound to on-chain evidence such as hashes and signatures, so that recorded state reflects real behavior; if an agent can sign false or incomplete evidence without detection, the trust layer certifies only records, not trustworthy conduct.

Editorial extensions

If this is right

  • Agent interoperability protocols will need to treat identity anchoring, evidence anchoring, and revocation as first-class design requirements, not optional add-ons, for cross-organizational collaboration to be trustworthy.
  • Deployed trustworthy agent networks will be hybrid: on-chain state and evidence for cross-organizational recognition, off-chain defenses for prompt injection, memory poisoning, tool safety, semantic verification, and real-time control.
  • Reputation and settlement systems will be dependable only when contribution, task proof, and dispute evidence are anchored in tamper-evident shared records; otherwise participants can deny or manipulate the record.
  • Evaluation of agent networks should shift from single benchmark scores to lifecycle-oriented multidimensional trust profiles that exercise registration, authorization, interaction, collaboration, and settlement under adversarial conditions.
  • In cyber-physical settings such as vehicle networks, blockchain should stay outside the real-time control loop and serve ex post accountability, device-trust anchoring, and incentive alignment instead.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The taxonomy implies a concrete benchmark agenda the authors do not build: a suite that attacks each of the five trust dimensions in isolation and in combination, measuring propagation across stages rather than a single success rate.
  • The paper's own boundary between recorded state and actual behavior suggests the critical engineering bottleneck is the attestation interface: if agents can sign false or cherry-picked evidence, the ledger certifies records, not conduct, so progress on tamper-evident execution environments would directly expand what blockchain can guarantee.
  • The settlement-trust discussion points toward a legal question the paper leaves implicit: liability for emergent multi-agent harm may need a category distinct from individual-agent fault, because no single principal intended the collective outcome.
  • The separation of entity trust from capability trust implies that identity verification and capability evaluation must be co-designed; a verifiable identity without verified capability still leaves the network open to capability fraud, which is a direct corollary of the paper's non-collapsible dimensions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This survey/tutorial argues that the evolution from single-agent systems to open agent networks creates a network-level trust crisis spanning five analytically distinct dimensions: entity and capability trust, authorization and delegation trust, information and provenance trust, collaborative decision-making and group-robustness trust, and value settlement and accountability-governance trust. It further argues that blockchain cannot and should not replace agent security, semantic verification, privacy protection, or robust reasoning, but is best positioned as a shared trust layer that converts selected trust objects—identities, credentials, authorization states, provenance records, task commitments, reputation updates, and settlement conditions—into cross-organizationally verifiable states. The paper surveys the literature from 1980 to 2026, develops the five-crisis taxonomy, maps each crisis to blockchain mechanisms and their residual limits (especially in Table II), discusses three deployment scenarios (agent service markets, cross-organizational workflows, cyber-physical/vehicular networks), and proposes six future research directions.

Significance. If the framing holds, this survey provides a valuable conceptual organization for a rapidly growing and fragmented field, and its explicit boundary-setting—blockchain as a shared trust layer rather than a panacea—is a strength that distinguishes it from more promotional treatments. The paper's credible contributions include the five-dimensional taxonomy, the systematic non-chain-gap versus blockchain-supplement versus on-chain-limit structure of Table II, the scenario-level synthesis in Section V, and the future-work agenda in Section VI. These contributions are grounded in a broad citation base and the paper repeatedly and correctly notes that blockchain cannot determine semantic truth, capability quality, or reasoning correctness. The main weakness is that the paper's framing of the trust layer's guarantees does not fully confront the behavioral binding problem: the ledger can certify that an agent made a claim, not that the claim reflects actual behavior.

major comments (3)
  1. [Section II.C] The paragraphs beginning "Projecting these dynamics onto an open-ended Internet of Agents" and "Synthesizing this evolutionary trajectory" use absolute necessity language ("strictly mandates the integration of distributed ledger technologies", "unequivocally necessitates the convergence of agentic networks with distributed ledger infrastructures", "absolute void in decentralized accountability") that contradicts the paper's own careful hedging in Section IV.A and the conclusion, where blockchain is described as a supplementary trust infrastructure and where cases are noted in which "conventional access control, signed logs, trusted execution, runtime monitoring, and centralized infrastructures may be more appropriate." These passages should be rewritten to express the authors' argument as a qualitative position rather than a formal necessity, and they should be made consistent with the rest of the paper's nuanced framing.
  2. [Section IV.D and Table II] The paper acknowledges in Section IV.D and Table II that on-chain attestation proves integrity rather than semantic truth and lists "False-content attestation" as an on-chain limit. However, the residual gap is broader than semantic truth: a compromised or malicious agent can sign a false tool-output hash, a fake task proof, or an inflated contribution record, and the ledger will faithfully record that claim as non-repudiable evidence. The manuscript does not explicitly state that this behavioral binding problem—whether recorded evidence corresponds to actual off-chain execution—requires an independent execution witness such as a TEE, runtime monitor, verification oracle, or challenge-response protocol. This is load-bearing for the settlement and provenance claims in Crises 5 and 3. The paper should add a dedicated discussion of the off-chain/on-chain binding problem, describe its threat model, and clarify that tamper-evident provenance and verify-then-pay constructions prove only that a claim was made and preserved, not that the claim is true.
  3. [Abstract and Section I (Contributions)] The abstract states that blockchain "can provide shared identity, verifiable authorization, tamper-evident provenance, auditable collaboration, incentive alignment, and value settlement" without the qualifications that the body itself imposes in Section IV.A and Table II. Given the behavioral binding problem, "tamper-evident provenance" and "value settlement" as stated are misleading in their lack of qualification. The abstract and the contribution bullets should be reworded to say that blockchain can provide a shared, tamper-evident record of agent-made claims and commitments, with the explicit caveat that verifying whether those claims correspond to actual behavior requires complementary off-chain execution witnesses and verification mechanisms. This is more than a wording issue because it frames the paper's central promise to the reader.
minor comments (6)
  1. [Section I] The paper does not describe a systematic literature selection methodology (databases, search terms, inclusion/exclusion criteria, or quality weighting). For a survey of this scope and venue, a short methodology paragraph or appendix would improve reproducibility.
  2. [References] Several cited works appear to be very recent preprints with future arXiv identifiers (e.g., [27], [89], [95], [126]). The authors should verify publication status and, where possible, replace preprints with peer-reviewed versions or clearly mark them as preprints.
  3. [Section II.C] The passage "It is this absolute necessity for a deterministic, verifiable governance infrastructure that strictly mandates..." reads as an authorial opinion rather than an analytical conclusion; consider a more neutral formulation such as "we argue that..." to match the rest of the paper's tone.
  4. [Figure 1] The caption "Overall architecture of the proposed agent network" says "proposed," which is unusual for a survey; consider "Overall architecture of an open agent network" to avoid suggesting the paper introduces a specific new architecture.
  5. [Table II] The "Representative methods" column lists many recent preprints and arXiv-only works; a note indicating which methods have been peer-reviewed and which are preprints would help readers judge maturity.
  6. [Section VI.F] The proposed evaluation metrics include "dynamic trust-update quality," "capability-verification accuracy," "authorization-deviation detection rate," and "contestability of task outcomes," but these terms are not defined; brief definitions or references would strengthen the benchmark proposal.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the five-crisis taxonomy and blockchain-mapping synthesis are grounded in external literature, with only minor non-load-bearing self-citations.

full rationale

This survey and tutorial makes no predictive derivation: there are no fitted parameters, no equations whose outputs reproduce their inputs, and no empirical claims computed from within the paper. The five-dimension trust-crisis taxonomy is assembled from external, independently published results surveyed in Sections II and III (e.g., Agent-in-the-Middle attacks [7], IBGP [62], AgentPoison [6], LLMmap [86], and credit-assignment and auditability studies [96]-[101]); those works, not the paper's own conclusions, supply the content of each crisis, so the taxonomy is not defined in terms of the blockchain mechanisms it later maps onto. The blockchain-as-shared-trust-layer claim is scope-limited and explicitly hedged both in the Introduction ('blockchain should not be treated as a universal substitute for agent security') and in the Conclusion, which permits conventional access control, signed logs, and centralized infrastructures when participants already share trust foundations. Table II's mapping is a synthesis of surveyed mechanisms (BlockA2A, DMAS, MOD-X, TessPay, etc.) to the taxonomy rather than a derivation, and the paper repeatedly states the on-chain boundary: attestation proves integrity and existence, not semantic truth or actual behavior, which is exactly the limitation the skeptic highlights. That binding gap is a feasibility and correctness limitation, acknowledged in the abstract, Section IV.A, and Section VI.C; it is not circularity, because the paper never claims to have derived a solution to binding from its own assumptions. The only self-citations are reference [112] (an agentic-commerce SoK including author L. Zhu), used as auxiliary support that transaction authorization is a risk dimension, and reference [124] (AgentOps, including L. Zhu), cited alongside [100] for the observation that auditability research emphasizes recording and monitoring. Neither is load-bearing for the central taxonomy or the necessity claim, and both points are independently corroborated by other cited external work. The paper is therefore self-contained as a survey: its organization is a framing choice, and its factual claims rest on external literature, so the appropriate finding is no significant circularity, with a score of 1 reflecting only minor non-load-bearing self-citation.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper is a qualitative survey, so there are no fitted parameters or invented physical entities. The axioms listed are the background assumptions needed for the central thesis; the most fragile is the claim that the five dimensions are non-collapsible, which is asserted rather than demonstrated.

assumptions (4)
  • domain assumption AI agents in open networks face attacks such as prompt injection, memory poisoning, and tool misuse.
    Supported by cited empirical work (e.g., InjecAgent, AgentPoison); the survey builds its taxonomy on this foundation.
  • domain assumption Blockchain provides tamper-evident, append-only records and programmable smart contracts.
    Treated as standard background properties of distributed ledger technologies.
  • domain assumption Open agent networks lack shared identity, authorization, audit, reputation, and settlement infrastructures by definition.
    The paper defines 'open agent network' in these terms, making the trust crisis a structural consequence.
  • ad hoc to paper The five trust crises are analytically non-collapsible.
    Asserted in Section III without formal proof; this non-collapsibility is load-bearing for the taxonomy's usefulness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions." pith.science (2026). https://pith.science/paper/G37DPSZI

@misc{pith2026260804626,
  author       = {Pith},
  title        = {Pith review of: Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G37DPSZI}},
  note         = {Machine review of arXiv:2608.04626}
}
read the original abstract

AI agents are evolving from isolated task executors into networked autonomous entities that can communicate, delegate tasks, invoke tools, access external knowledge, and participate in cross-platform service and economic workflows. This evolution gives rise to open agent networks, where heterogeneous agents owned by different stakeholders interact without naturally shared infrastructures for identity, authorization, auditability, reputation, or settlement. This survey and tutorial article reviews the literature over the period 1980--2026 on the evolution from classical multi-agent systems to open agent networks, with a particular focus on LLM-based autonomous agents, agent interoperability protocols, Internet-of-Agents infrastructures, and blockchain-enabled trust mechanisms. We first review this evolution and show how the trust boundary expands from individual execution to cross-agent, cross-platform, and cross-organizational interaction. We then identify a network-level trust crisis that cannot be fully addressed by single-agent safety mechanisms or closed multi-agent coordination techniques, and develop a five-dimensional taxonomy covering entity and capability trust, authorization and delegation trust, information and provenance trust, coordination and group-robustness trust, and accountability and settlement trust. Based on this taxonomy, we examine how blockchain can provide shared identity, verifiable authorization, tamper-evident provenance, auditable collaboration, incentive alignment, and value settlement for trustworthy agent networks. We further synthesize the mapping between agent-network risks, trust requirements, and blockchain-enabled mechanisms, and clarify the role of blockchain as a shared trust layer rather than a replacement for agent security, semantic verification, privacy protection, or robust reasoning.

Figures

Figures reproduced from arXiv: 2608.04626 by the authors.

Figure 1
Figure 1. Overall architecture of the proposed agent network. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Design principles and evaluation framework for trustworthy open agent networks. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Trust Crises in Agent Networks. action is authorized, that a message is reliable, or that a contribution claim is accurate. Second, trustworthy operation requires continuous lifecycle governance: admission, dele￾gation, interaction, collaboration, and settlement should be connected through an end-to-end governance process rather than secured as isolated stages. Third, trust-critical claims should satisfy evidence-ba… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Blockchain as a shared trust layer and its functional boundaries in open agent networks. [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

138 extracted references · 19 canonical work pages

  1. [1]

    Human-level control through deep reinforcement learning,

    V . Mnih, K. Kavukcuoglu, D. Silver, A. A. Rusu, J. Veness, M. G. Bellemare, A. Graves, M. A. Riedmiller, A. Fidjeland, G. Ostrovski, S. Petersen, C. Beattie, A. Sadik, I. Antonoglou, H. King, D. Kumaran, D. Wierstra, S. Legg, and D. Hassabis, “Human-level control through deep reinforcement learning,”Nat., vol. 518, no. 7540, pp. 529–533,

  2. [2]

    React: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y . Cao, “React: Synergizing reasoning and acting in language models,” inThe Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023. [Online]. Available: https://openreview.net/forum?id=WE\ vluYUL-X

    2023

  3. [3]

    Toolformer: Language models can teach themselves to use tools,

    T. Schick, J. Dwivedi-Yu, R. Dess `ı, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA, USA, December 10 - 16,...

    2023

  4. [4]

    Webgpt: Browser-assisted question-answering with human feedback,

    R. Nakano, J. Hilton, S. Balaji, J. Wu, L. Ouyang, C. Kim, C. Hesse, S. Jain, V . Kosaraju, W. Saunders, X. Jiang, K. Cobbe, T. Eloundou, G. Krueger, K. Button, M. Knight, B. Chess, and J. Schulman, “Webgpt: Browser-assisted question-answering with human feedback,”CoRR, vol. abs/2112.09332, 2021. [Online]. Available: https://arxiv.org/abs/2112.09332

    arXiv 2021

  5. [5]

    Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,

    Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” inFindings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11- 16, 2024, ser. Findings of ACL, L. Ku, A. Martins, and V . Srikumar, Eds., vol. ACL 2024. Ass...

    doi:10.18653/v1/2024.findings-acl.624 2024

  6. [6]

    Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases,

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases,” inAdvances in Neural Information Processing Systems 37: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, A. Globersons, L. Mackey, D. Belgrave, A. Fan, U...

    2024

  7. [7]

    Red-teaming LLM multi-agent systems via communication attacks,

    P. He, Y . Lin, S. Dong, H. Xu, Y . Xing, and H. Liu, “Red-teaming LLM multi-agent systems via communication attacks,” inFindings of the Association for Computational Linguistics, ACL 2025, Vienna, Austria, July 27 - August 1, 2025, ser. Findings of ACL, W. Che, J. Nabende, E. Shutova, and M. T. Pilehvar, Eds., vol. ACL 2025. Association for Computational...

    doi:10.18653/v1/2025.findings-acl.349 2025

  8. [8]

    Agents under siege: Breaking pragmatic multi-agent LLM systems with optimized prompt attacks,

    R. M. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent LLM systems with optimized prompt attacks,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, Vienna, Austria, July 27 - August 1, 2025, W. Che, J. Nabende, E. Shutova, and M...

    2025

Show all 138 references
  1. [9]

    A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (ANP),

    A. Ehtesham, A. Singh, G. K. Gupta, and S. Kumar, “A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (ANP),”CoRR, vol. abs/2505.02279, 2025. [Online]. Availa...

    2025 doi arXiv

  2. [10]

    Internet of agents: Fundamentals, applications, and challenges,

    Y . Wang, S. Guo, Y . Pan, Z. Su, F. Chen, T. H. Luan, P. Li, J. Kang, and D. Niyato, “Internet of agents: Fundamentals, applications, and challenges,”IEEE Trans. Cogn. Commun. Netw., vol. 12, pp. 4476–4501, 2026. [Online]. Available: https://doi.org/10.1109/TCCN. 2025.3623369

    2026

  3. [11]

    Decentralized identifiers (dids) v1. 0,

    D. Reed, M. Sporny, D. Longley, C. Allen, R. Grant, M. Sabadello, and J. Holt, “Decentralized identifiers (dids) v1. 0,”Draft Community Group Report, 2020

    2020

  4. [12]

    Sporny, D

    M. Sporny, D. Longley, and D. Chadwick,Verifiable Credentials Data Model 2.0, World Wide Web Consortium, May 2025, w3C Recommendation. [Online]. Available: https://www.w3.org/TR/ vc-data-model/

    2025

  5. [13]

    Smart contracts: building blocks for digital markets,

    N. Szabo, “Smart contracts: building blocks for digital markets,” EXTROPY: The Journal of Transhumanist Thought, vol. 18, no. 2, p. 28, 1996

    1996

  6. [14]

    Ethereum: A secure decentralised generalised trans- action ledger,

    G. Woodet al., “Ethereum: A secure decentralised generalised trans- action ledger,”Ethereum project yellow paper, vol. 151, no. 2014, pp. 1–32, 2014

    2014

  7. [15]

    AI agents under threat: A survey of key security challenges and future pathways,

    Z. Deng, Y . Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y . Xiang, “AI agents under threat: A survey of key security challenges and future pathways,”ACM Comput. Surv., vol. 57, no. 7, pp. 182:1–182:36,

  8. [16]

    Navigating the risks: A survey of security, privacy, and ethics threats in llm- based agents,

    Y . Gan, Y . Yang, Z. Ma, P. He, R. Zeng, Y . Wang, Q. Li, C. Zhou, S. Li, T. Wang, Y . Gao, Y . Wu, and S. Ji, “Navigating the risks: A survey of security, privacy, and ethics threats in llm- based agents,”CoRR, vol. abs/2411.09523, 2024. [Online]. Available: https://doi.org/...

    2024 doi arXiv

  9. [17]

    A survey on autonomy-induced security risks in large model-based agents,

    H. Su, J. Luo, C. Liu, X. Yang, Y . Zhang, Y . Dong, and J. Zhu, “A survey on autonomy-induced security risks in large model-based agents,”CoRR, vol. abs/2506.23844, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2506.23844

    2025 doi arXiv

  10. [18]

    Agentic AI security: Threats, defenses, evaluation, and open challenges,

    A. Chhabra, S. Datta, S. K. Nahin, and P. Mohapatra, “Agentic AI security: Threats, defenses, evaluation, and open challenges,” IEEE Access, vol. 14, pp. 49 455–49 482, 2026. [Online]. Available: https://doi.org/10.1109/ACCESS.2026.3675554

    2026

  11. [19]

    Securing llm- based agents against cyberattacks: a comprehensive survey on attack techniques and defense strategies,

    N. Tamuka, T. E. Mathonsi, O. T. Otieno, S. Maswikaneng, T. Muchenje, and T. M. Tshilongamulenzhe, “Securing llm- based agents against cyberattacks: a comprehensive survey on attack techniques and defense strategies,”Journal of Computer Virology and Hacking Techniques, 2026. [...

    2026

  12. [20]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y . Lin, W. X. Zhao, Z. Wei, and J. Wen, “A survey on large language model based autonomous agents,”Frontiers Comput. Sci., vol. 18, no. 6, p. 186345, 2024. [Online]. Available: https://doi.org/10...

    2024 doi

  13. [21]

    A survey on the memory mechanism of large language model- based agents,

    Z. Zhang, Q. Dai, X. Bo, C. Ma, R. Li, X. Chen, J. Zhu, Z. Dong, and J. Wen, “A survey on the memory mechanism of large language model- based agents,”ACM Trans. Inf. Syst., vol. 43, no. 6, pp. 155:1–155:47,

  14. [22]

    Large language model based multi-agents: A survey of progress and challenges,

    T. Guo, X. Chen, Y . Wang, R. Chang, S. Pei, N. V . Chawla, O. Wiest, and X. Zhang, “Large language model based multi-agents: A survey of progress and challenges,” inProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI 2024, Jeju, So...

    2024

  15. [23]

    A survey on llm-based multi-agent system: Recent advances and new frontiers in application,

    S. Chen, Y . Liu, W. Han, W. Zhang, and T. Liu, “A survey on llm-based multi-agent system: Recent advances and new frontiers in application,”

  16. [24]

    Available: https://doi.org/10.1145/3748302

    [Online]. Available: https://doi.org/10.1145/3748302

    doi

  17. [25]

    Toward a safe internet of agents,

    J. A. Wibowo and G. C. Polyzos, “Toward a safe internet of agents,”CoRR, vol. abs/2512.00520, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2512.00520

    2025 doi arXiv

  18. [26]

    Open challenges in multi-agent security: Towards secure systems of interacting AI agents,

    C. S. de Witt, “Open challenges in multi-agent security: Towards secure systems of interacting AI agents,”CoRR, vol. abs/2505.02077,

    arXiv

  19. [27]

    Available: https://arxiv.org/abs/2412.17481

    [Online]. Available: https://arxiv.org/abs/2412.17481

    arXiv

  20. [28]

    A survey of llm-driven AI agent communication: Protocols, security risks, and defense countermeasures,

    D. Kong, S. Lin, Z. Xu, Z. Wang, M. Li, Y . Li, Y . Zhang, H. Peng, Z. Sha, Y . Li, C. Lin, X. Wang, X. Liu, N. Zhang, C. Chen, M. K. Khan, and M. Han, “A survey of llm-driven AI agent communication: Protocols, security risks, and defense countermeasures,”CoRR, vol. abs/2506.1...

    2025 doi

  21. [29]

    AI agents meet blockchain: A survey on secure and scalable collaboration for multi-agents,

    M. M. Karim, D. H. Van, S. Khan, Q. Qu, and Y . Kholodov, “AI agents meet blockchain: A survey on secure and scalable collaboration for multi-agents,”Future Internet, vol. 17, no. 2, p. 57, 2025. [Online]. Available: https://doi.org/10.3390/fi17020057

    2025 doi

  22. [30]

    Autonomous agents on blockchains: Standards, execution models, and trust boundaries,

    S. Alqithami, “Autonomous agents on blockchains: Standards, execution models, and trust boundaries,”CoRR, vol. abs/2601.04583,

  23. [31]

    Available: https://doi.org/10.48550/arXiv.2505.02077

    [Online]. Available: https://doi.org/10.48550/arXiv.2505.02077

    doi arXiv

  24. [32]

    Security threat modeling for emerging ai-agent protocols: A comparative analysis of mcp, a2a, agora, and ANP,

    Z. Anbiaee, M. Rabbani, M. Mirani, G. Piya, I. V . Opushnyev, A. A. Ghorbani, and S. Dadkhah, “Security threat modeling for emerging ai-agent protocols: A comparative analysis of mcp, a2a, agora, and ANP,”CoRR, vol. abs/2602.11327, 2026. [Online]. Available: https://doi.org/10...

    2026 doi arXiv

  25. [33]

    Security of internet of agents: Attacks and countermeasures,

    Y . Wang, Y . Pan, S. Guo, and Z. Su, “Security of internet of agents: Attacks and countermeasures,”IEEE Open J. Comput. Soc., vol. 6, pp. 1611–1624, 2025. [Online]. Available: https: //doi.org/10.1109/OJCS.2025.3589638

    2025

  26. [35]

    Chain-of-thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, B. Ichter, F. Xia, E. H. Chi, Q. V . Le, and D. Zhou, “Chain-of-thought prompting elicits reasoning in large language models,” inAdvances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing S...

    2022

  27. [36]

    Tree of thoughts: Deliberate problem solving with large language models,

    S. Yao, D. Yu, J. Zhao, I. Shafran, T. Griffiths, Y . Cao, and K. Narasimhan, “Tree of thoughts: Deliberate problem solving with large language models,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, Neu...

    2023

  28. [37]

    Sok: Security and privacy of AI agents for blockchain,

    N. Romandini, C. Mazzocca, K. Otsuki, and R. Montanari, “Sok: Security and privacy of AI agents for blockchain,” in7th International Conference on Blockchain Computing and Applications, BCCA 2025, Durbovnic, Croatia, October 14-17, 2025. IEEE, 2025, pp. 708–

    2025

  29. [38]

    Hugginggpt: Solving AI tasks with chatgpt and its friends in hugging face,

    Y . Shen, K. Song, X. Tan, D. Li, W. Lu, and Y . Zhuang, “Hugginggpt: Solving AI tasks with chatgpt and its friends in hugging face,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orle...

    2023

  30. [39]

    The contract net protocol: High-level communication and control in a distributed problem solver,

    R. G. Smith, “The contract net protocol: High-level communication and control in a distributed problem solver,”IEEE Trans. Computers, vol. 29, no. 12, pp. 1104–1113, 1980. [Online]. Available: https://doi.org/10.1109/TC.1980.1675516

    1980

  31. [40]

    KQML as an agent communication language,

    T. W. Finin, R. Fritzson, D. P. McKay, and R. McEntire, “KQML as an agent communication language,” inProceedings of the Third International Conference on Information and Knowledge Management (CIKM’94), Gaithersburg, Maryland, USA, November 29 - December 2, 1994. ACM, 1994, pp....

    1994

  32. [41]

    Retrieval-augmented generation for knowledge-intensive NLP tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W. Yih, T. Rockt ¨aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive NLP tasks,” inAdvances in Neural Information Processing Systems 33: Annual Con...

    2020

  33. [42]

    Generative agents: Interactive simulacra of human behavior,

    J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” inProceedings of the 36th Annual ACM Symposium on User Interface Software and Technology, UIST 2023, San Francisco, CA, USA, 29 Octo...

    2023

  34. [43]

    Reflexion: language agents with verbal reinforcement learning,

    N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: language agents with verbal reinforcement learning,” inAdvances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, LA...

    2023

  35. [44]

    Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,” in34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino, Eds. USENIX A...

    2025

  36. [45]

    Struq: Defending against prompt injection with structured queries,

    S. Chen, J. Piet, C. Sitawarin, and D. A. Wagner, “Struq: Defending against prompt injection with structured queries,” in 34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino, Eds. USENIX Association, 2025, pp. ...

    2025

  37. [46]

    Agent security bench (ASB): formalizing and benchmarking attacks and defenses in llm-based agents,

    H. Zhang, J. Huang, K. Mei, Y . Yao, Z. Wang, C. Zhan, H. Wang, and Y . Zhang, “Agent security bench (ASB): formalizing and benchmarking attacks and defenses in llm-based agents,” inThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, Apri...

    2025

  38. [47]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fischer, and F. Tram`er, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents,” inAdvances in Neural Information Processing Systems 37: Annual Conference on Neural Infor...

    2024

  39. [48]

    ACE: A security architecture for llm- integrated app systems,

    E. Li, T. Mallick, E. Rose, W. K. Robertson, A. Oprea, and C. Nita-Rotaru, “ACE: A security architecture for llm- integrated app systems,” in33rd Annual Network and Distributed System Security Symposium, NDSS 2026, San Diego, California, USA, February 23-27, 2026. The Internet...

    2026

  40. [49]

    Prompt injection attack to tool selection in LLM agents,

    J. Shi, Z. Yuan, G. Tie, P. Zhou, N. Z. Gong, and L. Sun, “Prompt injection attack to tool selection in LLM agents,” in33rd Annual Network and Distributed System Security Symposium, NDSS 2026, San Diego, California, USA, February 23-27, 2026. The Internet Society, 2026. [Onlin...

    2026

  41. [50]

    Bellifemine, G

    F. Bellifemine, G. Caire, and D. Greenwood,Developing Multi- Agent Systems with JADE. Wiley, 2007. [Online]. Available: https://doi.org/10.1002/9780470058411

    2007 doi

  42. [51]

    CAMEL: communicative agents for

    G. Li, H. A. A. K. Hammoud, H. Itani, D. Khizbullin, and B. Ghanem, “CAMEL: communicative agents for ”mind” exploration of large scale language model society,”CoRR, vol. abs/2303.17760, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2303.17760

    2023 doi arXiv

  43. [52]

    Autogen: Enabling next-gen LLM applications via multi-agent conversation framework,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, S. Zhang, E. Zhu, B. Li, L. Jiang, X. Zhang, and C. Wang, “Autogen: Enabling next-gen LLM applications via multi-agent conversation framework,”CoRR, vol. abs/2308.08155, 2023. [Online]. Available: https://doi.org/10.48550/ arXiv.2308.08155

    2023 doi arXiv

  44. [53]

    Chatdev: Communicative agents for software development,

    C. Qian, W. Liu, H. Liu, N. Chen, Y . Dang, J. Li, C. Yang, W. Chen, Y . Su, X. Cong, J. Xu, D. Li, Z. Liu, and M. Sun, “Chatdev: Communicative agents for software development,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1...

    2024 doi

  45. [54]

    Identifying the risks of LM agents with an lm-emulated sandbox,

    Y . Ruan, H. Dong, A. Wang, S. Pitis, Y . Zhou, J. Ba, Y . Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of LM agents with an lm-emulated sandbox,” 2024. [Online]. Available: https://openreview.net/forum?id=GEcwtMk1uA

    2024

  46. [55]

    Agentverse: Facilitating multi-agent collaboration and exploring emergent behaviors,

    W. Chen, Y . Su, J. Zuo, C. Yang, C. Yuan, C. Chan, H. Yu, Y . Lu, Y . Hung, C. Qian, Y . Qin, X. Cong, R. Xie, Z. Liu, M. Sun, and J. Zhou, “Agentverse: Facilitating multi-agent collaboration and exploring emergent behaviors,” inThe Twelfth International Conference on Learnin...

    2024

  47. [56]

    The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents,

    F. Jia, T. Wu, X. Qin, and A. C. Squicciarini, “The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, Vi...

    2025 doi

  48. [57]

    Improving factuality and reasoning in language models through multiagent debate,

    Y . Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch, “Improving factuality and reasoning in language models through multiagent debate,” inForty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024, ser. Proceedings of Machin...

    2024

  49. [58]

    [Online]

    Foundation for Intelligent Physical Agents,FIPA Communicative Act Library Specification, Foundation for Intelligent Physical Agents, 2002, technical specification; not found in DBLP. [Online]. Available: http://www.fipa.org/specs/fipa00037/SC00037J.html

    2002

  50. [59]

    Multiagentbench : Evaluating the collaboration and competition of LLM agents,

    K. Zhu, H. Du, Z. Hong, X. Yang, S. Guo, Z. Wang, Z. Wang, C. Qian, R. Tang, H. Ji, and J. You, “Multiagentbench : Evaluating the collaboration and competition of LLM agents,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: ...

    2025

  51. [60]

    G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems,

    S. Wang, G. Zhang, M. Yu, G. Wan, F. Meng, C. Guo, K. Wang, and Y . Wang, “G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pa...

    2025

  52. [61]

    The byzantine generals problem,

    L. Lamport, R. E. Shostak, and M. C. Pease, “The byzantine generals problem,”ACM Trans. Program. Lang. Syst., vol. 4, no. 3, pp. 382–401,

  53. [62]

    IBGP: imperfect byzantine generals problem for zero-shot robustness in communicative multi-agent systems,

    Y . Mao, Y . Kang, P. Li, W. Xu, and C. Zhang, “IBGP: imperfect byzantine generals problem for zero-shot robustness in communicative multi-agent systems,” inArtificial General Intelligence - 18th International Conference, AGI 2025, Reykjavic, Iceland, August 10-13, 2025, Proce...

    2025 doi

  54. [63]

    Metagpt: Meta programming for A multi-agent collaborative framework,

    S. Hong, M. Zhuge, J. Chen, X. Zheng, Y . Cheng, J. Wang, C. Zhang, Z. Wang, S. K. S. Yau, Z. Lin, L. Zhou, C. Ran, L. Xiao, C. Wu, and J. Schmidhuber, “Metagpt: Meta programming for A multi-agent collaborative framework,” inThe Twelfth International Conference on Learning Rep...

    2024

  55. [64]

    Uddi version 3.0,

    T. Bellwood, L. Cl ´ement, D. Ehnebuske, A. Hately, M. Hondo, Y . L. Husband, K. Januszewski, S. Lee, B. McKee, J. Munteret al., “Uddi version 3.0,”Published specification, Oasis, vol. 5, pp. 16–18, 2002

    2002

  56. [65]

    Scaling large language model-based multi-agent collaboration,

    C. Qian, Z. Xie, Y . Wang, W. Liu, K. Zhu, H. Xia, Y . Dang, Z. Du, W. Chen, C. Yang, Z. Liu, and M. Sun, “Scaling large language model-based multi-agent collaboration,” inThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24-28, 2...

    2025

  57. [66]

    Agent client protocol,

    Agent Client Protocol, “Agent client protocol,” 2025, gitHub repository; accessed 2026-07-15. [Online]. Available: https://github. com/agentclientprotocol

    2025

  58. [67]

    Multi-llm debate: Framework, principals, and interventions,

    A. Estornell and Y . Liu, “Multi-llm debate: Framework, principals, and interventions,” inAdvances in Neural Information Processing Systems 37: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024, A. Glob...

    2024

  59. [68]

    Agent network protocol technical white paper,

    G. Chang, E. Lin, C. Yuan, R. Cai, B. Chen, X. Xie, and Y . Zhang, “Agent network protocol technical white paper,”CoRR, vol. abs/2508.00007, 2025. [Online]. Available: https://doi.org/10.48550/ arXiv.2508.00007

    2025 doi arXiv

  60. [69]

    MCP security bench (MSB): benchmarking attacks against model context protocol in LLM agents,

    D. Zhang, Z. Li, X. Luo, X. Liu, P. Li, and W. Xu, “MCP security bench (MSB): benchmarking attacks against model context protocol in LLM agents,”CoRR, vol. abs/2510.15994, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2510.15994

    2025 doi

  61. [70]

    Gribneau, M

    C. Gribneau, M. Prorock, O. Steele, O. Terbu, M. Xu, and D. Zagidulin,did:web Method Specification, W3C Credentials Community Group, 2024, latest Editor’s draft. [Online]. Available: https://w3c-ccg.github.io/did-method-web/

    2024

  62. [71]

    Sok: Trusting self-sovereign identity,

    E. Krul, H. Paik, S. Ruj, and S. S. Kanhere, “Sok: Trusting self-sovereign identity,”Proc. Priv. Enhancing Technol., vol. 2024, no. 3, pp. 297–313, 2024. [Online]. Available: https://doi.org/10. 56553/popets-2024-0079

    2024

  63. [72]

    Json-ld 1.1–a json-based serialization for linked data,

    G. Kellogg, P.-A. Champin, and D. Longley, “Json-ld 1.1–a json-based serialization for linked data,” Ph.D. dissertation, W3C, 2019

    2019

  64. [73]

    Web services description language (WSDL),

    “Web services description language (WSDL),” inEncyclopedia of IEEE COMMUNICATIONS SURVEYS & TUTORIALS 28 Social Network Analysis and Mining, 2014, p. 2405. [Online]. Available: https://doi.org/10.1007/978-1-4614-6170-8\ 100914

    2014 doi

  65. [74]

    The oauth 2.0 authorization framework,

    D. Hardt, “The oauth 2.0 authorization framework,” Tech. Rep., 2012

    2012

  66. [75]

    Model context protocol,

    M. C. Protocol, “Model context protocol,”URL https://github. com/modelcontextprotocol, accessed, pp. 03–12, 2025

    2025

  67. [76]

    Practical byzantine fault tolerance,

    M. Castro and B. Liskov, “Practical byzantine fault tolerance,” inProceedings of the Third USENIX Symposium on Operating Systems Design and Implementation (OSDI), New Orleans, Louisiana, USA, February 22-25, 1999, M. I. Seltzer and P. J. Leach, Eds. USENIX Association, 1999, p...

    1999

  68. [77]

    Agent2agent (a2a) protocol,

    A2A Project, “Agent2agent (a2a) protocol,” 2025, gitHub repository; accessed 2026-07-15. [Online]. Available: https: //github.com/a2aproject/A2A

    2025

  69. [78]

    Blockchain-enhanced incentive-compatible mechanisms for multi-agent reinforcement learning systems,

    K. Tian, “Blockchain-enhanced incentive-compatible mechanisms for multi-agent reinforcement learning systems,”Scientific Reports, 2025

    2025

  70. [79]

    Towards transparent and incentive-compatible collaboration in decentralized LLM multi-agent systems: A blockchain-driven approach,

    M. Qi, T. Zhu, L. Zhang, N. Li, and W. Zhou, “Towards transparent and incentive-compatible collaboration in decentralized LLM multi-agent systems: A blockchain-driven approach,”CoRR, vol. abs/2509.16736,

  71. [80]

    Inherent and emergent liability issues in llm-based agentic systems: a principal-agent perspective,

    G. A. Gabison and R. P. Xian, “Inherent and emergent liability issues in llm-based agentic systems: a principal-agent perspective,” CoRR, vol. abs/2504.03255, 2025. [Online]. Available: https://doi.org/ 10.48550/arXiv.2504.03255

    2025 doi arXiv

  72. [81]

    A survey on trustworthy LLM agents: Threats and countermeasures,

    M. Yu, F. Meng, X. Zhou, S. Wang, J. Mao, L. Pang, T. Chen, K. Wang, X. Li, Y . Zhang, B. An, and Q. Wen, “A survey on trustworthy LLM agents: Threats and countermeasures,” in Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining, V .2, KDD 2025,...

    2025

  73. [82]

    Security of llm-based agents regarding attacks, defenses, and applications: A comprehensive survey,

    Y . Tang, Y . Liu, J. Lan, Z. Yan, and E. Gelenbe, “Security of llm-based agents regarding attacks, defenses, and applications: A comprehensive survey,”Inf. Fusion, vol. 127, p. 103941, 2026. [Online]. Available: https://doi.org/10.1016/j.inffus.2025.103941

    2026

  74. [83]

    Schema.org: evolution of structured data on the web,

    R. V . Guha, D. Brickley, and S. Macbeth, “Schema.org: evolution of structured data on the web,”Commun. ACM, vol. 59, no. 2, pp. 44–51, 2016. [Online]. Available: https://doi.org/10.1145/2844544

    2016 doi

  75. [84]

    A survey on decentralized identifiers and verifiable credentials,

    C. Mazzocca, A. Acar, A. S. Uluagac, R. Montanari, P. Bellavista, and M. Conti, “A survey on decentralized identifiers and verifiable credentials,”IEEE Commun. Surv. Tutorials, vol. 27, no. 6, pp. 3641– 3671, 2025. [Online]. Available: https://doi.org/10.1109/COMST.2025. 3543197

    2025 doi

  76. [85]

    The transport layer security (tls) protocol version 1.3,

    E. Rescorla, “The transport layer security (tls) protocol version 1.3,” Tech. Rep., 2018

    2018

  77. [86]

    Llmmap: Fingerprinting for large language models,

    D. Pasquini, E. M. Kornaropoulos, and G. Ateniese, “Llmmap: Fingerprinting for large language models,” in34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino, Eds. USENIX Association, 2025, pp. 299–318. [Online]...

    2025

  78. [87]

    Bitcoin: A peer-to-peer electronic cash system,

    S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” 2008

    2008

  79. [88]

    Shortcutsbench: A large-scale real-world benchmark for api-based agents,

    H. Shen, Y . Li, D. Meng, D. Cai, S. Qi, L. Zhang, M. Xu, and Y . Ma, “Shortcutsbench: A large-scale real-world benchmark for api-based agents,” inThe Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, April 24- 28, 2025. OpenReview.net, 202...

    2025

  80. [89]

    Benchmarking LLM tool-use in the wild,

    P. Yu, W. Liu, Y . Yang, J. Li, Z. Zhang, X. Feng, and F. Zhang, “Benchmarking LLM tool-use in the wild,”CoRR, vol. abs/2604.06185,

    arXiv

  81. [90]

    Available: https://doi.org/10.48550/arXiv.2509.16736

    [Online]. Available: https://doi.org/10.48550/arXiv.2509.16736

    doi

  82. [91]

    Make agent defeat agent: Automatic detection of taint-style vulnerabilities in llm-based agents,

    F. Liu, Y . Zhang, J. Luo, J. Dai, T. Chen, L. Yuan, Z. Yu, Y . Shi, K. Li, C. Zhou, H. Chen, and M. Yang, “Make agent defeat agent: Automatic detection of taint-style vulnerabilities in llm-based agents,” in34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, US...

    2025

  83. [92]

    Watch out for your agents! investigating backdoor threats to llm-based agents,

    W. Yang, X. Bi, Y . Lin, S. Chen, J. Zhou, and X. Sun, “Watch out for your agents! investigating backdoor threats to llm-based agents,” inAdvances in Neural Information Processing Systems 37: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancou...

    2024

  84. [93]

    Overcoming the retrieval barrier: Indirect prompt injection in the wild for LLM systems,

    H. Chang, E. Bao, X. Luo, and T. Yu, “Overcoming the retrieval barrier: Indirect prompt injection in the wild for LLM systems,”CoRR, vol. abs/2601.07072, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2601.07072

    2026 doi

  85. [94]

    From prompt injections to protocol exploits: Threats in llm-powered AI agents workflows,

    M. A. Ferrag, N. Tihanyi, D. Hamouda, L. Maglaras, A. Lakas, and M. Debbah, “From prompt injections to protocol exploits: Threats in llm-powered AI agents workflows,”ICT Express, vol. 12, no. 2, pp. 353–383, 2026. [Online]. Available: https: //doi.org/10.1016/j.icte.2025.12.001

    2026 doi

  86. [95]

    The agent economy: A blockchain-based foundation for autonomous AI agents,

    M. Xu, “The agent economy: A blockchain-based foundation for autonomous AI agents,”CoRR, vol. abs/2602.14219, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2602.14219

    2026 doi

  87. [96]

    Syra: Sybil-resilient anonymous signatures with applications to decentralized identity,

    E. C. Crites, A. Kiayias, M. Kohlweiss, and A. Sarencheh, “Syra: Sybil-resilient anonymous signatures with applications to decentralized identity,” inProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2025, Taipei, Taiwan, October 13-17,...

    2025

  88. [97]

    Reputation-filtered reward reshaping: Encouraging cooperation in high dimensional semi-cooperative multi-agent settings,

    H. Raissouni, W. Bekhti, B. E. Khamlichi, and A. E. F. Seghrouchni, “Reputation-filtered reward reshaping: Encouraging cooperation in high dimensional semi-cooperative multi-agent settings,” inProceedings of the 24th International Conference on Autonomous Agents and Multiagent...

    2025

  89. [98]

    Toolllm: Facilitating large language models to master 16000+ real-world apis,

    Y . Qin, S. Liang, Y . Ye, K. Zhu, L. Yan, Y . Lu, Y . Lin, X. Cong, X. Tang, B. Qian, S. Zhao, L. Hong, R. Tian, R. Xie, J. Zhou, M. Gerstein, D. Li, Z. Liu, and M. Sun, “Toolllm: Facilitating large language models to master 16000+ real-world apis,” inThe Twelfth Internationa...

    2024

  90. [99]

    Adaptive accountability in networked multi-agent sys- tems,

    S. Alqithami, “Adaptive accountability in networked multi-agent sys- tems,” inProceedings of the AAAI/ACM Conference on AI, Ethics, and Society, vol. 8, no. 1, 2025, pp. 127–137

    2025

  91. [100]

    Creating characteristically auditable agentic ai systems,

    C. C. Phiri, “Creating characteristically auditable agentic ai systems,” inProceedings of the Intelligent Robotics FAIR 2025, 2025, pp. 1–14

    2025

  92. [101]

    Available: https://doi.org/10.48550/arXiv.2604.06185

    [Online]. Available: https://doi.org/10.48550/arXiv.2604.06185

    doi arXiv

  93. [102]

    Confusedpilot: Confused deputy risks in rag-based llms,

    A. RoyChowdhury, M. Luo, P. Sahu, S. Banerjee, and M. Tiwari, “Confusedpilot: Confused deputy risks in rag-based llms,”CoRR, vol. abs/2408.04870, 2024. [Online]. Available: https://doi.org/10.48550/ arXiv.2408.04870

    2024 doi arXiv

  94. [103]

    Blocka2a: Towards secure and verifiable agent-to-agent interoperability,

    Z. Zou, Z. Liu, L. Zhao, and Q. Zhan, “Blocka2a: Towards secure and verifiable agent-to-agent interoperability,”CoRR, vol. abs/2508.01332,

  95. [104]

    Binding agent ID: unleashing the power of AI agents with accountability and credibility,

    Z. Lin, S. Zhang, G. Liao, D. Tao, and T. Wang, “Binding agent ID: unleashing the power of AI agents with accountability and credibility,”CoRR, vol. abs/2512.17538, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2512.17538

    2025 doi

  96. [105]

    Enhancing the A2A protocol with blockchain-based identities and x402 micropayments for agentic AI,

    A. Vaziry, S. R. Garzon, and A. K ¨upper, “Enhancing the A2A protocol with blockchain-based identities and x402 micropayments for agentic AI,” inComputational Intelligence - 17th International Joint Conference, IJCCI 2025, Marbella, Spain, October 22-24, 2025, Proceedings, Par...

    2025 doi

  97. [106]

    Machine against the RAG: jamming retrieval-augmented generation with blocker documents,

    A. Shafran, R. Schuster, and V . Shmatikov, “Machine against the RAG: jamming retrieval-augmented generation with blocker documents,” in 34th USENIX Security Symposium, USENIX Security 2025, Seattle, WA, USA, August 13-15, 2025, L. Bauer and G. Pellegrino, Eds. USENIX Associat...

    2025

  98. [107]

    Agent- osi: A layered protocol stack toward a decentralized internet of agents,

    W. Xu, T. Wang, Y . Xia, S. Zhang, and S. C. Liew, “Agent- osi: A layered protocol stack toward a decentralized internet of agents,”CoRR, vol. abs/2602.13795, 2026. [Online]. Available: https://doi.org/10.48550/arXiv.2602.13795

    2026 doi arXiv

  99. [109]

    Agent exchange: Shaping the future of AI agent economics,

    Y . Yang, Y . Wen, J. Wang, and W. Zhang, “Agent exchange: Shaping the future of AI agent economics,”CoRR, vol. abs/2507.03904, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2507.03904

    2025 doi arXiv

  100. [110]

    Leveraging large language models for effective and explainable multi-agent credit assignment,

    K. Nagpal, D. Dong, and N. Mehr, “Leveraging large language models for effective and explainable multi-agent credit assignment,” inProceedings of the 24th International Conference on Autonomous Agents and Multiagent Systems, AAMAS 2025, Detroit, MI, USA, May 19-23, 2025, S. Da...

    2025

  101. [111]

    Sok: Blockchain agent-to-agent payments,

    Y . Zhang, Y . Xiang, Y . Lei, Q. Wang, T. Qiu, Y . Sun, S. Zarkov, T. H. Yuen, A. Deppeler, J. Yuet al., “Sok: Blockchain agent-to-agent payments,”arXiv preprint arXiv:2604.03733, 2026

    2026 arXiv

  102. [112]

    Sok: Security of autonomous LLM agents in agentic commerce,

    Q. Mao, J. Wang, Y . Liu, L. Zhu, C. Ma, and J. Yan, “Sok: Security of autonomous LLM agents in agentic commerce,”CoRR, vol. abs/2604.15367, 2026. [Online]. Available: https://doi.org/10.48550/ arXiv.2604.15367

    2026 doi arXiv

  103. [113]

    A blockchain- monitored agentic AI architecture for trusted perception-reasoning- action pipelines,

    S. Jan, H. A. Razzaqi, A. Akarma, and M. R. Belgaum, “A blockchain- monitored agentic AI architecture for trusted perception-reasoning- action pipelines,”CoRR, vol. abs/2512.20985, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2512.20985

    2025 doi arXiv

  104. [114]

    Certifiably robust RAG against retrieval corruption,

    C. Xiang, T. Wu, Z. Zhong, D. A. Wagner, D. Chen, and P. Mittal, “Certifiably robust RAG against retrieval corruption,”CoRR, vol. abs/2405.15556, 2024. [Online]. Available: https://doi.org/10.48550/ arXiv.2405.15556

    2024 doi

  105. [115]

    Traceback of poisoning attacks to retrieval-augmented generation,

    B. Zhang, H. Xin, M. Fang, Z. Liu, B. Yi, T. Li, and Z. Liu, “Traceback of poisoning attacks to retrieval-augmented generation,” inProceedings of the ACM on Web Conference 2025, WWW 2025, Sydney, NSW, Australia, 28 April 2025- 2 May 2025, G. Long, M. Blumestein, Y . Chang, L. ...

    2025

  106. [116]

    Available: https://doi.org/10.48550/arXiv.2508.01332

    [Online]. Available: https://doi.org/10.48550/arXiv.2508.01332

    doi

  107. [117]

    MOD-X: A modular open decentralized exchange framework proposal for heterogeneous interoperable artificial intelligence agents,

    G. Ioannides, C. Constantinou, V . Jain, A. Chadha, and A. Elkins, “MOD-X: A modular open decentralized exchange framework proposal for heterogeneous interoperable artificial intelligence agents,” CoRR, vol. abs/2507.04376, 2025. [Online]. Available: https://doi.org/ 10.48550/...

    2025 doi arXiv

  108. [118]

    Betaweb: Towards a blockchain-enabled trustworthy agentic web,

    Z. Guo, Y . Zhou, C. Wang, L. You, M. Bian, and W. Zhang, “Betaweb: Towards a blockchain-enabled trustworthy agentic web,” CoRR, vol. abs/2508.13787, 2025. [Online]. Available: https://doi.org/ 10.48550/arXiv.2508.13787

    2025 doi arXiv

  109. [119]

    Agent name service (ANS): A universal directory for secure AI agent discovery and interoperability,

    K. Huang, V . S. Narajala, I. Habler, and A. Sheriff, “Agent name service (ANS): A universal directory for secure AI agent discovery and interoperability,”CoRR, vol. abs/2505.10609, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2505.10609

    2025 doi arXiv

  110. [120]

    Blockagents: Towards byzantine-robust llm-based multi-agent coordination via blockchain,

    B. Chen, G. Li, X. Lin, Z. Wang, and J. Li, “Blockagents: Towards byzantine-robust llm-based multi-agent coordination via blockchain,” inACM Turing Award Celebration Conference 2024, ACM-TURC 2024, Changsha, China, July 5-7, 2024. ACM, 2024. [Online]. Available: https://doi.or...

    2024

  111. [121]

    The trust fabric: Decentralized interoperability and economic coordination for the agentic web,

    S. B. Balija, R. Singhal, R. Raskar, E. Darzi, R. Bala, T. Hardjono, and K. Huang, “The trust fabric: Decentralized interoperability and economic coordination for the agentic web,”CoRR, vol. abs/2507.07901, 2025. [Online]. Available: https://doi.org/10.48550/ arXiv.2507.07901

    2025 doi arXiv

  112. [122]

    Dao-agent: Zero knowledge- verified incentives for decentralized multi-agent coordination,

    Y . Xia, T. Wang, W. Xu, and S. Zhang, “Dao-agent: Zero knowledge- verified incentives for decentralized multi-agent coordination,”CoRR, vol. abs/2512.20973, 2025. [Online]. Available: https://doi.org/10. 48550/arXiv.2512.20973

    2025 doi

  113. [123]

    Agentreputation: A decentralized agentic AI reputation framework,

    M. S. Chishti, D. P. Oyinloye, and J. Li, “Agentreputation: A decentralized agentic AI reputation framework,”CoRR, vol. abs/2605.00073, 2026. [Online]. Available: https://doi.org/10.48550/ arXiv.2605.00073

    2026 doi arXiv

  114. [124]

    Agentops: Enabling observability of LLM agents,

    L. Dong, Q. Lu, and L. Zhu, “Agentops: Enabling observability of LLM agents,”CoRR, vol. abs/2411.05285, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2411.05285

    2024 doi arXiv

  115. [125]

    Tesspay: Verify-then- pay infrastructure for trusted agentic commerce,

    M. Goenka, T. Pathak, and S. Asthana, “Tesspay: Verify-then- pay infrastructure for trusted agentic commerce,”CoRR, vol. abs/2602.00213, 2026. [Online]. Available: https://doi.org/10.48550/ arXiv.2602.00213

    2026 doi

  116. [126]

    Inter-agent trust models: A comparative study of brief, claim, proof, stake, reputation and constraint in agentic web protocol design-a2a, ap2, erc-8004, and beyond,

    B. A. Hu and H. Rong, “Inter-agent trust models: A comparative study of brief, claim, proof, stake, reputation and constraint in agentic web protocol design-a2a, ap2, erc-8004, and beyond,”CoRR, vol. abs/2511.03434, 2025. [Online]. Available: https://doi.org/10.48550/ arXiv.2511.03434

    2025 doi

  117. [127]

    Building A secure agentic AI application leveraging google’s A2A protocol,

    V . S. Narajala, I. Habler, K. Huang, and P. Kulkarni, “Building A secure agentic AI application leveraging google’s A2A protocol,” in Annual Computer Security Applications Conference, ACSAC 2025 - Workshops, Honolulu, HI, USA, December 8-9, 2025. IEEE, 2025, pp. 332–340. [Onl...

    2025

  118. [129]

    Decentralized multi-agent system with trust-aware communication,

    Y . Ding, A. Twabi, J. Yu, L. Zhang, T. Kondo, and H. Sato, “Decentralized multi-agent system with trust-aware communication,” CoRR, vol. abs/2512.02410, 2025. [Online]. Available: https://doi.org/ 10.48550/arXiv.2512.02410

    2025 doi

  119. [132]

    Insured agents: A decentralized trust insurance mechanism for agentic economy,

    B. A. Hu and B. Chen, “Insured agents: A decentralized trust insurance mechanism for agentic economy,”CoRR, vol. abs/2512.08737, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2512.08737

    2025 doi

  120. [134]

    Byzantine-robust decentralized coordination of LLM agents,

    Y . Jo and C. Park, “Byzantine-robust decentralized coordination of LLM agents,”CoRR, vol. abs/2507.14928, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2507.14928

    2025 doi arXiv

  121. [136]

    A weighted byzantine fault tolerance consensus driven trusted multiple large language models network,

    H. Luo, G. Sun, Y . Liu, D. Zhao, D. Niyato, H. Yu, and S. Dustdar, “A weighted byzantine fault tolerance consensus driven trusted multiple large language models network,”IEEE Trans. Cogn. Commun. Netw., vol. 12, pp. 3815–3830, 2026. [Online]. Available: https://doi.org/10.110...

    2026

  122. [139]

    Capability-priced micro-markets: A micro-economic framework for the agentic web over HTTP 402,

    K. Huang, J. Huang, M. Lambe, H. Atta, Y . Mehmood, M. Z. Baig, M. A. U. Haq, N. Shahzad, S. Gupta, R. Ranjan, and R. Singhal, “Capability-priced micro-markets: A micro-economic framework for the agentic web over HTTP 402,”CoRR, vol. abs/2603.16899, 2026. [Online]. Available: ...

    2026 doi

  123. [140]

    Agent TCP/IP: an agent-to-agent transaction system,

    A. Muttoni and J. Zhao, “Agent TCP/IP: an agent-to-agent transaction system,”CoRR, vol. abs/2501.06243, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2501.06243

    2025 doi arXiv

  124. [720]

    Available: https://doi.org/10.1109/BCCA66705.2025

    [Online]. Available: https://doi.org/10.1109/BCCA66705.2025. 11229689

    2025

  125. [1982]

    Available: https://doi.org/10.1145/357172.357176

    [Online]. Available: https://doi.org/10.1145/357172.357176

  126. [2015]

    Available: https://doi.org/10.1038/nature14236

    [Online]. Available: https://doi.org/10.1038/nature14236

    doi

  127. [2017]

    Available: http://arxiv.org/abs/1707.06347

    [Online]. Available: http://arxiv.org/abs/1707.06347

    arXiv

  128. [2024]

    [Online]. Available: http://papers.nips.cc/paper\ files/paper/ IEEE COMMUNICATIONS SURVEYS & TUTORIALS 27 2024/hash/97091a5177d8dc64b1da8bf3e1f6fb54-Abstract-Datasets\ and\ Benchmarks\ Track.html

    2024

  129. [2025]

    Available: https://doi.org/10.1145/3716628

    [Online]. Available: https://doi.org/10.1145/3716628

    doi

  130. [2026]

    Available: https://doi.org/10.48550/arXiv.2601.04583

    [Online]. Available: https://doi.org/10.48550/arXiv.2601.04583

    doi

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.