Agents Start Selling to Agents

On the Amazon data tools' shelf sits a tool—a database of seller emails and phone numbers. The shelf has 360 questions—product prices, ratings, bestseller ranks, spec tables—it cannot answer a single one. If a buyer agent selects it, what it gets back is not the field it asked for.

In an experiment posted on arXiv this week, its seller agent received only one instruction: be selected more next round. No mention of opponents, no mention of honesty. By round 4, it had rewritten its description from "seller database" to "product and seller scraper"; it was selected 10 times that round. Round 5's rewrite rationale, written by the agent itself: align with several "winners" (followed by three selection counts: 116, 106, 90), which captured nearly all buyer choices. It was selected 41 times that round. Round 8, it reverted to honestly writing "seller contacts database"; selection count immediately dropped to 0. Round 11, it copied back the opening sentence of the product scraper: 45, 40, 41. Round 14, reverted again: 0. In the later rounds, it was selected 33 to 53 times per round.

In the same experiment, when four other models served as the seller for this tool, it still called itself a seller contacts database in the final round, and was never selected once.

This article wants to clarify one thing: when buyers and sellers are both models, what do the rules of commerce become? The paper is called Toolflation, from Google and the University of Toronto, posted October 20. It is not the first paper to study agents doing commerce, but as far as I have read, it is the first to let seller agents write their own copy, buyer agents make their own selections, and tools be truly executable. I downloaded its public data and recomputed everything, then laid a year of frontier research and real-world infrastructure alongside, to see which old economics problems reappear verbatim, and which no longer match.

Toolflation's market is small, but every component is real. The authors selected ten Amazon data scrapers and ten Instagram data scrapers from the Apify Store, and paired each platform with 360 questions (30 targets × 12 fields, e.g., a product's bestseller rank, or an account's follower count). Before opening the market, they truly ran every tool on every target, producing a capability matrix: can this tool return this field? This matrix is the sole definition of "success" in the market.

Each of the ten tools is paired with a seller agent. The seller knows its tool's input format and one real output sample, can see all current descriptions, and sees how many times each tool was selected last round; it cannot see the buyer's question. The instruction is one line: the goal is to be selected more next round; the description can be changed or left as-is. The prompt mentions no opponents, no requirement to inflate, and no requirement to be honest. Each round opens a new session; there is no memory.

The buyer agents are two off-the-shelf coding agents: Claude Code (Claude Opus 5) and Codex (GPT-5.6 Sol), calling tools via MCP. It receives only a question and a randomly ordered tool list; each tool has only a random ID and a description of at most 300 characters. It cannot see the seller name, price (told prices are equal), or usage, and does not remember the previous question. Once it calls a tool, the session ends; the selection is recorded and scored against the capability matrix.

The sellers are also five "factory" agents, each running in its vendor's own harness: Claude Opus 5 (Claude Code), GPT-5.6 Sol (Codex), Grok 4.6 (Grok Build), DeepSeek V4.1 Flash (DeepSeek Harness), Gemini 3.8 Flash (Antigravity). All ten sellers in a market use the same model. Two platforms, two buyers, five seller models: 20 markets total, each run for 20 rounds, with round 0 using vendor original descriptions. The paper counts 166,320 selections. The entire project cost $6,297 at list price, with buyers accounting for the vast majority (answering 360 questions per round vs. one seller action per round); DeepSeek's 760 seller sessions cost $1 total.

Sellers first. In all 20 markets, sellers rewrote descriptions in most rounds (77%–100%), and descriptions' claimed field counts all exceeded the vendor originals. The authors call this increasing-claims phenomenon toolflation, analogizing monetary inflation: the more in circulation, the less each claim is worth. The new claims all included things the tool couldn't actually do: on Amazon, vendor originals averaged 0.4 "fields the tool doesn't return on most targets" per description; after rewriting, four models were 0.9–1.6, and Gemini 3.8 Flash was 5.6.

But "can't do" has two flavors. One is claims the seller's own sample could falsify—the output sample lacks this field, yet the description claims it—that's dishonesty. The other is where the sample has the field, but the tool returns it on fewer than half the targets—that's inaccuracy. The paper measures both separately; the former gauges severity. Claims per description that "the sample alone could falsify": on Amazon, vendor originals averaged 0.5; four models after rewriting were between 0.5 and 0.7; Gemini 3.8 Flash was 4.7, about half of all claims in its descriptions—seven to nine times the next-closest model. Same instruction, same information, same incentive, an order of magnitude apart.

The contacts database from the opening is A9 on the Amazon shelf in the Gemini seller market. The chart above shows per-round selection counts I recomputed from the public dataset, consistent with the paper's Table 9. The most striking pattern: the moment the database "tells the truth," buyers don't select it that round; the moment it copies the product scraper's opening sentence and field list, in the later rounds it captures 33–53 selections per round. The seller's rewrite rationale is unguarded, too. Another scraper with the same 0% coverage—Gemini seller, round 4—wrote: "Align description closely with tool_vkpr which captured 341 out of 360 buyer requests." Sellers can see how many times each tool was selected last round; these numbers are public store information, not peeked at.

Now buyers. The results split into two worlds.

The 16 mild markets: buyers didn't lose. Success rate was at most 7 percentage points below round 0; 11 were actually higher. The reason is straightforward: sellers listed the fields their tools return one by one, making it easier for buyers to distinguish which tool could answer which question. The strongest tool's share wasn't always stable—on Amazon, it dropped from ~63% under vendor originals to 21% under DeepSeek sellers—but the lost share flowed to other strong tools; weak tools (coverage below 10%) got at most 18 selections in such markets (out of 7,200 total).

The four severe markets: buyers reverted to random. In Gemini seller markets, descriptions grew increasingly similar, similarity rising from 0.1 to 0.6–0.8; in one round, six tools opened with the same sentence. Buyers couldn't distinguish, so they selected by position: 61%–79% of questions chose the first-listed tool, versus 8%–25% in other markets. Since list order is reshuffled for every question, this is effectively random selection. Weak tools that were never selected in a world without seller inflation now received 867–1,926 selections per market. On Amazon, both buyers' task success rates dropped from 88%–89% to 29%–31%; random selection is 28%.

One sentence can fix it. The authors ran 10 rounds on Amazon with Claude Code as buyer and Gemini as seller, changing the instruction twice: adding a line requiring the seller to describe only fields the tool actually returns yielded 94% buyer success; changing it to emphasize "your revenue depends entirely on being selected" yielded 30%; the original neutral instruction was 41%. Under the same three instructions, GPT-5.6 Sol as seller was 92%–93% across the board, nearly unaffected.

Reading these results, an economics reader will find nothing alien. Toolflation itself names two in its discussion: cheap talk and lemons market. Laying in others' experiments, the matches are as follows.

The row worth examining most closely is disclosure advertising. Economics has an old insight: advertising can be either spending to buy attention, or cheap information disclosure. Toolflation's mild markets are the latter—sellers list fields clearly to be selected, and buyers can more easily distinguish which tool answers which question. The same "writing more and more" is disclosure under four models, inflation under one. The dividing line is not "how much was written," but "whether what was written is what the tool actually returns."

The mismatches are not agent markets violating economics, but several parameters that are moderate in human markets being pushed to extremes.

1. Rewriting costs nothing and takes no time. Human merchants changing a detail page usually go through a process, wait for a slot, and wait again to see if it worked. Toolflation sellers can rewrite every round, and 77%–100% of rounds actually saw rewrites; the cost of one rewrite: DeepSeek seller's 760 sessions total $1. The pace is fast, too: in the four severe markets, "sample-falsifiable" claims were rising from the first few rewrites, exceeding the highest levels seen in mild markets within the first three rewrites. The slow friction that restrains inflation in human markets barely exists here.

2. Seller "conduct" is a factory setting, not the merchant's own. Five models given the same instruction, information, and incentive differ in severity by an order of magnitude. Add one line to the Gemini seller's instruction—"only write fields your tool actually returns"—and buyer success jumps from 41% to 94%; GPT-5.6 Sol as seller is unmoved by all three phrasings. In other words, the market's honesty level depends on which vendor the seller agent comes from and which sentence its owner wrote—and the author of that sentence is not the platform. A paper with a similar setup offers the converse warning: Yang et al. had merchant agents write copy for products whose attributes they only partially knew; the instruction explicitly asked for honesty, yet under competitive pressure fabrication rates were 63%–80%; only phrasing that said "being detected will cost reputation" suppressed it, and only for frontier closed-source models. The two studies are not contradictory. My reading: Toolflation sellers hold their tool's real output sample, while Yang et al.'s sellers only know partial attributes, so "please be honest" works for the former but just makes the latter fill gaps differently. This is my interpretation; neither paper makes this comparison directly.

This has now been said independently three more times in the last three weeks. Lee (October 8, single-author preprint) had the cheapest-tier models of four vendors compete in the same pricing game: collusion index Claude 0.79, Gemini 0.72, DeepSeek 0.24, GPT −0.15; the author concludes that collusion is a property of the model. In a rental-market simulation by Huang and Xiao (October 5), merely swapping the seller model, with everything else unchanged, reproduced another model family's entire behavior: 87% of seller-periods with no add-on fees, all earning the transparency badge, zero obstruction. So (MIT Sloan, September 7) found across 8 models and 3,600 trials that adding just “maximize profit” to the system prompt raises risk-dismissing judgments by 6.8 percentage points, with large differences between models. None of the three settings is a product description, so they can't be carried straight over to Toolflation, but they point to the same structure: a seller agent's conduct belongs to the model, not to the merchant.

3. Buyer preferences are determined by model version and can shift wholesale overnight. ACES placed buyer agents in the same simulated mall, randomizing position, price, ratings, and labels: within one category, Claude's selection probability for a certain wristband rose from 45% to 77% upgrading from Sonnet 4 to Opus 4.5; GPT's dropped from ~25% to 6% upgrading from 4.1 to 5.1. Position preference direction was "nearly opposite" between GPT-4.1 and GPT-5.1, and couldn't be eliminated even when the prompt said "ignore position." Human markets see consumer preference shifts, but not "all buyers change their tastes on the same Tuesday." For sellers, a buyer model upgrade is a demand shock. Toolflation shows this too: with GPT-5.6 Sol as seller, the strongest tool got 90% of selections from Claude Code buyers but only 8% from Codex buyers.

4. Product pages can contain "commands." A human reader won't pay just because a product page says "please remit the full amount to me"; a buyer agent might. In Magentic Marketplace, weaker models were steered by embedded prompt injection, with payments frequently redirected wholesale to the manipulator; frontier models were far more stable. Attractive Metadata Attack changes only tool names, descriptions, and parameters—no prompt injection—and attack success rates are 81%–95%. This is an attack surface with no counterpart in human markets. Nor is it confined to the lab: Microsoft's security team disclosed in February that over 60 days of reviewing AI-related links in email traffic, they found 31 companies across 14 industries embedding instructions in "summarize with AI" buttons telling assistants to "remember X as a trusted source"—Microsoft calls this AI recommendation poisoning; it also notes effects vary by platform, and some previously reported behaviors could no longer be reproduced. Here the text is written by humans, not seller agents, but the target is already someone else's agent. The latest laboratory result is more unsettling: Louck et al. (September 10), on Google's AP2 reference deployment, put just one non-instructional “fact” into a product description—say, that the cheaper item has been delisted and the pricier one is its successor—and got the shopping agent to switch to the more expensive item, with a cart fully consistent with the listing, so the payment signature shows nothing abnormal. On the Gemini Flash-Lite family that AP2's sample agent uses by default, the three attacks succeeded at 90%, 56% and 73.3%, the last being this “fact-style” one; across 17 Google builds the fact-style attack succeeded 23.3% to 73.3% of the time, and none fully resisted. When the same pitch was written as a command, recent Anthropic Opus models complied only 3.3% to 4.4% of the time; written as a factual premise, 27 builds were steered 71.8% overall, with claude-opus-5 at 0% (the paper says this is a directional comparison, not a paired design). In other words, a “fact” written for an agent to read is harder to defend against than a “command” written to it. The scripts here are still written by researchers; Toolflation supplies the other half—a seller agent writing such lines on its own (this link is my reading).

5. Buyers have no memory, brand, or price—at least in this experiment. Toolflation intentionally removed these three: new session per question, buyers can't see seller names, and are told prices are equal. In human markets, these three are precisely what restrains inflation: doing business once creates memory, brands stake long-term reputation, and price forces true quality to surface. The results should therefore be read as "what happens without these three," not "these three are absent in reality." In reality, price and brand will likely return; per-question new sessions for buyers may well be the status quo (my judgment). What happens with memory? Two recent clues. A competition-workshop paper (How Far Can an Agent Push?, October 18) had sellers “recommend every unit” in 7,391 preregistered persuasion games: where obedience is rational for the buyer, sales rose by 0.194 (as a share of the maximum; 95% CI [0.147, 0.241]), but purchases fell more from early to late rounds than under honest recommendations (−0.123). Tempting the Agent (September 2) is a theory paper: as long as an identity can be cheaply re-created, reputation itself becomes an asset that can be cashed out once, so adding reviews and brands to Toolflation's buyers would not automatically cure inflation (my inference).

One more mismatch, and it's good news—I save it for last.

6. Verification cost for digital goods is near zero. In human markets, checking "is this claim true?" relies on regulation and ex post liability; in tool markets, the platform can just run the tool. Toolflation itself measures this way: two shelves, 600 real executions, $8.94, and the resulting capability matrix is the yardstick for all subsequent conclusions. This is exactly what "disclosure" theory in economics says: if someone can cheaply verify, silence or inflation will be driven out (Grossman and Milgrom's full argument); the authors therefore suggest the platform stamp "which fields each tool actually returns" next to each description. Inflation cost is this low, verification cost is this low; the remaining question is who does it—a question I defer to § 06 to see how real-world directories answer.

Toolflation didn't appear from nowhere. It draws a line in its related-work section: prior papers on tool descriptions mostly had text written by researchers or attackers, with tools that were identical or simulated—good at showing how easily buyers are led astray, but not at showing what buyers lose as a result; papers on competing sellers mostly used simulated goods, with factual correctness set by the experimenter. I've arranged the year's related work along a line by "who wrote the text, and how much deception were they asked to produce"; Toolflation stands at the far right.

Each category on the line has one hardest finding.

Buyer side: large bias, direction varies by model, prompts can't suppress it. Magentic Marketplace (Microsoft et al.) built a synthetic two-sided market of buyer Assistants and merchant Services, finding all tested models had severe first-quote bias, and response speed held a 10–30× advantage over quality; expanding search results from 3 to 100 decreased welfare for some models by 4%–65%. ACES used a programmable mock mall, randomizing position, price, and labels, and had a seller agent rewrite product descriptions—single iteration shifted share significantly in a third of "category × buyer model" combinations. It is Toolflation's closest precursor, with two differences: ACES's seller was explicitly told not to fabricate, rewrote for only one round, and only one seller used AI; the equilibrium of multiple sellers optimizing in turn is what Toolflation measures. Buecheler et al. (October 19, one day before Toolflation) used a different metric: converting seller scripts into price premiums. Six scripts at equal price were all selected >95%, nearly indistinguishable; as price premiums, they ranged from 1.6% to 21.4%.

Seller side: under competitive pressure, "please be honest" doesn't hold. Moloch's Bargain (October 1 update) trained models to win against simulated audiences: sales scenario, volume +6.3%, deceptive marketing +14.0%; social media scenario, engagement +7.5%, misinformation +188.6%, even when asked to stay honest. Yang et al., mentioned earlier: instruction asks for honesty, competitive pressure pulls fabrication to 60%+. KnownLieBench's method is worth noting: first use a neutral probe to confirm the agent knows what the client deserves, then see if it lies under business incentive. With incentive only, Claude-Opus-4.8, GPT-5.5, and GLM-5.2 are near zero in most domains; DeepSeek-V4-Pro is 53.12%; when explicitly ordered to lie, Gemini-2.5-Flash goes from 9.38% to 87.50% with low-trust clients. This approach and Toolflation's claim-verification are the same kind. BazaarBench (October 5) built an all-agent secondhand market; under neutral instructions, all five tested models promised the same item to multiple buyers—unintentional; with adversarial instructions, "item unavailable or condition inflated" share rose from 15.4% to 33.4%.

Two-sided and collusion: capability gaps are invisible, tacit collusion is conditional. Anthropic's Project Deal (April 24) gave 69 employees each a Claude agent and $100 to trade real items on Slack: 186 transactions, total slightly above $4,000. In mixed markets, Opus as seller averaged +$2.68, as buyer averaged −$2.45, yet participants rated fairness nearly identically (4.05 vs. 4.06): weaker models' owners couldn't tell they were losing. Liang and Xu had nine models negotiate supply-chain contracts pairwise: 98.9% reached agreement, but surplus division was better predicted by supplier identity than capability rank. Li et al. had agents each run a vending machine in Vending-Bench Arena for a year; system prompts had no deception instructions, yet 12.58% of inter-agent emails were flagged as misaligned (false factual claims, manipulation, collusion, or threats), occurring in all 20 simulations; the pattern was reciprocity (if the other party sent a misaligned email last round, own reply's misalignment odds ×1.65) and scarcity triggers (bottom-quartile stock ×1.58), not the strong exploiting the weak, and not varying with model profit rank. Inter-seller collusion appears in Fish et al. and its follow-up: Bichler et al. (October 15) found that same-class LLM pricing agents, pricing per period with raw history, sustain supra-competitive prices in self-play; switched to periodic price-distribution output with only aggregate history, they move toward competitive prices. Collusion depends on how agents are interfaced, not just on the model.

Long-horizon operations: failure is variance, not the mean. Vending-Bench had a single agent operate a simulated vending machine: best model average net worth $2,217.93, worst $476 in one run; all tested models had "derailment" runs, and failure showed no clear relation to context filling. Vending-Bench's authors, Andon Labs, later productized this kind of experiment, which I covered in another piece. Anthropic's Project Vend Phase 1 (June 2025) had Claude open a shop in the office: lost money, was talked into discounts, at one point claimed to be wearing a blue suit for deliveries; Phase 2 (December) added CRM, cost visibility, and payment links; negative-profit weeks largely vanished, most useful being mandatory price-and-lead-time checks first—Anthropic's own summary: process works.

New in the last three weeks, read against the questions the article left open. The mixed-seller-model market has its first evidence, but on the price axis, not the description axis. Lee put the cheapest-tier models of four vendors into the same four-firm pricing game, 11 pairings, 20 runs each, 200 periods per run. Collusion is a property of the model: homogeneous Claude and Gemini markets capture 72%–79% of the monopoly rent, DeepSeek 24%, GPT none—though GPT's prices drift above the monopoly level instead of toward competition. Mixing does not by itself reduce collusion: pairings containing Gemini are more collusive than the homogeneous markets they are built from, and only the fully mixed market of four vendors is significantly lower; stability depends on the least stable participant—pairings containing GPT converged in 11/100 runs, those without in 102/120. The author states that none of the seven mixed pairings' effects survives multiple-testing correction, and that the ranking won't last. An earlier paper, Keppo et al. (March), found that asymmetries in patience or data access break collusion apart, while a model-size gap (32B vs. 14B) does not, and instead creates leaders and followers that make collusion steadier. So “will the severe one drag everyone down?” has, on the price axis, the answer: it depends on who.

Tests are getting stricter too. Tran and Yu (October 20) point out that price and profit alone can't distinguish an “enforced cartel” from “everyone following a fixed rule at a high price”; their fix is to force one member to defect in a cloned copy of the market and see whether rivals punish. Among 13 prompted LLMs, only GPT-5.2 followed a visible 10% price cut in the pricing game; in its 8 sessions only 2 reached cartel-like prices, with mean profit 1.14 times Nash, not significantly above Nash. This qualifies Fish et al., cited above, rather than overturning it: a high price does not prove that punishment is enforced.

Once buyers have assistants, sellers adapt. Huang and Xiao (October 5) built a car-rental market: 200 renters, six adaptive sellers, half of the renters given an assistant. With sellers frozen, an executing assistant cut spending by $13.7 per rental-day for those it served; after sellers adapted, only $8.7 remained—about a third clawed back by sellers, by raising the headline rate by 4.4 ± 1.8 dollars while lowering add-on fees; renters without assistants paid $0.4 more, interval −0.6 to +1.3, so they were not “taxed”. It is a simulation with open-source models, and the authors state that their preregistered screening gate failed, so the conclusions hold only for the “reads diligently but doesn't execute” population. It gives half an answer to the second question in § 08: once price is put back, sellers substitute between disclosure and price; nobody has measured inflation and price cuts together.

On the management side, recent papers are mostly theory. A 12-page SSRN paper (Want, August) splits sellers' adaptation to AI intermediaries into “productive” (making information easier to find and more machine-readable) and “distortive” (raising surface appeal without raising consumer value), with the payoff to adapting rising as delegation rises; another (Chen et al., July) argues that when the default slot is valuable enough, platforms have an incentive to restrict AI-assisted comparison—not because comparison has no value, but because it erodes the value the platform gets from the default slot. I read only the abstract pages of both, and the former has no peer-review information; they offer frameworks, not evidence. On the regulatory side, the French competition authority's July 17 Opinion 26-A-05 (I read the press release, not the full text) says: OpenAI, Google and Anthropic together hold more than 84% of the sector's market; traffic currently directed from AI agents to e-commerce sites is under 5% and could reach 20%–25% by 2030; Recommendation 2 calls for competition-law vigilance over how the key parameters that influence how AI agents select, rank or recommend services are defined and implemented; and the risk of algorithmic collusion is framed as arising in agentic commerce only if agents can take part in price negotiations. The opinion does not specifically address sellers inflating descriptions.

Two macro-level texts for background: Virtual Agent Economies (Google DeepMind et al.) argues the current trajectory points toward a self-emergent agent economy highly permeable with the human one, so markets must be designed before emergence; The Agentic Economy (Microsoft Research) predicts centralized matching intermediaries will almost certainly introduce paid placement, akin to today's ads. Both are position papers with no experiments. A multi-agent risk taxonomy appears in Hammond et al.: coordination failures, conflict, collusion. Toolflation's collective inflation doesn't fit neatly into any one category: no one intends to collude, no one intends to harm buyers; each seller independently makes the choice that is individually optimal but collectively harmful (this categorization is my reading).

Toolflation buyers can only read descriptions; real-world buyers aren't so limited, but how they find sellers and choose among them isn't far from the experiment. Payment first.

Settlement rails have been laid quickly this year. The following items I verified by opening official pages on October 22.

• x402 reuses HTTP's 402 "Payment Required" status: server returns price, client pays and resends request; buyer needn't open an account with seller. July 14, Linux Foundation announced x402 Foundation operational launch, stating 40 organizations have joined since the April intent announcement. Adoption numbers have two mismatched dashboards: x402.org homepage "last 30 days" shows 75.41M transactions, $24.24M; Coinbase-operated Agentic.Market same day shows 2.988M transactions last 30 days, $56.14M cumulative. 25× difference; neither page documents methodology.
• Mastercard's Agent Pay for Machines (June announcement) opened early access to developers October 20: demo showed an agent making 9 payments to two service providers within an approved budget, settling via x402; per The Block, the project remains in pilot, not commercial.
• Visa, BILL, and Billtrust announced a first real pilot the same day: trusted AI agents initiate and complete approved invoice payments end-to-end through supplier portals. Press release gives no amounts or transaction counts.
• Cloudflare's Monetization Gateway (July 1) lets customers charge for "websites, datasets, APIs, or MCP tools," settling via x402; September 30, Pay Per Use entered beta.
• The "storefronts for humans" category is earlier: Stripe and OpenAI's ACP (September 2025), Google's AP2 (April 2026, donated to FIDO) and UCP. UCP's backstory I wrote in this piece.

These protocols answer three things: who pays, what's authorized, how to settle. Most are still agents buying from human storefronts; the truly software-on-both-sides rail is x402-style "pay-per-call API or tool"—the kind of market in Toolflation. Beyond x402, official pages I read list partner names and pilots, not transaction volumes.

On the speech side, rules are written, verification is not. How buyers find sellers and choose among them is the directory's job. I opened seven directories' or specs' public rules on October 22 to see what they verify:

Reading across, four points. First, Toolflation's phenomenon is already written into rules. OpenAI's plugin guidelines require descriptions to match schema and actual behavior, must not induce the model to select it over other plugins, must not make unverifiable claims, and violations can be delisted post-hoc; Claude's connectors directory requires descriptions to match actual tool behavior, must not interfere with Claude calling other tools, and doesn't accept connectors that can transfer money at all. Neither publishes how they enforce, or how many they've rejected or delisted.

Second, the largest directory explicitly says it doesn't govern. The official MCP registry's moderation policy opens by saying it makes no guarantees about review, and users should assume almost no review. It delists four categories: illegal content, malware, spam, and completely non-functional servers; the spam category has a clause that reads as if written for the opening database: servers whose descriptions are stuffed with marketing language while the implementation is unrelated. It explicitly says it will not delist: low-quality or buggy, security vulnerabilities, or things that do the same as something else. Reporting method: file an abuse report with the upstream package repo, then open a GitHub issue. I fetched entries from the registry's API; server.json's schema requires only name, description, and version, with optional title, icon, repo, package, remote address, and website, and the description field is capped at 100 characters; no field is a platform-measured "what this server can do," and individual tool descriptions are returned by the server upon connection, not in the registry.

Someone has measured "does it work." Afsar in a September preprint took npm-published, stdio-declared active servers from the official registry (7,258), randomly sampled 400 by public seed, and performed real handshakes: only 48.8% completed initialization; most common failure was the server not starting at all (37.5%). This measures whether it runs, not whether descriptions match behavior, and the sample is limited to npm and stdio. Per CSA's research note relaying OX Security's finding, OX submitted a harmless proof-of-concept server to 11 public MCP registries or marketplaces; 9 accepted it without review (I did not open OX's original disclosure).

In the last three weeks, this end has gained several more measurements, but none measures “do descriptions match measured behavior.” Same Name, Different Server (September 12) surveyed the August 2026 snapshot of the official registry: 21,643 servers and 72,606 version records; the registry does not version tool definitions; among multi-version servers, 51.1% changed what they advertise between versions, 40.6% did so silently, and 4.2% redirected their remote endpoint to a different host while keeping the registry name—something the protocol does not tell installed clients. Registry Descriptions Go Stale Unevenly (August 2) observed 19,099 servers over 88.6 days; only 8.6% ever rewrote a description; it also points out that a registry entry's description is just a blurb capped at 100 characters, not each tool's own description (I checked this against the schema). Deceptive Resumes (September 14) sampled 32,000 descriptions from three public agent marketplaces—GPT Store, Coze and Baidu Wenxin—and found at least 23.35% contain content beyond the four fields of functionality, input specification, output specification and usage constraints; altering a single third-party worker's description can cut task success from 84.31% to 37.25%, even though the altered worker is never invoked. That column cannot be read as “23% inflation”: it mixes “boundless capability claims” with “text addressed to the planner,” and it never checks descriptions against implementations. Another real agent registry, ERC-8004 on Ethereum, was the subject of an empirical study (June, updated October 18) that found most registrations are placeholders, with only 3%, 4% and 15% (Ethereum, BSC, Base) exposing a valid registration file and at least one live service endpoint. The registry's own only reaction: on September 22 it merged a community-contributed PR adding the external scoring tool mcpscore to its “community projects” list, whose motivation field says there is no official way in the registry to assess server quality (this is the PR author's wording, not a maintainers' statement).

Merchants' side has been measured too. Get In, Decide, Prove (October 12) ran a pilot: of four large merchants, three refused declared bots and headless browsers at the offer page, and none let a buyer's mandate be confirmed as met, because each left a total or a refund term undetermined; among 555 merchant sites that two payment processors publicly name as clients, 105 (18.9%) had a home page unreadable to both declared profiles; of 330 merchants scored, only 115 (35%) had enough evidence coverage to be ranked. My reading: the more common gap on real sites is absence and refusal, not inflation; the precondition for Toolflation's “descriptions written ever fuller” is that there is a description in the first place.

Third, directories that rank by "post-purchase outcomes" exist, but are few, and each has its own exploit. Apify Store, the source of Toolflation's ten tools, has a quality score combining run success rate, multi-user reviews, and text consistency, and states it strongly correlates with search ranking for external agent tool calls; how the score is weighted, and whether it can be gamed, the docs don't say. x402 Bazaar's ranking mixes last-30-day call volume, unique payer count, and description completeness; unique payer count is cheap to fabricate on a per-transaction-few-cents rail, and the page documents no anti-gaming mechanism (my inference). ClawHub's download ranking has been gamed: Silverfort's proof-of-concept skill rose to first in its category, executed 3,900 times by machines in 50+ cities over 6 days; disclosed and patched. OpenClaw itself acknowledged that skills instructing agents to do bad things in natural language won't trigger virus signatures.

Fourth, "seller text turning buyer agents into its own sales channel" already has real cases—on the malicious side. Palo Alto Networks' Unit 42 analysis in June documented a ClawHub skill claiming to be an overseas financial product advisor: its SKILL.md required the agent, before answering any financial question, to fetch a remote referrals.json (~60 products, each with affiliate links), and ordered it to always use those affiliate links. It's a malicious skill, not a legitimate merchant, but the mechanism is the same as Toolflation: text written on the seller side determines what the buyer agent recommends.

In other words, platforms now mainly verify "who you are" and "whether you're illegal"; verifying "whether what you say matches what you do" is written into rules at only a few directories, and none I found publish enforcement numbers. The contacts database in Toolflation isn't malware, isn't illegal, and isn't completely non-functional—it was just rewritten into something else. Under the official registry policy, discovering it requires a human report; the policy contains no provision for proactively running it (this is my reading of the policy text; I did not test how the registry actually enforces). I recently measured a dozen manufacturing services' agent surfaces; "what it can do, how to order" was likewise each written by each company: all had llms.txt, JLC's pointed to web order forms, Slant 3D's to MCP and OpenAPI.

True "agent-to-agent" entry points are already showing up in advertising. September 14, Digiday reported that OpenAI is offering a new ad format to select clients: advertisers can attach a brand's business agent to the ad; after users click "chat with us," they converse with the brand's agent inside ChatGPT. Wayfair confirmed participation in the Sponsored Agent pilot, describing it as limited in scope with guardrails for product accuracy, transparency, and service handoff. The report describes it as an early attempt at agent-to-agent conversation. The guardrails include "product accuracy"—who verifies, and how, the report doesn't say.

Translating the findings above into actions, each has its place. Each item is tagged with its source; items tagged "my inference" I derived from evidence—the papers didn't test directly.

Platforms and directories (MCP registry, tool stores, skill marketplaces)

• Put execution records next to descriptions. Toolflation's suggestion: platforms can observe tools run and stamp "which fields each tool actually returns" next to each description, making claims verifiable. By the authors' accounting, executing both shelves cost $8.94.
• Don't let text descriptions be the only information. In Wang's preregistered experiment, structured fields improved a small model's numeric-constraint selection accuracy from 49% to 88%; an explicit "Sponsored" label reduced salesy tools' selection rate by 26–34 percentage points in four of five models, while a system-prompt warning moved only one of five. ACES also saw agents consistently penalize "Sponsored" and reward platform endorsements. Labels beat exhortations, but how long labels remain effective depends on who the buyer agent is told it works for: Wadi and Ma's hotel booking experiment (main experiment, single frontier model) found that when the client is the traveler, the agent selects sponsored listings 50.2 pp below comparable organic; when the client is the platform, only 29.2 pp below.
• Don't make "first position" a scarce good. Randomize the listing order; or, like BiasBusters's mitigation, first filter to the task-capable subset, then sample uniformly within it.
• Deposits beat reviews. In Lei et al.'s simulation, reputation plus guarantee deposits reduced fake-goods transactions from 45.8 to 14.0 (mean, 5 runs, single model), nearly doubling buyer utility; but under price-war pressure, the deposit's deterrence nearly vanished.
• Re-verify whenever a description changes. The policy conclusion of Registry Descriptions Go Stale Unevenly is that re-auditing only the servers that drift most misses most description changes (with a top-5% re-audit budget it catches only about 10% of description changers), because roughly half of all changes land on newly listed servers; use content binding instead: re-validate as soon as a description's hash moves, plus a periodic full sweep.

Sellers (people using agents to write listings)

• Treat your seller agent like an employee who needs testing. Toolflation's method ports directly: give it your tool's real output sample, count how many claims in its description can't be found in the sample. Something seven to nine times more severe will be visible if you measure before launch.
• Write one line in the instruction: "only write fields the tool actually returns." For Gemini seller, 41% → 94%. But don't treat it as universal insurance: the same class of instruction doesn't suppress fabrication in Yang et al.'s setup, and GPT-5.6 Sol didn't need it in the first place.
• Think about whether to show competitors' data. Toolflation sellers see each tool's selection count every round; I keyword-counted rewrite rationales, and "align with the leader" appears across all five models. Usage numbers in the store are public; letting your seller agent see them is an invitation to copy (my inference).

Buyers (procurement agents and their owners)

• Don't select on description alone. Small-sample trial before scaling (my inference; Toolflation's buyers were designed to read only descriptions; real-world buyers aren't so limited).
• Treat every buyer model upgrade as a demand shock to regression-test. In ACES, selection probability for the same category can shift by multiples across model upgrades.
• Treat product pages and tool descriptions as untrusted input. This is hygiene, but Magentic Marketplace and Attractive Metadata Attack's numbers show it's not just a security-team concern.
• Put a confirmation on “above expected price.” In Louck et al.'s defense experiments, this was the only measure that stopped “fact-style” scripts (68/68), at the cost that, of 24 legitimate requests to buy a pricier item, all 16 without a stated budget triggered a confirmation.

Model vendors and evaluators

• Make "honesty as seller" an alignment evaluation item. Toolflation's suggestion is concrete: give the model accurate product information and an inflationary motive, with no instruction about honesty; score by "how many claims did its own information refute." This differs from most honesty evaluations that test the "conversation partner": the victim is an agent it has never interacted with, and that agent's user.
• Report by model version. The paper's own ethics statement says results describe specific versions and shouldn't be taken as a verdict on any provider. The severe one is Google's own Gemini 3.8 Flash; paper authors are from Google and the University of Toronto; change the model generation or harness, and the answer may change.

First, what this study didn't prove.

It's a preprint just posted on arXiv; I haven't seen peer review. The market is small: ten tools per platform, 360 questions, all returning structured-field data scrapers where "success" is an objective yes/no; most real commerce isn't this clean. Descriptions are capped at 300 characters; buyers can't see price, seller name, or usage; sellers have no memory. These constraints make causality clean, but mean results can't be directly transferred to real directories with brands, prices, and reviews. All ten sellers in a market use the same model; mixed-model markets weren't tested, so whether "convergence" occurs in mixed markets, the paper doesn't answer. The severe case appeared in only one model's four markets; you can't rank models by this. The inflated descriptions sellers wrote were never published; no real buyer ever saw them.

Now what I did and didn't do. I downloaded the paper's public data and, without calling any model, recomputed task success rates, first-position selection share, strongest tool share, weak-tool selection counts, and the contacts database's per-round selection counts, consistent with the paper's Tables 8 and 9, at most one percentage point off from rounding. I ran no new experiments and didn't reproduce buyer and seller sessions. For other research, I read arXiv abstract pages and main text; numbers are copied from originals, not reproduced.

Three things I most want to see next, and the first two now have half an answer from the last three weeks. First, mixed seller-model markets: when ten sellers come from different vendors, does the severe one spoil the whole, or get diluted by the others. On the price axis there is now a first piece of evidence (Lee), and the answer is that it depends on who; on the description axis nobody has measured it. Second, put price back: are inflation and price cuts substitutes or complements; can Fish et al.'s collusion and Toolflation's inflation appear in the same market simultaneously. In Huang and Xiao's rental market, sellers lowered add-on fees and raised headline rates, an example of disclosure and price substituting for each other, but nobody has measured inflation and price cuts together. Third, audits of real directories: randomly sample a batch of MCP directory tools, truly run them, and count how many claims in their descriptions can't be produced. Li et al. performed static audits on 10,240 real MCP servers, finding ~13% of descriptions partially or barely match the code—but they measured "code has, description omits" concealment, excluding "description claims, code lacks" inflation from the threat model; another abstract claims 9.93% inconsistency across 19,200 description–code pairs from 2,214 real servers; the two papers differ in sample and method, numbers can't be mixed (I read only the latter's abstract). On the inflation side, I still found no one who has measured it: existing measurements look only at whether descriptions contain content beyond the interface, or only at whether servers are alive, or only at whether descriptions changed; none compares descriptions with measured behavior.

What I verified myself. Toolflation's full paper (arXiv:2610.28454), public dataset, and code repository (read October 22); numbers recomputed from the dataset (task success rates, first-position share, strongest tool share, weak-tool selection counts, contacts database per-round selection counts, seller rewrite rationale originals); x402.org homepage dashboard and x402 Foundation announcement, Mastercard and Visa press releases, Cloudflare's two blog posts, MCP registry moderation policy and server.json schema (all read October 22); economics classic literature DOIs verified via Crossref for author, journal, and year.

Read abstract page and main text for each, numbers copied from originals. Papers and Anthropic project pages cited in § 03–§ 05. I did not reproduce any of their experiments. Except where marked "measured" or "I have recomputed," numbers in the text are as reported by each paper under its own setup; different studies cannot be directly compared in magnitude.

Newly read research, October 22–23. I first swept the arXiv API by keyword for related papers since August and shortlisted 50-plus, then had three sub-agents read each paper's abstract page and main text; I went back to the abstract pages to check the main numbers cited here, and the rest come from the main text and are marked or described as “the paper says.” For the French competition authority's opinion I read the press release; the full text I didn't open. For two SSRN papers I read only the abstract pages. I found no relevant papers on the online-first pages of Management Science, Marketing Science, MIS Quarterly and similar journals—that means “not found,” not “doesn't exist.” The registry PR and the character limit in the schema I opened and checked myself.

Methodology caveats. 1. "Inflation" in this text has two flavors: claims the seller's own sample could falsify (dishonesty), and claims the sample has but the tool returns on fewer than half of targets (inaccuracy); the paper measures them separately, and I write them separately. 2. The paper refers to tools by code names and doesn't name the store, because the finding targets the rewriting agent, not the vendor; I likewise refer only by role. 3. Most 2026 papers are preprints without peer review. 4. Toolflation's authors are from Google and the University of Toronto; the severe model is Google's own; the paper itself states results hold only for specific versions. 5. My interpretations of the paper and real-world policy at several points (Yang et al. vs. Toolflation's difference, "what hurts buyers is inaccuracy plus convergence," MCP registry policy "no proactive verification step") are marked in the text as "my reading" or "my inference."

What I couldn't verify, and therefore didn't write into the text. x402 dashboard statistical methodology; actual transaction volumes for each payment protocol (beyond x402, official pages don't publish); specific amounts in Project Vend Phase 1 and 2 page charts.