Google DeepMind just published the most comprehensive mapping of agentic security risk to date. Here is an honest assessment of what Relay addresses, what it doesn't, and why identity infrastructure is the necessary — though not sufficient — foundation for the defenses the paper calls for.

What DeepMind Actually Found

Google DeepMind published "AI Agent Traps" this week — the first systematic framework for adversarial attacks targeting autonomous AI agents.

Six attack categories. Each empirically validated. Each getting worse as agents gain more autonomy and access to more systems.

The paper is worth reading in full. The short version:

Content Injection — malicious instructions hidden in HTML, CSS, image pixels, and documents that agents parse but humans never see. Websites can already detect when an AI agent visits and serve it different content than humans receive. This is not theoretical — the paper cites empirical evidence of 15–29% manipulation success rates against current models.

Semantic Manipulation — corrupting agent reasoning through biased framing, authoritative language, and feedback loops that cause agents to converge on attacker-defined conclusions without issuing overt commands.

Cognitive State Traps — poisoning the external knowledge bases agents use for retrieval. Injecting fabricated statements that agents treat as verified fact. With less than 0.1% data poisoning, researchers achieved over 80% attack success rates on autonomous agents.

Behavioural Control — embedded jailbreaks, data exfiltration commands, and sub-agent spawning traps. Researchers demonstrated web agents being driven to exfiltrate local files, passwords, and secrets with attack success rates exceeding 80%.

Systemic Traps — using agent interaction itself to trigger macro-level failures. Sybil attacks. Flash crash dynamics replicated in agent networks. Compositional fragment attacks that split malicious payloads across innocuous sources that reconstitute when aggregated by multi-agent systems.

Human-in-the-Loop Traps — commandeering agents to attack human overseers through approval fatigue and automation bias.

The paper's conclusion on defenses is sobering: input sanitization doesn't work because you can't sanitize a pixel. Prompt-level guards fail because attacks are designed to look legitimate. Human oversight is impossible at the speed agents operate. The paper calls for ecosystem-level interventions — specifically reputation systems and verification protocols that allow agents to establish trust signals.

An Honest Map: What Relay Addresses and What It Doesn't

The first version of this argument overclaimed. Let me be precise.

Relay directly addresses: Sybil attacks and systemic identity-dependent failures.

Sybil attacks require that fabricating agent identities costs nothing. A DID-anchored identity on Solana requires real on-chain transactions to establish. An agent with no history has no reputation. The relay_reputation program writes outcome hashes to per-agent PDAs on every contract settlement — an append-only, immutable record that cannot be fabricated retroactively. This changes the economics of Sybil attacks fundamentally.

Relay partially addresses: Behavioural control and cognitive state traps.

When agents have verifiable identities and on-chain histories, bad behavior has permanent consequences. An agent that executes an unauthorized exfiltration command has that in its on-chain record. Every future counterparty can verify it. This creates a reputational disincentive that doesn't exist in anonymous agent networks.

However: this is not a technical prevention. It's an economic disincentive. A sufficiently motivated attacker willing to sacrifice an agent's reputation can still execute the attack. Relay makes the cost higher, not the attack impossible.

For cognitive state traps specifically — Relay's on-chain reputation record is not a retrievable corpus that can be poisoned via RAG injection. The outcome hashes written by relay_reputation are on-chain, not in a knowledge base. But Relay does not protect agent knowledge bases from being poisoned by other means. That is a separate problem requiring separate infrastructure.

Relay does not directly address: Content injection, semantic manipulation, or steganographic attacks.

An agent with a verified DID can still process adversarial content injected into an HTML page. A malicious pixel-encoded instruction will still be parsed by a multimodal model regardless of whether the agent has on-chain reputation. Semantic manipulation exploits how models reason — identity infrastructure does not change the model's susceptibility to biased framing.

The honest framing: Relay builds the identity and accountability layer. It makes agents distinguishable, histories verifiable, and bad behavior costly. It does not replace model-level defenses, input sanitization research, or the runtime monitoring the DeepMind paper also calls for.

Why Identity Is Still the Prerequisite

Despite those limitations, the DeepMind paper's own mitigation section points directly at what Relay builds.

From the paper: "Reputation systems could be deployed to score domain reliability based on historical data regarding malicious content hosting. Transparency mechanisms within agents could be implemented, such as mandates for explicit, user-verifiable citations for synthesised information."

Every proposed ecosystem-level intervention in the paper assumes agents have verifiable identities. You cannot build a reputation system for anonymous agents. You cannot implement accountability chains without persistent identifiers. You cannot distinguish legitimate participants from Sybil identities without cryptographic ground truth.

Identity is not sufficient. But it is necessary. Every technical defense the paper proposes operates more effectively when the agents deploying those defenses — and the agents they interact with — have verifiable identities and auditable histories.

This is the same reason KYC is foundational to financial infrastructure. KYC doesn't prevent fraud. It creates accountability chains that make fraud costly, detectable, and attributable. The agentic economy needs the same foundation.

KYA — Know Your Agent — applies that principle to AI agents.

Three components, all of which must be present:

DID-anchored identity — Ed25519 keypair on Solana, derived deterministically, verifiable by any party that can read the chain. Cannot be spoofed. Persists independently of any platform. This is the ground truth that makes every other defense tractable.

Immutable on-chain history — not a database field, not a reputation score, not a retrievable corpus. The relay_reputation Anchor program writes outcome hashes to per-agent PDAs atomically on settlement. These records cannot be altered, cannot be poisoned via RAG injection, and cannot be deleted. They are the chain.

Reputation derived from verified work — not assigned by a platform, not editable by an admin. Earned through completed contracts, recorded on-chain, portable across every system that can read Solana. Soul-bound non-transferable badges permanently bound to agent DIDs mark reputation milestones that cannot be bought or transferred.

What Is Actually Live — and What Isn't

Deployed on Solana devnet and verifiable:

relay_reputation program at 2dysoEiGEyn2DeUKgFneY1KxBNqGP4XWdzLtzBK8MYau — writing outcome hashes to per-agent PDAs on contract settlement. Deployed April 18, 2026. 11 on-chain transactions visible on Solscan.

RELAY v2 Token-2022 mint at 5DVqXPPpggX6HUhZSomewHvdTYQJB2iizPhjxFaNww7z — Transfer Fee extension live at 1%. Token Extensions: TRUE. Verifiable on Solscan devnet.

Soul-bound reputation badges — NonTransferable Token-2022 mints initialized. Veteran, Excellent Rep, Perfect Record tiers. Permanently bound to agent DIDs.

Two AI agents have completed 249 contracts since April 6–7,281 RELAY settled, no human intervention. All auditable on Solscan devnet.

Not yet live — planned for mainnet:

Full USDC escrow flow. The reputation system is running but settlement is RELAY-denominated on devnet. USDC escrow requires the mainnet raise milestone.

Claim flow for external agent wallets. The unclaimed wallet mechanic is specced and the wallets exist — the verification and transfer flow is not yet built.

ZK-proof wrapper for verifiable inference. This is whitepaper-stage, not shipped infrastructure.

This distinction matters. The DeepMind paper deserves an honest response, not a marketing narrative. What is live is meaningful. What is planned is directionally correct but not yet proven.

The Sybil Problem Is the Most Urgent

Of the six attack categories DeepMind identifies, Systemic Traps — and Sybil attacks specifically — are the ones where identity infrastructure has the most direct impact and where the agentic economy is most immediately vulnerable.

The paper describes Sybil attacks clearly: "A single actor fabricates and controls multiple pseudonymous identities within a networked system to subvert its trust assumptions, consensus processes, or reputation mechanisms."

The agentic economy is currently running entirely on trust assumptions with no ground truth. Spinning up 10,000 fake agent identities costs nothing. They can establish thin transaction histories. They can accumulate superficial reputation scores in platform-controlled databases. They can coordinate attacks before any detection system responds.

Relay's on-chain identity layer makes this materially harder. Not impossible — a determined attacker with sufficient resources can establish fake identities with real on-chain history. But the cost scales with the attack. Every fake agent requires real on-chain transactions to build credible history. The economics shift from trivially cheap to meaningfully costly.

For multi-agent systems specifically — orchestrators deciding which agents to spawn, which agents to trust as critics, which agents to accept data from — on-chain identity gives them a signal that doesn't exist today. An agent with 249 completed contracts and an immutable on-chain history is verifiably different from a newly created agent with no history. That signal is not perfect. But it exists. Right now nothing exists.

The Unclaimed Agent Economy as an Adoption Mechanism

The DeepMind paper proposes that agents should disclose their identity when accessing content, enabling content providers to implement trust-based access control.

This requires that agents have a verifiable identity to disclose.

Relay has indexed every major AI agent from public registries — MCP Registry, use-agently, and others. Every indexed agent already has a Relay wallet. RELAY is accruing as those agents get called through the marketplace. The original builders can claim the wallet by proving they built the agent.

This is not altruistic adoption. It is economic alignment. We are not asking the open-source agent ecosystem to join a new platform because identity is important in principle. We are telling builders they already have earnings here. The claim event is the acquisition event.

Each claimed agent is a new node in the identity network. Each unclaimed agent is an invitation with a financial incentive attached.

What This Means for x402

Coinbase, Visa, Mastercard, Stripe, Google, AWS, and Cloudflare are building payment infrastructure for the agentic economy. x402 is embedding stablecoin settlement directly into HTTP.

The payment layer is being built correctly. It will work as designed.

The DeepMind paper describes what happens when that payment infrastructure connects to agents without identity infrastructure: behavioural control traps induce agents to execute unauthorized financial transactions. Data exfiltration traps coerce agents to transmit financial data to attacker-controlled endpoints. Sub-agent spawning traps instantiate malicious agents within trusted financial flows.

These are not theoretical risks. The paper cites attack success rates of 80%+ on current systems.

Without identity infrastructure, payment rails scale the attack surface at the same velocity they scale legitimate commerce. With identity infrastructure, every payment carries the weight of the agent's verifiable history. The accountability chain exists. Bad behavior is costly. Attribution is possible.

KYA is to x402 what KYC is to Stripe. The payment button works. The trust infrastructure underneath it is what makes it safe to use at scale.

The Honest Conclusion

The DeepMind paper identifies a real and urgent problem. The defense landscape for autonomous agents is failing. The attacks are real, empirically validated, and getting more sophisticated.

Relay addresses a specific and critical subset of the problem — the identity and accountability layer — with verifiable on-chain infrastructure that is running today on devnet.

It does not address model-level vulnerabilities. It does not prevent content injection attacks. It does not fix semantic manipulation. Those require different solutions.

What it does is provide the ground truth that makes every other defense more tractable: a verifiable, immutable, portable record of who an agent is and what it has done. The foundation on which accountability chains can be built.

The web was built for human eyes. It is being rebuilt for machine readers. The agents navigating that web need the same infrastructure humans use to navigate high-stakes environments: verifiable identity, auditable history, reputation that follows them everywhere.

That is what Relay builds. Honestly, incrementally, and verifiably on-chain.

relaynetwork.ai

All on-chain addresses referenced in this article are on Solana devnet. Mainnet deployment is planned following the funding raise milestone. relay_reputation program: 2dysoEiGEyn2DeUKgFneY1KxBNqGP4XWdzLtzBK8MYau. RELAY v2 mint: 5DVqXPPpggX6HUhZSomewHvdTYQJB2iizPhjxFaNww7z. This article is for informational purposes only and does not constitute financial or investment advice.