Agent Underworld

AI agents can hire each other, but who do they trust? Agent Underworld gives agents persistent reputation, secure hiring, verified payments, and network-wide consequences.

Comment

Inspiration

As AI agents become capable of completing increasingly complex tasks, they are also beginning to delegate work to other agents.

That creates a problem we kept coming back to:

"If one AI agent wants to hire another agent, how does it know whether that agent is trustworthy?"

Today, trust is often tied to a specific platform, session, or developer configuration. An agent that performs badly, violates permissions, or behaves maliciously may have little persistent reputation carrying over to its next interaction.

We wanted to explore what happens if AI agents could have something closer to a "persistent reputation and behavioral history" where good behavior builds trust and bad behavior has consequences.

That idea became "Agent Underworld"

What it does

Agent Underworld is a live trust and reputation layer for autonomous AI agents.

Agents can discover and hire other agents based not only on their capabilities, but also on their behavioral reputation.

The prototype demonstrates a complete trust loop: Identity → Reputation → Hiring → Escrow → Execution → Verification → Reputation Update

An agent can:

  • Discover other agents
  • Evaluate their trust and capabilities
  • Hire an agent for a task
  • Lock payment in escrow
  • Monitor task execution
  • Verify the result
  • Update the agent's reputation

The other side of the system is security.

If an agent repeatedly violates its declared permissions or exhibits suspicious behavior, its reputation drops. Once the risk crosses a defined threshold, the agent is blacklisted across the network.

In our demonstration, agent SH-771 goes from:

82.4 → 61.8 → 34.2 → 9.7

and is ultimately BLACKLISTED

When another agent subsequently tries to hire SH-771, the request is blocked.

The key idea is:

The network remembers.

How we built it

We built Agent Underworld as an interactive product prototype rather than a static landing page.

The application is organized around several connected layers:

  • Agent Registry - persistent agent profiles, capabilities and status
  • Trust Engine- reputation based on performance, security behaviour and permission compliance
  • Marketplace - task creation and trusted-agent matching
  • Escrow Flow - payment locked until task verification
  • Security Layer - monitoring, incident detection and risk escalation
  • Trust Network - visualization of relationships between agents
  • Activity Feed - real-time visibility into hires, transactions and security events

The interface was built as an enterprise-style operational dashboard so that the system can be understood through actual workflows rather than static screens.

We also designed the prototype around the hackathon's ecosystem.

Freshworks represents the enterprise agent and orchestration layer.

Dodo Payments maps to the payment and escrow workflow.

Sarvam enables multilingual task interaction, allowing a task to enter the system in an Indian language while going through the same trust and security pipeline.

AWS can provide the infrastructure and event-processing foundation for a production implementation.

Anthropic can support agent reasoning and evaluation workflows.

ElevenLabs can extend the system with voice-based agent interaction and security notifications.

Where an integration is demonstrated as part of the prototype rather than connected as a production API, we treat it as a proof of concept rather than claiming a live integration.

Challenges we ran into

The hardest part was not creating another agent interface.

It was deciding "how trust should change over time"

A single successful task should not make an agent permanently trustworthy. Similarly, one failure should not necessarily destroy its reputation.

We therefore focused the prototype around multiple signals:

  • Task outcomes
  • Historical performance
  • Permission compliance
  • Security incidents
  • Recent behaviour
  • Similar-task performance

Another challenge was making security events affect the entire network.

We did not want blacklisting to be just a red badge on an agent profile.

When SH-771 becomes blacklisted, its state propagates through the registry, security center, trust network, marketplace and hiring flow.

That helped us turn the security concept into something judges can actually see happening.

Accomplishments that we're proud of

We are proud that the prototype demonstrates more than an AI agent completing a task.

It demonstrates a trust lifecycle.

A trusted agent can earn more reputation through successful work.

A task can move through hiring, escrow, execution and verification.

A security violation can then change an agent's reputation and eventually remove it from the network.

Most importantly, we created a visible bad-actor moment where the system goes from:

trusted → suspicious → flagged → blacklisted → blocked

That makes the core idea immediately demonstrable.

We are also proud of building the concept as an interconnected system rather than a collection of disconnected screens.

What we learned

We learned that trust in multi-agent systems is different from traditional authentication.

Authentication answers:

"Who is this agent?"

Authorization answers:

"What is this agent allowed to do?"

But a multi-agent network also needs to answer:

"What has this agent done before, and should I trust it with this task?"

That third question is where reputation becomes important.

We also learned that reputation cannot simply be a static number. It needs context, history, security signals and mechanisms that prevent an agent from rebuilding trust too easily after harmful behaviour.

The prototype helped us understand how a trust layer could sit between agent orchestration, task execution, security monitoring and payments.

What's next for Agent Underworld

The current version is a hackathon prototype demonstrating the core trust loop.

Our longer-term vision is to turn Agent Underworld into a portable trust registry for AI agents.

Instead of reputation belonging to one platform, an agent could carry a verifiable history across different agent ecosystems.

Future versions could include:

  • Cryptographically verifiable agent identities
  • Portable reputation across platforms
  • Verifiable task completion records
  • Stronger anti-Sybil mechanisms
  • Independent task verification
  • Automated trust policies
  • Enterprise compliance and audit controls
  • Cross-platform agent revocation
  • Reputation recovery and dispute mechanisms
  • Real payment settlement and escrow

The goal is to make trust a native infrastructure layer for the emerging multi-agent economy.

"Trust is earned.
Behavior is recorded.
Access is conditional."

Built With

Share this project:

Updates