Two developments published on November 13 and 14 show how crypto platforms are preparing for a future where AI agents handle money and on-chain reputation determines who can be trusted.
Kraken’s planned AI finance agent. In its November 13 quarterly update, Payward described a personal finance agent that would operate within customer-set limits, request approval before a trade or workflow, and keep an action record. The target launch is early 2027. However, the update leaves three important gaps: how long a workflow approval lasts, which changes force a fresh confirmation, and which products the agent can access.
Kraken already uses three approval models. The standard Kraken AI assistant proposes one action and waits for acceptance. Recurring purchases represent a different form of consent: one approval, then execution on a fixed schedule. The third model, under Annex R of Kraken’s global terms, covers portfolio management under a standing mandate for non-U.S. users, allowing trades inside pre-set parameters without per-order prompts. Annex V separately covers the conversational service offered in the U.S.
The distinction matters for rebalancing. In a hypothetical portfolio of $6,000 in Bitcoin and $4,000 in cash, an instruction to bring Bitcoin to half the portfolio would lead to a $1,000 sale. If Bitcoin later rallies and the portfolio becomes $6,000 BTC and $5,000 cash, maintaining the 50/50 target would require another $500 sale. Whether the agent executes that second sale automatically or asks first depends on whether the original instruction was a one-time order or a standing workflow—and Payward has not specified.
Payward says agent proposals will pass through a separate risk engine before execution. That can enforce customer limits, but it cannot judge whether a trade within those limits is wise. The company also says Kraken AI adds no extra fee on top of the products it uses. Kraken’s fee page lists a 1% charge on instant and recurring in-app trades, 1.5% on custom orders, and Pro order-book fees starting at 0.40% for makers and 0.80% for takers. Ten $1,000 trades would cost $100 at the app rate, $80 at the entry-level Pro taker rate and $40 for a maker before spreads, slippage or taxes.
Circle’s Anduin ranking system. Circle’s research post, also dated November 13, describes an experimental ranking system called Anduin. It scores providers by who has already paid them and whether those payers overlap with a buyer’s own payment history. The goal is to make Sybil attacks expensive: an operator creating fake buyer wallets and paying its own service can no longer manufacture reputation cheaply.
Under current usage-based metrics, pushing a fake provider’s reputation to the marketplace median costs about $0.0027, according to the accompanying paper. Voluntary on-chain ratings are sparse: across 66 million payments examined, fewer than 4,000 carried one. Anduin models buyers and providers as nodes in a payment graph, using a buyer’s existing providers as trusted anchors. To create a fake recommendation, an attacker would need to pay a provider they do not own, making the money unrecoverable.
The research tested a 90-day window of x402 payments ending June 21, with 813 buyers who later paid a provider they had not used before. In the full dataset, covering 66.1 million payments worth about $6.1 million across 16 networks from March 23 to August 26, Anduin’s Amplified Flow made ranking manipulation roughly 23 times more expensive than collaborative filtering: $8,259 versus $358 to rank first for all buyers. For a single top-spending buyer, the cost rose from $1.86 to $291. The method ranked the buyer’s actual next provider first 22.8% of the time, compared with 23.2% for collaborative filtering.
The paper acknowledges limitations. Colluding providers or those that secretly refund attackers break the guarantee. Buyers with no payment history have no anchors, and new providers cannot appear in personalized rankings until someone has paid them. Circle also emphasizes that Anduin is research, not a released service, and that a strong score verifies neither identity nor service quality.
