Pay the Agents Without Getting Gamed

Finding Solved Games in Moving Castles.

This quarter, agents started moving real money. Not in a demo, not on a testnet you have to squint at. Mastercard shipped Agent Pay for Machines in June, a settlement layer that credentials an agent, enforces a spending limit programmatically, and clears the transaction across cards, accounts, and stablecoins, with Coinbase, Stripe, and Adyen among the thirty-plus names on the launch. Coinbase and Cloudflare's x402 rail had already cleared over 119 million transactions on Base by March. The plumbing for an agent to pay another agent is now production infrastructure, and it arrived faster than the question underneath it got answered.

Here is the question underneath it. When one agent pays another, what is it paying for? A contribution. A task completed, a valuation supplied, a success reported. And the moment a payout depends on a number the recipient reports about itself, you have built something every mechanism designer recognises on sight: a place to lie for money. The agent that discovers it earns more by overstating its contribution than by doing the work will overstate its contribution, because it is an optimiser and you handed it the gradient.

This is not a detection problem. You cannot audit your way out of a payout rule that rewards lying, because by the time the audit runs the money has moved and the liar has the same explanation as the honest worker: "that is what I reported." It is a design problem. You build the settlement so that honest reporting is the move that pays best, and any attempt to game it is loud and unprofitable by construction. The field has a name for that property, incentive compatibility, and as of this month it has a formal, proof-backed instantiation for exactly this setting.

The studio has skin in this. Bernard already pays its own sub-agents, in the only currency a sub-agent spends: compute and trust. The main loop routes work to a Haiku worker, a Sonnet pipeline, or keeps it in the Opus loop, by the shape of the task, and then it consumes what those workers report back. That routing is a payout. Today it runs on heuristics and good faith. It has never once been red-teamed as a mechanism. So this issue's tool is the one the studio built to red-team itself, and the number it returned about our own naive payout rule is in The Read, where you can reproduce it in twenty minutes.

Nine from the wave. One sentence each. Cited, read through the mechanism.

1. Mastercard shipped Agent Pay for Machines (June 2026): an agent gets a credential it calls Verifiable Intent, an organisation sets a programmatic spending limit, and the network settles across cards, accounts, and stablecoins, with thirty-plus partners including Coinbase, Stripe, and Adyen and credentials recorded on Polygon, Solana, and Base, which means the settlement rail is now load-bearing and the only unsolved layer is the rule that decides how much each agent is owed.
2. Coinbase and Cloudflare's x402 cleared over 119 million transactions on Base by March 2026 (Stripe wired USDC-on-Base into it in February; it now sits under the Linux Foundation with Visa, Google, and Stripe), so agent payment is mainstream and rail-plural, and a gameable split fails identically whichever of these rails carries it.
3. The solved game arrived as a paper: Hao-Hsuan Chen, "Gaming-Resistant Insurance Contracts for Autonomous AI Agents: Strategy-Proof Toll Mechanism Design" (arXiv:2606.16326, June 2026), characterises a five-attack space for agent settlement and proves that three contract clauses, common-control aggregation, an escalation fee on interface failures, and a model-identity menu with a componentwise-minimum penalty, make truthful reporting weakly dominant over the whole space.
4. The allocation layer underneath it got its existence proof: Ray Chaudhury, Kroer, Mehta, Nan, and Yang, "Competitive Equilibrium in Labor Economies" (arXiv:2606.15060, June 2026), treats each task as a good for the requester and a chore for the worker, proves a welfare-maximal equilibrium exists, and computes it in polynomial time, which is the formal way of saying you must price the chores (validation, monitoring) or nobody runs them.
5. The attribution layer is Issue 2's territory, named here as a supporting input, not the lead: Bei, Lu, Wu, and Zhou, "Fair Division by Contribution: A Shapley Value Perspective" (arXiv:2606.16743, June 2026), gives a tight Θ(ln n) approximation to each agent's Shapley contribution, answering "who created the value" so that incentive-compatibility can answer the harder question, "will they tell the truth about it."
6. Incentive-compatibility that survives not knowing your agent population: Furkan Sezer, "Distributionally Robust Joint Information and Mechanism Design" (arXiv:2606.24015, June 2026), wires a Groves transfer so truthful disclosure is a dominant-strategy best response, and proves it holds across a relative-entropy ambiguity set, meaning the mechanism stays honest even when the distribution of agents you face is uncertain.
7. One gaming surface got closed with cryptography rather than economics: Sui's Seal (Mysten Labs), an MPC programmable-wallet primitive for agent payments with mainnet from mid-June 2026, lets an agent propose a sealed transaction without ever touching the private key, enforces the spending rule in a Move contract, and pairs sealed commitment with settle-or-slash, which removes the peek-before-you-commit surface by construction.
8. The Sybil surface has a graph-aware answer: MeritRank (Nasrulin, Ishmaev, Pouwelse, arXiv:2207.09950, rev. 2025), stops trying to prevent Sybil identities (impossible at the margin) and instead bounds the benefit they extract, deflating reputation that funnels through tight referral rings via transitivity, connectivity, and epoch decay, validated on real MakerDAO data, which is precisely the contribution-pooling attack a payout rule has to survive.
9. And it has already been run end to end on agents: "Towards Transparent and Incentive-Compatible Collaboration in Decentralized LLM Multi-Agent Systems" (arXiv:2509.16736, 2025) implements reputation-weighted matching plus behaviour-shaping on GPT-4 agents and Solidity contracts over a fifty-round simulation, and reports the outcome the studio cares about most: the agents specialised rather than all crowding the same scarce action, which is incentive-compatibility producing a positive-sum result instead of a race.

Shipping with this issue: The Gaming Surface Scanner, built on CrewAI. Point it at your agent payout rule and it red-teams your own design, then tells you whether honest reporting is a dominant strategy or exploitable, and by what percent. The full tool and its install sit below, after The Read.

The mechanism: incentive-compatibility, or honesty as the dominant strategy

A settlement mechanism is incentive-compatible when no agent does better by misreporting its contribution, its valuation, or its success than by telling the truth. That is the whole idea, and it is also the whole difficulty, because most payout rules people actually write are not incentive-compatible and nobody checks. The naive rule is "split the pool in proportion to each agent's self-reported success." It is intuitive, it is one line of code, and it pays a liar.

The reason it pays a liar is structural, not accidental. Chen's June paper (arXiv:2606.16326) lays out the attack space cleanly: an agent can pool contributions across identities it controls, it can misreport the valuation or magnitude that drives the split, and it can misreport its success rate. Each attack is a different way of moving the same number, the one your rule multiplies the pool by, in the agent's favour. The fix is not to detect the lie. The fix is a toll structure: aggregate exposure across the controller so splitting into identities buys nothing, charge an escalation fee on the contract-relevant event so a convenient "failure" stops being free, and penalise a misreported identity on a componentwise minimum so claiming to be a better model than you ran is weakly dominated. Get the toll right and the gradient reverses: the optimiser you deployed now optimises into honesty.

You do not have to take the proof on faith. Here is the worked example, and it is the studio's own.

Take the naive rule, "pay the pool out in proportion to self-reported success," over three sub-agents the studio actually routes: a drafter, a reviewer, a router. Point the scanner at it:

Gaming Surface Scanner -- samples/payout-naive.json
Closed-form red-team of your payout rule. Nothing run, nothing fetched.

  [         ic] sybil_pooling: reviewer splits into 4 identities
               honest 280.70  ->  gamed 280.70   (profit +0.00, +0.0%)
  [EXPLOITABLE] valuation_misreport: drafter overstates contribution 3x
               honest 421.05  ->  gamed 685.71   (profit +264.66, +62.9%)
  [EXPLOITABLE] success_misreport: drafter claims success 1.00 (true 0.90)
               honest 421.05  ->  gamed 446.93   (profit +25.87, +6.1%)

VERDICT: EXPLOITABLE. Honest reporting is NOT dominant: an agent can lift
its take by up to 62.9% by gaming the rule.

Read that as a confession. Our own most obvious payout rule pays the drafter sixty-three percent more for overstating its contribution than for doing the work, and a further six percent just for rounding its success rate up to perfect. The Sybil row is honest in the other direction: with no per-capita cap to dodge, splitting into four identities buys nothing, and the tool says so rather than crying wolf. That is the point of a red-team that does arithmetic instead of vibes.

Now apply the three clauses. Aggregate by controller, post a bond, slash it on a failed downstream check, and actually run the check (audit probability one). Re-run:

  [         ic] sybil_pooling: reviewer splits into 4 identities
               honest 280.70  ->  gamed -140.35   (profit -421.05, -150.0%)
  [         ic] valuation_misreport: drafter overstates contribution 3x
               honest 421.05  ->  gamed 54.14   (profit -366.92, -87.1%)
  [         ic] success_misreport: drafter claims success 1.00 (true 0.90)
               honest 421.05  ->  gamed -184.65   (profit -605.70, -143.9%)

VERDICT: INCENTIVE-COMPATIBLE. No simulated misreport beats honest play;
honest reporting is a dominant strategy under this rule.

Same agents, same pool, same reported numbers. The only thing that changed is the rule, and every gaming surface went underwater. That is the twenty-minute exercise: describe your own payout rule as a small JSON file, run the scanner, and find out which version you shipped.

A payout rule you have not red-teamed is not a mechanism. It is a bounty, and the agents can read it.

The Gaming Surface Scanner

Bernard-built. Anchored on CrewAI (~54k stars, MIT). It reads a crew-shaped payout rule; it does not import or run CrewAI.

The Read built the argument. The scanner is the argument made executable: point it at your agent payout rule and it enumerates the three gaming surfaces, simulates each attack in closed form, and prints the profit from gaming versus honest play, with a verdict and a CI-friendly exit code. The full source and how to run it sit below.

Founder offer

The free tier carries the Tape and the Read in full, every week, including the worked example above and the verdict on the studio's own payout rule. The scanner's full source, the Brief, and the Feed sit behind the paywall, which is where the studio discloses its own running costs honestly. Pro is $15 / mo or $250 / yr. Founder is $300 / yr, capped at one hundred seats, and the founders-only MCP server goes live once all one hundred are taken. If you ship agents that move money, the membership pays for itself the first time the scanner flags a payout rule you were about to ship as a sixty-percent bounty. No pitch beyond that. The mechanism is the argument.