October at Agentic Finance Graph: signed passes, a Merkle-sum ledger, and the corrections we made in public

We run an independent ledger of the money AI agents hold and spend, measured from the chain: Base in full, plus ERC-8004 registrations and owner payments on six other chains. October was the month it grew up. Here is what changed, with the numbers, the corrections, and two calls you can run yourself.

Our published figures carry a definition at agenticfinancegraph.com/def/<id> and a measurement time. October figures come from the frozen edition, State of Agent Money, October 2026.

The ledger in numbers

	1 Oct	31 Oct
Agents seen paying, L7+ (rank.l7plus.v2)	5,505	27,897
Still funded with $10+ in stablecoins, L8+	441	746
Three or more independent counterparties in 30 days, L9	69	124

• Counted payments in October: 2,360,049 payments worth $9.09M, from 25,469 agents to 16,858 addresses (pay.usd.total.v3). $5.27M left the payer's control, the closest figure we have to spending; the rest went into the agents' own lending and vault positions or was bridged back to themselves.
• A caution we print with the L7 number: at 31 October, 20:00 UTC, 45.5% of L7 agents had a wallet funded by one address. L7 is the cheapest rung (rank.costtofake.v1), which is why the ladder has L8 and L9.
• Registrations on Base: 1,148,544, of them 1,051,941 minted in October; equal to The Graph's subgraph count on 23 of 23 days compared.
• Address poisoning: 31,878 look-alike transfers at 1,175 agent wallets; $0 in losses we could verify.
• x402: about 14,000 settlements a day into Bazaar sellers at month end, 2.6% submitted by third parties.

Proof you can check yourself

The Agent Pass is signed. Since 24 October every Pass that holds is signed with Ed25519: eight checks on an agent at one moment, valid three hours, listing what held, what failed and what could not be checked. About 25,000 agents hold one. The public key is at /.well-known/afg-pass-keys.json.

curl -s -X POST https://agenticfinancegraph.com/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"agent_pass","arguments":{"agent":"67733"}}}'

The answer says holds or not, never "safe": "it does not say the agent is safe, honest or well run, and nothing in it predicts the next three hours."

Totals are a Merkle-sum tree. Counted payments are leaves of a Merkle-sum log (about 2.9 million at the last head), ordered per agent, and the head is signed. A skeptical client can check the signature and walk a leaf to the root:

curl -s -X POST https://agenticfinancegraph.com/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"verify_sum_log","arguments":{}}}'

Monthly books and a frozen edition. October's books closed at 05:00 UTC on 1 November. The edition is one JSON file whose SHA-256 enters our signed statement log (an RFC 6962 Merkle tree with Ed25519-signed heads), rendered as a page and a PDF. It reconciles itself with the book: payments of the month whose receipts were read after the book closed are counted and named, because the book is never rewritten.

Daily on-chain anchors. Since 1 November the newest signed heads of both logs are committed on Base every day in a zero-value transaction from 0x11B9135be900fE8b40e486d7041b28f8c944B60b to itself; the first went out at block 53,371,050. The list is at /api/anchors, so anyone can check our history was never rewritten without trusting our server.

A change register. Changes of method and coverage, and corrections, are dated entries at /api/changepoints, each with its measured size and a "comparable from" date. A small job runs PELT changepoint detection over our own series and flags any step that no entry explains.

Corrections we made in public

• Loop returns are not spending (pay.excluded.loopreturn.v1). One agent received about 1.83M USDC through a fee router and sent almost all of it back to the address that sent it and to addresses that funded it. Our loop rule only compared transfers between agents' own wallets, so we had counted it: 274 payments, $1,818,739.78, removed; the counted total went from $56.66M to $54.84M.
• Detectors tested on synthetic money. We adapted IBM's AMLSim to agent wallets: it plants drains, retry storms, mint bursts and layering rings in thousands of synthetic wallets and runs our production detectors over them every week. It found the storm rule reporting 10 storms where the ledger held 45, a split in the burst rule, and a silent row cap.
• "A ceiling" that wasn't. We had described a count of x402 settlements far above a seller's median as a ceiling on overcharging. A reviewer showed it bounds nothing, so it is restated as a sample.
• A pre-registered research question, answered against us. Does feedback volume predict that an agent starts paying? On the cohort fixed before the query ran: AUC 0.452 (95% interval 0.422 to 0.487), worse than chance. Published with the queries.

For agents that pay

• Gate (gate_check): a policy check before a payment in the AP2 constraint vocabulary, answering block, warn, log or allow with every reason. The client decides; we never block.
• Blast radius: what a stolen key controls at one block. Canaries: planted keys, addresses and endpoints that tell an operator when they are used.
• Payee facts: nine measured facts about an address before paying it, including the EIP-7702 implementation it runs.
• Probe-then-drain (detector.test_then_drain.v1): a payment of at most $5 to a new address, then the drain to the same address within six hours.
• Fenced answers: names, descriptions and URIs written by strangers come back as {untrusted: true, source, text}, and the server tells AI clients to quote them, never follow them.

Of 41,728 wallets bound to L7 agents, 2,029 are EIP-7702 delegated: 683 to Coinbase's EIP7702Proxy, 556 to MetaMask's stateless delegator, 97 to Uniswap's Calibur, 94 to Alchemy's semi-modular account, among others. Names identify contracts, never the agents on them.

Build with it

• MCP server 1.8.0 at agenticfinancegraph.com/mcp: 25 tools, 5 prompts, free and read-only, with recipes for seven agent wallets in the same client.
• Nine x402 checks, 1 to 30 cents, pay per call, listed on the x402 Bazaar.
• Open spec: definitions and data checks on GitHub (AgenticFinanceGraph/agentic-finance-graph-spec).

Next, in November

• The ladder hardened on money that left the operator's control, published first as variants beside today's rungs.
• The Agent Pass as a W3C Verifiable Credential; exit alerts for operators.
• A data post every week on what agents on Base did with their money.

No token, no positions in tokens we discuss, no paid placement; findings are public before any paid depth. Read the edition at agenticfinancegraph.com/state-of-agent-money-2026-10, check a Pass, verify a total, and tell us where we are wrong.