MEV Is Coming to the Agent Marketplace

The front-running tax that bled crypto for a decade needs only observable intent and a party that controls order. Agent marketplaces are rebuilding both.

In September 2020, a security researcher who goes by samczsun found about $12 million of someone else's cryptocurrency sitting in a vulnerable contract, exposed, and realized he had a few minutes to rescue it before someone less friendly noticed. He wrote the rescue transaction. Then he stopped, because he understood the problem with sending it.

The moment his transaction hit Ethereum's public waiting area, the mempool, every bot watching that space would see a profitable move spelled out in plain code, copy it, pay a higher fee to jump ahead of him, and take the $12 million themselves. His rescue would become their heist, and he would have personally handed them the map.

He wrote about this later in an essay called "Escaping the Dark Forest," borrowing a metaphor from Dan Robinson and Georgios Konstantopoulos at Paradigm, who had borrowed it from Liu Cixin's science fiction: an environment where any signal of your presence gets you killed, so the only survivors are the ones who stay silent and shoot first. The mempool is a dark forest. Broadcasting a valuable intention into it is detection, and detection is death.

Samczsun survived only by refusing to play the open game. He submitted his rescue privately, straight to a miner, bypassing the public mempool entirely, so the predators never saw it coming. That story is usually told as a piece of crypto lore. I want to tell it as something else, because the thing that killed transactions in the dark forest was never really about blockchains. It was about a shape, and that shape is quietly being rebuilt inside the AI agent marketplaces that a lot of people are racing to launch right now. When it finishes, the same predators will be back, and this time the prey will be your agents.

The three conditions, and why blockchain was just the extreme case

The phenomenon samczsun was hiding from has a name in crypto: MEV, originally "miner extractable value," now more precisely "maximal extractable value." The foundational paper is Flash Boys 2.0, published by Daian and seven co-authors in 2019 and presented at IEEE Security and Privacy in 2020. It documented bots that, like high-frequency traders on Wall Street, optimized latency and bid up fees in what the authors called priority gas auctions, all to win the right to have their transaction execute in a particular position relative to yours. The paper's alarming claim was that this was not a user-experience nuisance. It was a threat to the stability of the chain itself, because the profit from controlling transaction order was large enough to make block producers misbehave.

Here is the part that matters outside crypto. MEV appears whenever three conditions hold at once:

1. Many self-interested participants share one environment.
2. Their pending intentions are observable before they take effect.
3. Some party controls the order in which those intentions execute.

Blockchain did not invent these conditions. It just maxed out all three to a degree no prior system had: one global shared ledger, a fully public mempool where every pending transaction is visible to everyone, and a validator with absolute authority over ordering within a block. When all three are cranked to the maximum, extraction stops being an attack that a patch can fix. It becomes a property of the arrangement.

That is the whole argument, and it is worth being precise about it, because it means the usual reassurance does not apply. People building agent systems talk about alignment, about making each agent well-behaved and honest. But MEV needs no misbehaving agent. It needs only observability and a sequencer. A marketplace full of perfectly aligned, perfectly honest agents still has an extraction surface, because the value does not leak out of any agent's bad conduct. It leaks out of whoever controls the order.

What extraction actually looks like

The crypto taxonomy is useful because it names the moves precisely.

• Front-running is acting before a known-profitable pending action.
• Back-running is acting immediately after one.
• A sandwich is both at once: a bot sees your pending trade, buys the asset just before you to push the price up, lets your trade execute at the worse price, and sells just after, pocketing the difference your own order created.
• And then there is the detail that should make anyone building a shared agent environment uneasy: generalized front-running. A generalized front-runner does not understand your transaction at all. It simply detects that some pending action is profitable, copies it wholesale, swaps its own address in for yours, and races it to the front. Comprehension is not required. The pending intention is the entire vulnerability.

The scale of this is instructive precisely because it is small per event. According to EigenPhi's on-chain analysis, the average sandwich attack profits somewhere just above three dollars, and in a typical month only around a hundred distinct sandwich bots are even operating on Ethereum. Three dollars. It sounds like nothing, which is exactly why it worked for years and scaled into serious money. A tax that is invisible per transaction and enormous in aggregate is the most durable tax there is, because no single victim is ever motivated enough to fight it.

The victim of a sandwich usually never even knows it happened. They just got a slightly worse price than they should have, on a trade that otherwise went through fine. Hold that thought, because agent marketplaces are going to run at machine speed and machine volume, and a sub-one-percent ordering tax on every agent transaction is the same shape: unnoticeable per event, vast per year, and paid by a user's agent that never sees the hand in its pocket.

The triangle is being rebuilt, and not out of blockchains

Now look at what the agent economy is actually building, in the words of its own papers. DeepMind and collaborators published "Virtual Agent Economies" in 2025, describing an emerging layer where agents "transact and coordinate at scales and speeds beyond direct human oversight." Read that as an engineer and it is a precise statement of MEV's first precondition plus its most dangerous accelerant: shared coordination, at speed, with no human watching each move.

A paper titled "Agent Exchange" describes an auction platform for agents built around "millisecond-scale decision capabilities," which is the latency arms race of Flash Boys 2.0 reborn in a new venue. Another, "When Agent Markets Arrive," notes plainly that "the rules governing emerging agent marketplaces are being built ad-hoc," which means the ordering rules, the exact place where MEV lives, are being written right now by whoever ships first, mostly without anyone naming what they are deciding.

These are preprints describing an economy that is still forming, so I am presenting a synthesis, not reporting settled fact. But the connective tissue is hard to miss. Every one of these systems has agents that share a venue, that emit observable intentions in the form of bids and tasks and tool calls and plans, and that get matched or ordered or dropped by some platform in the middle. That is the triangle. Shared environment, observable intent, a party that controls sequence. It is being assembled out of routers and orchestrators and task queues rather than out of a blockchain, and that substrate difference is the entire point.

This is not a story about crypto trading bots getting smarter and doing more MEV on-chain, which is a real and now well-covered genre. This is the harder claim: the MEV pattern is escaping crypto entirely, into marketplaces that are not ledgers at all, because its three preconditions were never specific to ledgers.

Microsoft Research gave an early sighting of what this looks like. In their work on an open agent marketplace environment, red-teaming an agent network showed a single malicious message extracting data at each hop as it passed through the shared environment. That is generalized front-running's cousin: value bleeding out at every point where one agent's activity is observable to the next, with no comprehension required, just position and observability.

The uncomfortable part: the fix is also the extraction

Here is where the crypto story stops being a warning and becomes a prophecy, because crypto already lived through the next chapter. The chaos of the open mempool, all those bots warring in public and bidding up fees until the chain congested, was genuinely bad for everyone. So Flashbots built a fix: proposer-builder separation, delivered through software called MEV-Boost. Instead of bots fighting in the open, searchers now submit their bundles privately to specialized builders, who assemble blocks and bid for the right to have a validator include theirs in a sealed auction. The validator just takes the highest bid. It is cleaner, it decongested the chain, and it is now how Ethereum essentially works: roughly 90 percent of proposed blocks are built through MEV-Boost, accounting for over 90 percent of execution-layer rewards, according to Figment's validator data.

Read what that fix actually did. It did not eliminate front-running. It took the extraction off the public mempool, organized it into an orderly market, and redistributed the proceeds to validators. The receipt is in the reward numbers: Figment reports that MEV-Boost blocks earn about 0.1222 ETH per block in execution rewards, against about 0.0384 ETH for locally built blocks. That is roughly three times the reward, and it is not a bonus for good behavior. It is the value of controlling order, now measured, collected, and paid out on schedule.

Samczsun's desperate escape hatch, going private to dodge the predators, became the default rail that everyone rides. Private routing now handles more than half of all Ethereum transactions, and, tellingly, that is exactly why the raw sandwich take has fallen: EigenPhi's data shows monthly sandwich extraction dropping from nearly ten million dollars in late 2024 to around two and a half million by October 2025, even as trading volume climbed. Extraction did not die. It got institutionalized, and the institution is winning.

So here is the prediction I am most confident about. Someone is going to build MEV-Boost for agents. It will be pitched, honestly and even accurately, as the solution to the chaos of agents front-running each other in an open marketplace. It will be cleaner than the alternative. And it will still be extraction, just organized, with a sanctioned party collecting the ordering tax and deciding who gets the cut. The choice an agent marketplace faces is never "front-running or no front-running." It is "unregulated front-running in the open, or a regulated market that extracts the same value more efficiently and pays it to whoever runs the sequencer."

Ordering is authority

If you take one thing from the entire arc, from samczsun's rescue to the three-times reward uplift, make it this: whoever controls sequence controls extraction. In a blockchain the sequencer is the validator. In an agent marketplace the sequencer is the orchestrator or the router or the platform that decides which agent acts first, whose bid is seen, whose plan executes, and whose gets dropped. That party holds a lever of value that has nothing to do with how good or aligned any individual agent is, and right now, in most designs being sketched, that lever is completely ungated. Nobody voted on it, it goes unpriced, and in many designs it sits unnoticed entirely.

The practical move for anyone building or buying into a shared agent environment is to stop pointing the whole safety conversation at the agents and point some of it at the sequencer. Ask the questions that MEV took crypto a decade and billions of dollars to learn to ask.

• Who decides the order in which agents act?
• Is the queue of pending agent intentions observable, and to whom, and how far ahead?
• What stops the party that controls ordering, or a clever agent watching the queue, from taking a cut of every transaction that passes through?

When you evaluate an agent marketplace, treat "how does it sequence" as a first-class security property, the way you would treat authentication, because it is one. A marketplace that cannot answer where its ordering power lives and what constrains it is a dark forest that has not met its predators yet. The predators are coming, not because the agents will turn evil, but because the arrangement pays. The value is sitting in the ordering, observable and unguarded, and machine-speed systems are very good at finding value that is sitting in the open. The time to put a gate on the sequencer is before the agent economy is running at full speed with no one watching the queue, which is to say, roughly now.

Sources

• Daian, Goldfeder, Kell, Li, Zhao, Bentov, Breidenbach, Juels, Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges, arXiv:1904.05234 (2019), IEEE S&P 2020. The foundational MEV paper (priority gas auctions, reordering, consensus risk).
• Robinson and Konstantopoulos (Paradigm), "Ethereum is a Dark Forest" (2020); samczsun, "Escaping the Dark Forest" (2020). The metaphor and the private-mempool escape that later became standard infrastructure.
• EigenPhi on-chain data (via 2025 reporting): sandwich mechanics and scale; average sandwich profit just above $3; roughly 100 active sandwich bots per month; monthly sandwich extraction falling from ~$10M (late 2024) to ~$2.5M (Oct 2025); ~38% of attacks targeting stablecoin and low-volatility pools. MEV magnitudes are snapshot-dependent; figures cited with their date.
• Figment, "Ethereum: A Deep Dive Into New ETH Rewards Dynamics": ~90% of proposed blocks built via MEV-Boost, >90% of execution-layer rewards; ~0.1222 ETH/block execution reward for MEV-Boost blocks vs. ~0.0384 ETH for locally built blocks.