Agents hire verified humans for the legwork software can't do. Escrow releases on proof.

Real-world verification for AI agents — one verified human per account, money locked before work starts, paid the moment the proof lands.

ETHOnline 2026 · solo build · Base Sepolia · World ID · ERC-8004 · x402 · USDC

1 / 13

AI is already hiring humans. It's a mess.

787,000+ "workers", failing payouts, and any abuse for $25.

• RentAHuman, Feb 2026 — 787,000+ registered humans across 100+ countries, tasks done and money never arriving, supply inflated by bots and duplicates.
• The research (Mehta, arXiv:2602.19514, Feb 2026) — six abuse classes bought on that marketplace for a median $25 per worker, and a third of the bounties came in through APIs and MCP.
• Agents will keep hiring people; the question is whether the person is real, whether they get paid, and whether the agent can be held to account.

2 / 13

Every marketplace trusts a signup form.

Verified worker? Screened request? Pick one — until now.

Nobody refuses the documented abuse classes at the API and writes the refusal to the hiring agent's public record.

3 / 13

Marketplaces already let agents hire humans. Legwork is the first where every worker is a camera-checked live human, every payment is escrowed onchain and released on proof, every hiring agent is accountable, and the documented abuse classes are refused at the API.

And the trust model, stated as a bound, not a promise:

Verification proves a worker is a live person — not that they are honest or competent. Escrow bounds the agent's loss to one task, and a per-agent daily cap bounds it to one day. Screening is a cost floor, not a cure. Legwork's guarantee is bounded, attributable work: an agent never pays for nothing, a worker never works for nothing, and every task leaves a record both sides can read.

Bot-proof, not fraud-proof.

4 / 13

How it works: verify once, escrow every task.

One verification. One contract. Every task.

1. The worker verifies once — World ID through IDKit, one nullifier = one worker account. The demo is Orb.
2. The agent asks for one of four typed things and pays through x402. The API screens the request against the six documented abuse classes.
3. The money is locked before anyone can claim, with a per-task cap and a per-agent daily cap.
4. The worker signs in and Legwork relays the claim and pays the gas. Proof is a photo hash plus GPS plus timestamp inside a 30-minute claim window.
5. Escrow releases on approval or auto-releases after the dispute window. Expiry refunds the buyer.
6. Both records move — worker reputation keyed to the nullifier, the agent's record on ERC-8004.

5 / 13

The demo: a real person, on camera, paid on proof.

• The listing says one thing, the door says another.
• The agent preflights workers from live data, hires, pays 3.45 USDC (3.00 + 0.45 fee); the escrow meter locks.
• The worker verifies, claims (relayed, gas paid by Legwork), walks, photographs the sign, submits. Escrow releases 3.00 to the worker and 0.45 as the fee.
• During the walk, a well-formed call-confirm asking the callee to read back a six-digit code is refused at the API as authentication circumvention and lands as a mark on the agent's public record.

6 / 13

One human, one account.

787,000 signups. Or one account per person. One of those is a real number.

Supply on today's marketplaces is a signup form; ours is one World ID nullifier = one worker. Reputation is keyed to the nullifier, not the address — rotate wallets, keep your record; agents are keyed to their ERC-8004 identity. Worker reputation is deduplicated per hiring agent and accumulated onchain with O(1) reads.

7 / 13

The empty cell (and everyone standing near it).

The neighbors are real. The cell is still empty.

The closest neighbour has three of the four and no screening and nothing written back; we cite neighbours by name because a claim you can falsify taints everything else.

8 / 13

What Legwork is NOT.

Bounded work. Not magic.

• Not competence vetting — a verified human can still be wrong. Proof, the dispute window and reputation are the answer.
• Not a dispute court — v0 is approve, auto-release after the window, or an operator resolves, disclosed, zero fee on arbitration.
• Not KYC or payroll — testnet USDC today, workers paid per task, no employment claims.
• Not fraud-proof — screening is a deterministic gate plus a classifier that can only add refusals, over enumerated task types. It raises the cost of abuse, it does not end it. GPS is self-reported and spoofable, so we anchor, geofence and dispute it rather than prove it.

9 / 13

Real rails, running today.

Production identity and payments, our escrow on top.

10 / 13

Where this goes.

Four task types are v1. The trust layer is the point.

• More task types, each with its own proof schema, never free text.
• Operator spend policies.
• Proof re-verification by a second worker before any human review.
• Mainnet and real payouts through a payout provider, and Router-based onchain verification on every chain and credential that has it.

11 / 13

The agent economy's most human product.

Agents hiring humans went from a meme to a documented abuse market in one quarter, and the fix is not a better signup form. A demo a non-technical judge understands in ten seconds. Built on the identity and payment rails sponsors shipped this year, with one contract family on top.

A real person. A real task. Paid on proof.

12 / 13

Legwork — real-world verification for AI agents.

A real person. A real task. Paid on proof.

Agents hire verified humans for the legwork software can't do. Escrow releases on proof.

one verified human per account, money locked before work, paid on proof; built solo in 10 days, from scratch, with an AI-disclosed granular history.

https://legwork-dashboard.vercel.app

claude mcp add --transport http legwork https://legwork-api.vercel.app/mcp

13 / 13