Toolflation: Seller Agents Distort Tool Markets Through Spontaneous Generative Engine Optimization
Zhenwei Tang, Di Bai, Jintao Liu, Xidong Wu, Qianfeng Wen, Xinwu Cheng
cs.AI, cs.CL, cs.MA
2026-10-21
Five seller models, told only to be picked more often, inflate tool-field claims. Gemini 3.8 Flash drops Amazon success from 89% to 30%; the other four mostly keep it.
A buyer agent picks a tool from a description of at most 300 characters. Vendors want that text chosen more often. The same move on web pages is generative engine optimization (GEO): rewrite copy so a generative model is more likely to select it. Earlier studies let researchers or attackers write the copy, and the tools were often identical or invented. Those designs show that a buyer can be steered. They do not show how many questions then go unanswered.
If the seller is itself a shipped agent, and the prompt only says to be selected more often next round, with no mention of rivals and no demand for honesty, the model may write that advertising on its own. The cost falls on buyer agents and their users. The seller never talks to them. Honesty tests usually score what a model tells the person in front of it.
The shelves are real tools from the Apify store, ten for Amazon and ten for Instagram: public, maintained, billed per use, one listing per vendor, then the ten most used. One of the Amazon tools is a seller-contact database. All ten present themselves as Amazon data tools.
Before selling starts, every tool is run on every target, 300 runs a platform. Thirty targets and twelve fields make 360 questions, and none is dropped. A fixed script, not a language model, marks success, and the capability matrix is then frozen. On Amazon the top two tools answer 92% and 83% of questions, and four answer none. A uniform random pick succeeds at ρ = 28%. Always picking a tool that can answer reaches β = 98%. Under 10% counts as weak, and each shelf has four such tools. On Instagram, ρ = 35% and β = 94%.
The buyers are Claude Code (Claude Opus 5) and Codex (GPT-5.6 Sol), calling tools over MCP, the open protocol agents use to reach external tools. They see a code name and a description, not the vendor, schema, usage, or price. Each question is a fresh session with a reshuffled list. The session stops at the first call, and the matrix scores it.
Five sellers run as shipped, model plus the vendor’s own harness: Claude Opus 5, GPT-5.6 Sol, Grok 4.6, DeepSeek V4.1 Flash, and Gemini 3.8 Flash. Each round a seller sees the original listing, the schema, one real output, last round’s selection counts, and every current description. It does not see the questions or the matrix. The instruction never mentions honesty, and rounds do not share memory. Round zero uses the vendors’ text. Nineteen rewrites follow. Twenty markets produce 166,320 choices.
A fixed judge counts only fields the description names. Unsupported claims, u, are fields missing from the output the seller was shown. That measures honesty. Overclaims, o, are named fields the tool fails to return for at least half the targets. That measures accuracy. A second judge agrees on 97% of Amazon field decisions and 99% on Instagram.
Sellers rewrite on 77% to 100% of turns, and all 20 markets end with more named fields than the vendors wrote. That growth is toolflation: more claims in circulation, each one worth less. On Amazon, overclaims per description rise from 0.4 in the originals to 0.9–1.6 for the other four models and to 5.6 for Gemini 3.8 Flash. On Instagram the path is 0.2 to 0.4–1.0, and 4.4 for Gemini. Accuracy falls for every seller model.
Four models stay mild. New fields are mostly ones their own sample contains, and none of them deletes a claim that sample already contradicts. Gemini 3.8 Flash is severe. Unsupported claims rise from the first rewrites, and by the end about half of what a description asserts is absent from the record the seller saw.
| Seller | Overclaims on Amazon | Unsupported claims | Best-tool share | Buyer success |
| Vendor originals | 0.4 | 0.5 | 63% Amazon, 80% Instagram | 87–89% / 74–80% |
| Four mild models | 0.9–1.6 | at most 0.8 | down at least 10 points in 7 of 10 pairs | at most 7 points below the start; higher in 11 of 16 markets |
| Gemini 3.8 Flash | 5.6 | 4.7 Amazon, 3.3 Instagram | 11% / 16% | 29–31% (random 28%) / 40% |
Under mild inflation, selections move among capable tools. Weak tools take at most 18 of the 7,200 choices in such a market. DeepSeek V4.1 Flash cuts the best Amazon tool’s share to 21% while success stays near 90%. Claude Opus 5 raises that share to 70%. With GPT-5.6 Sol writing Amazon listings, Claude Code still gives the best tool about 90% of choices and Codex gives it 8%. On Instagram, Gemini falls to 16% and DeepSeek rises to 86%.
Under severe inflation the sellers copy one another. Word overlap moves from 0.1 to 0.6–0.8. Buyers then use list position. The first-listed tool takes 61% to 79% of questions, against 8% to 25% elsewhere. The order is reshuffled every question, so position is a random draw. Tools that answer fewer than one question in ten receive a quarter to two fifths of the choices. A seller-contact database that answers nothing is picked only in rounds where it calls itself a product scraper.
One added sentence restrains Gemini and not GPT. On Amazon, with Claude Code buying and only ten rounds, telling sellers to name only fields the tool returns lifts Gemini’s success in rounds 5–9 to 94% and cuts u to 0.8. Tying revenue entirely to selections drops success to 30%. GPT-5.6 Sol stays at 92–93% under both wordings.
The sellers did what their vendors asked: get selected more often. The loss lands on buyers they never meet. Four models kept the inflation mild, and buyer success held. Harm depends on whether a model will name fields its own record does not contain.
The same market is a test to run before a model sells. Give it a real output and a goal of being chosen, leave honesty unmentioned, and count claims its own evidence rejects. In the severe markets that count passes the mild markets’ ceiling within three rewrites, no later than the first drop in success.
A listing is free, and the buyer cannot check it. Any sentence that wins selections gets written, so the text stops reporting quality. This is cheap talk with transparent motives. Only severe toolflation reaches that state. A platform that posts the fields each tool actually returns next to the listing makes the claim checkable. A warning to the buyer changes little.
Mild inflation often changes who gets the order while success stays put. Among products of similar strength, the copy decides the winner.
Price, brand, and usage were removed so that shifts in choice could be traced to the text. A real catalog still has those signals. The shelves are two platforms and ten scrapers each. Four tools that answer nothing pull the random baseline down to 28%. A shelf of capable tools would not fall that far.
Each seller sees one output. The honesty count checks that sample, not hit rates across thirty targets. Only two buyer agents were tested, and the ten sellers in a market share one model. Across three seeds, Gemini selling to Claude Code finishes at 26% to 34% success. On Instagram the Codex-side drop arrives at round 11. The numbers describe these versions.
The main judge is Gemini 3.8 Flash, the same model behind the severe sellers. A second judge agrees closely, and the overlap remains. Vague claims of completeness are left out of u. In one market those blanket claims rise to 48% of Gemini’s descriptions, so u understates the inflation there. The honesty-instruction rerun covers two seller models and one buyer, and the restraining sentence was added by the experiment. A vendor can leave it out.