How to Rewrite Internet Rules When Everyone Has an Indefatigable Agent

Written by: Cobo

Fast forward to 2028, you let your personal AI agent buy ingredients for soup. It keenly detects that the carrots at the local supermarket are 10 cents more expensive than the average price. In pursuit of a global optimal solution, it autonomously orchestrates the entire North American agricultural supply chain, nearly triggering a multinational trade dispute. In the end, it delivers the ingredients to your kitchen on time, saving you a total of 23 cents.

This slightly darkly humorous anecdote has recently circulated widely on Twitter. Its resonance on the platform stems from its precise articulation of an impending reality: AI agents can easily overexert themselves in pursuit of local optimal solutions.

The real-life counterpart of this anecdote recently unfolded in the United States.

JC Bahr-de Stefano, an investor at the venture capital firm Better Tomorrow Ventures, authorized his personal AI agent Instinct to monitor reservations at the notoriously hard-to-book steakhouse "4 Charles Prime Rib" in New York. In JC's vision, Instinct was supposed to act like a capable human assistant, refreshing the reservation platform Resy from time to time to catch any potential cancellations.

However, just a few hours later, JC received a permanent ban notification from Resy, and all future reservations under his name were canceled. JC later shared a screenshot of the ban email on Twitter with a wry caption: "Well done, Instinct."

To understand how he got banned, JC reviewed Instinct's operation logs. It was only then that the truth emerged: the digital assistant's efforts exceeded human imagination. It not only polled at a high intensity around the clock at a rate of about 200 times per hour but also thoroughly scanned the availability for the next 21 days every 10 minutes. During the peak release period at 9 AM, it even shortened the request interval to an astonishing 0.4 seconds, bombarding the system for two and a half minutes.

In the eyes of Resy's anti-fraud and risk control system, this was not a desperate diner but rather a small-scale DDoS attack or an unrestrained scalper's ticket-buying script. JC himself admitted that the ban was entirely reasonable.

This account of a ban due to "overexertion" may seem like a somewhat absurd case on the surface, but it is actually a prelude to a paradigm shift in technology. It not only exposes the current AI agents' rough and aggressive strategy execution but also reveals a deeper industry concern: when humans completely delegate the digital interfaces of daily life to 24/7 indefatigable AI agents, are the existing internet infrastructures and trust rules truly ready?

From "Talking to Me" to "Acting on My Behalf"

Behind this ban incident reflects an important shift in the current AI industry: AI is gradually breaking away from the single chat window form and evolving into an era of highly autonomous and executable intelligent agents.

In the daily experiences of most people, the boundaries of AI are still confined within a chat window: users ask questions, and AI provides answers. Even as the underlying large language models' intelligence continues to soar, this question-and-answer interaction paradigm has not changed, with AI playing the role of a passive knowledge base waiting for inquiries.

However, products like Instinct, developed by Noah Shinn, and Meta Muse, which garnered 730,000 downloads within five days of its launch, represent another product form that begins to take over execution directly.

Users can assign tasks just like messaging a real assistant: "Cancel unnecessary subscriptions," "Keep an eye on London flights, book if the price is right," "Help me book 4 Charles."

To accomplish these tasks, the new generation of agents has gained unprecedented system permissions: email, calendar, location, password credentials, and even payment tools. When encountering services without APIs, they can operate web pages and even directly call merchants.

Meta's Muse brings this capability to mainstream platforms. In just five days, it achieved 730,000 downloads. It is deeply embedded in Instagram and WhatsApp: recognizing dishes in Reels and generating shopping lists, reading group chat party plans, automatically handling menus, sending invitations, and splitting costs.

At the same time, Meta has opened Muse Connectors, allowing third-party developers to package Gmail, Calendar, Notion, Spotify, and e-commerce interfaces into standardized agent tools. With user authorization, Muse can autonomously schedule across services based on a vague natural language command: reading group chats to set up dinners, confirming gaps with Calendar, and completing purchases through reservation platforms. Muse Connector essentially uses structured protocols to continuously expand the range of actions agents can touch and operate.

However, as the agents' operational radius rapidly expands, they soon collide with traditional internet risk control rules, touching on design blind spots in the current internet security system.

When Platform Risk Models Meet AI Agents

Looking back at JC's experience, Resy's risk control system did not misjudge; it merely executed the standard logic established by the internet over the past twenty years: from CAPTCHA, device fingerprinting to IP frequency control, all security systems have long defaulted to a binary premise: behind the terminal is either a real person or a bot with malicious scripts.

Personal agents completely break this balance.

The high-frequency, round-the-clock, millisecond-level response behavior of agents is technically indistinguishable from malicious attacks; but in terms of contractual logic, it is backed by a real user who has complete informed consent and clearly delegates the task.

This misalignment raises a question: when traffic possesses both "complete legitimate user delegation" and "extreme machine characteristics," how should the platform define it? Does it belong to malicious attack behavior or is it an extension of legitimate user behavior?

If Resy's ban on the reservation agent was merely a single platform's routine defense against abnormal traffic, then Amazon's recent comprehensive ban on Meta Muse escalates this technical friction into an ecological game between platforms.

A few weeks after Muse launched its cross-platform purchasing feature, Amazon recently intercepted all access from Muse agent nodes, citing "unauthorized automated scripts" and security authorization issues, blocking the latter's purchasing loop. This game profoundly exposes a structural gap in the agent era: user authorization does not equate to platform authorization.

Users can certainly allow Muse to buy paper towels for them, but Amazon also has the right to refuse any unofficial machine identity access. For the e-commerce giant, the risk here is that the shopping entry and customer relationships face the danger of being hijacked by upper-level agents.

However, today's underlying internet protocols are clearly not prepared for such a complex dual relationship.

OAuth excels at defining what applications can access, and Rate Limit is good at limiting request frequency, but they cannot answer three deeper contextual questions: Who does this agent represent? Is it faithfully executing the user's immediate intent? Is the platform willing to accept this agency behavior?

Even if future identity verification issues are resolved, contradictions will remain unsolved. Resy can confirm 'this is JC's authorized agent,' and Amazon can recognize 'this is a Muse authorized by a user,' but the platform still has to make a choice: whether to allow countless millisecond-level responses, indefatigable agents to completely reconstruct their resource invocation logic—especially when these resources are already highly scarce.

When the "First Come, First Served" Model Begins to Fail

Reservations at popular restaurants, tickets for top concerts, last-minute discounted tickets, limited edition collectibles... For a long time, human society has relied on almost the same traditional rules to allocate these limited resources: inventory is limited, and opportunities belong to those who discover and act faster.

The reason this "first come, first served" mechanism can maintain balance is that it relies on an implicit threshold of time and effort: human attention and physiological limits are finite.

Most people will not refresh the reservation page for 72 consecutive hours, nor will they check flight prices every few seconds. Time, patience, and reaction speed form a natural filter. It may not be fair, but it effectively limits the number of times each person can compete.

However, when everyone is equipped with an intelligent agent, this physical buffer will vanish.

If everyone can have a program monitor dozens of targets around the clock and automatically submit requests the moment a vacancy is released, then first come, first served will quickly shift to whose agent responds faster, accesses deeper, can attempt more times, or even who has better interfaces and resources.

From competing human patience to competing machine computing power, the era of relying on physical friction to adjust supply and demand is completely over. Moving forward, platforms are likely to evolve in several directions:

• Continue to combat automation with more advanced detection methods. Employing more complex CAPTCHAs, stricter device fingerprint recognition, and more aggressive abnormal behavior scoring mechanisms. This method may be effective in the short term, but as agent programs become increasingly adept at simulating human browser behavior, this strategy will be hard to maintain.
• Build agent identity protocols. Establishing identity verification and rate limiting mechanisms for agents so that platforms can not only identify that a certain account is sending requests but also confirm that this is JC's authorized agent, querying availability within its permitted scope. This is essentially an extension of the OAuth model, adding a layer that can record authorization delegation and operational permission scope. This can mitigate the misuse of risk control but still does not answer how scarce resources should be allocated.
• Function internalization: building a native intention collection layer. Rather than allowing thousands of external agents to poll servers at millisecond frequencies, platforms might as well proactively hand over interfaces and establish a native intention collection layer. Users no longer need to rush; they just need to issue long-term instructions: any Friday night for two within the next month. The platform will internally unify matching and allocation through rules such as lottery, loyalty points, or fulfillment credit.
• Move towards complete price discovery, i.e., market-based auctions, allowing dynamic pricing to take over scarcity. For truly scarce inventory, dynamic pricing or bidding mechanisms can allow the market to complete resource allocation on its own. Agents are very good at automated bidding within preset budgets; they can continuously evaluate prices based on users' established preferences and budgets and automatically complete transactions when conditions (such as cost-effectiveness) match. The trade-off of this approach is that it directly links the ability to acquire resources to the user's willingness to pay, raising questions about the fairness of resource allocation.

In practical terms, the ultimate form of the future is likely to be a combination of various mechanisms: formal agent identity authentication for machine access, native preference matching mechanisms for ordinary inventory, and clearer allocation mechanisms (such as queuing, lottery, or dynamic bidding) for high-demand goods. Changes have occurred and are irreversible. Platforms must proactively choose and implement these new rules rather than fantasizing about relying on human-operated physical friction to implicitly adjust supply and demand.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.