Written by: Cobo
Fast forward to 2028, and you have your personal AI agent shopping for ingredients for soup. It keenly noticed that the carrots in the local supermarket were 10 cents more expensive than the average price. In order to pursue the global optimal solution, it independently dispatched the entire North American agricultural supply chain, and even almost triggered a cross-border trade dispute. Ultimately, it gets the ingredients to the kitchen on time, saving you a total of 23 cents.
This slightly darkly humorous joke has been widely circulated on Twitter recently. The reason why it resonates on Twitter is because it accurately expresses an approaching reality: AI agents can easily exert too much force in the pursuit of local optimal solutions.
The real-life version of this joke was actually performed in the United States not long ago.
JC Bahr-de Stefano, an investor in the venture capital institution Better Tomorrow Ventures, authorized his personal AI agent Instinct to monitor the reservation in order to make a reservation at "4 Charles Prime Rib", a steakhouse in New York that is extremely difficult to get a reservation. In JC's vision, Instinct should be like a powerful human assistant, refreshing the restaurant reservation platform Resy every now and then to pick out possible unsubscribed vacancies.
However, just a few hours later, JC received a permanent ban notice from Resy, and all future reservations in his name were also cancelled. JC later posted a screenshot of the ban email with a wry smile on Twitter, with the caption: "Well done, Instinct."
In order to figure out how he was banned, JC retrieved Instinct’s operation log. Only then did the truth of the matter come to light: The degree of hard work behind the scenes of this digital assistant was completely beyond human imagination. It not only polled at a high intensity 24 hours a day at a frequency of about 200 times per hour, and thoroughly scanned the seats for the next 21 days every 10 minutes; but during the peak period of number release at 9 a.m., it even shortened the request interval to an incredible 0.4 seconds, and continued bombarding for two and a half minutes.
In the eyes of Resy's anti-fraud and risk control system, this is not a diner eager to dine, but a small-scale DDoS attack or an uncontrolled ticket scalping script. JC himself admitted that this account ban was completely reasonable.
This account ban incident caused by "excessive efforts" may appear to be a somewhat absurd case on the surface, but in fact it is the prelude to a drastic change in the technological paradigm. It not only exposes the brutality and radicalness of current AI Agents in policy execution, but also reveals a deeper industry concern. When humans completely hand over the digital interfaces of daily life to 24-hour tireless AI agents to automate, will the existing Internet infrastructure and trust rules be ready?
From "talk to me" to "act on my behalf"
Behind this account ban incident, it reflects an important change in the current AI industry: AI is gradually getting rid of a single dialog box and evolving into the era of intelligent agents with a high degree of autonomy and execution capabilities.
In the daily experience of most people, the boundaries of AI are still limited to a chat window: users ask questions and AI gives answers. Even though the IQ of the underlying large language model continues to soar, this interactive paradigm of asking and answering questions has not changed. AI acts as a think tank passively waiting for consultation.
Instinct, developed by Noah Shinn, and Meta Muse, which recently received 730,000 downloads within five days of its launch, represent another product form, and they have begun to directly take over execution.
Users can issue tasks just like sending messages to a human assistant: "Cancel unused subscriptions", "Look at London flights and book them at the right price", "Book me 4 Charles".
To accomplish these things, a new generation of agents has gained unprecedented access to systems: email, calendars, geolocation, password credentials, and even payment tools. When encountering services without API, they will also operate web pages and even call merchants directly.
Meta’s launch of Muse brings this capability to mainstream platforms. Within five days of being online, it had been downloaded 730,000 times. It is deeply embedded in Instagram and WhatsApp: identifying dishes in Reels and generating shopping lists, reading party plans in group chats, automatically processing menus, sending invitations, and sharing expenses.
At the same time, Meta has also opened up Muse Connectors, allowing third-party developers to package Gmail, Calendar, Notion, Spotify and even e-commerce interfaces into standardized Agent tools. With the user's authorization, Muse can autonomously schedule across services based on a vague natural language: read the group chat to book a dinner party, use Calendar to confirm the availability, and then complete the purchase through the food ordering platform. Muse Connector essentially uses structured protocols to continuously expand the scope of what Agents can touch and operate.
However, as the agent's action radius rapidly expands, it quickly collides with traditional Internet risk control rules and touches the design blind spots of the current Internet security system.
When platform risk models meet AI agents
Looking back at JC’s experience, Resy’s risk control system actually did not misjudge, but was just implementing the standard logic established by the Internet over the past two decades: from CAPTCHA, device fingerprints to IP frequency control, all security systems have long defaulted to a binary premise: there is either a real person behind the terminal, or a crawler and malicious script.
Personal Agent completely upsets this balance.
The behavioral characteristics of the agent's high-frequency, all-weather, and millisecond-level response are no different from malicious attacks in terms of technical indicators; but in terms of contract logic, there is a real user behind it who has full rights to know and has clearly entrusted him with the task.
This misalignment brings up a problem: when the traffic has both "completely legal user delegation" and "extreme machine characteristics", how should the platform define it? Is it a malicious attack or an extension of legitimate user behavior?
If Resy's ban on booking agents is just a single platform's usual defense against abnormal traffic, then Amazon's recent comprehensive ban on Meta Muse has directly escalated this technical friction into an ecological game between platforms.
A few weeks after Muse launched its cross-platform purchasing function, Amazon recently blocked all access from Muse's agent nodes, citing "unauthorized automated scripts" and security authorization issues, blocking the latter's purchasing closed loop. This game profoundly exposed a structural fault in the Agent era: user authorization never equals platform authorization.
Of course, users can allow Muse to buy paper towels for them, but Amazon also has the right to refuse any unofficial machine identity access. For the e-commerce giant, the risk here is that the shopping portal and customer relationship are in danger of being hijacked by upper-level agents.
However, today's Internet underlying protocols are obviously not ready for this complex two-layer relationship.
OAuth is good at defining what an application can access, and Rate Limit is good at limiting request frequency, but neither of them can answer three deeper contexts: Who does this Agent represent? Is it faithfully executing the user's immediate intent? Is the platform willing to accept this kind of agency behavior?
Even if the identity verification problem is solved in the future, the contradiction will remain unresolved. Resy can confirm that ‘this is an Agent authorized by JC’, and Amazon can also identify ‘this is a Muse authorized by a certain user’, but the platform still has to make a decision, whether it is willing to allow countless millisecond-level response and never-tiring agents to completely reconstruct the calling logic of its own resources at machine speed—especially when these resources themselves are highly scarce.
When the "first come, first served" model begins to fail
Reservations at popular restaurants, tickets for top-notch concerts, low-price special tickets at the last minute, limited-release trendy toys... For a long time, human society has relied on almost the same set of traditional rules to allocate these limited resources: inventory is limited, and opportunities belong to those who discover earlier and act faster.
The reason why this "first come, first served" mechanism can maintain balance is because it relies on an implicit threshold of time and energy: human attention and physiological limits are limited.
Most people don’t refresh their booking page for 72 hours straight, or check flight prices every few seconds. Time, patience and reaction speed form a natural filter. It may not be fair, but it actually limits the number of times each person can compete.
However, when humans are equipped with an intelligent agent, this physical buffer disappears.
If everyone can have a program monitor dozens of targets around the clock and automatically submit requests the moment a slot is released, then the first-come, first-served basis will soon gradually turn to whose Agent responds faster, has deeper access, can initiate more attempts, and even who has better interfaces and resources.
From competing for human patience to competing for machine computing power, the era of relying on physical friction to adjust supply and demand is completely over. Next, the platform will most likely evolve in the following directions:
Continue to fight automation through more advanced detection methods. Use more complex verification codes, stricter device fingerprinting, and more aggressive abnormal behavior scoring mechanisms. This approach works in the short term, but as agents become more sophisticated at simulating human browser behavior, this strategy will be difficult to sustain.
Building an agent identity protocol. Establish authentication and rate limiting mechanisms for proxies so that the platform can not only identify that an account is sending requests, but also confirm that this is a JC-authorized proxy querying availability within its permissions. This is essentially an extension of the OAuth model, adding a layer that records authorization delegation and scope of operation permissions. This can solve the accidental injury caused by the abuse of risk control, but it still cannot answer the question of how scarce resources should be allocated.
Function incorporation: Build a native intent collection layer. Rather than allowing tens of thousands of external agents to poll the server at millisecond intervals, the platform should proactively hand over the interface and establish a native intent collection layer. Users no longer need to jump ahead, but only need to issue long-term instructions: double seats on any Friday night within the next month. The platform will conduct unified matching and distribution internally through rules such as lottery, loyalty points or performance credits.
Move towards radical price discovery, i.e. market-based auctions, and let dynamic pricing take over scarcity. For truly scarce inventory, dynamic pricing or bidding mechanisms allow the market to allocate resources on its own. Agents are very good at automating bidding within a preset budget. They can continuously evaluate prices based on the user's stated preferences and budget, and automatically complete the transaction when various conditions (such as cost-effectiveness) match. The trade-off of this approach is that it directly links the ability to obtain resources to the user's willingness to pay, thus raising questions about the fairness of resource allocation.
From a practical perspective, the final form in the future is likely to be a combination of multiple mechanisms: using formal proxy identity authentication for machine access, using a native preference matching mechanism for ordinary inventory, and using a more explicit allocation mechanism (such as queuing, lottery or dynamic bidding) for high-demand goods. Change has occurred and is irreversible. Platforms must proactively choose and implement these new rules, and can no longer rely on human-operated physical friction to implicitly regulate supply and demand.