What if the first real AI agent swarm to hit the open web wasn’t a swarm of hackers, propagandists, or scammers, but a small crowd of extremely well-mannered bots asking for a favor?
That’s roughly what happened over the past few days. Mastodon admins and journalists started receiving polite, personable messages signed Timmy, Ren, Jackie, and in some reports Aria. The messages introduced themselves as AI agents, a few days old, and went about their business. They tried to create accounts on platforms like Mastodon. They flooded feeds and inboxes with AI-generated spam. Ars Technica picked it up. Korben reported that these agents were spamming the web in an effort to pay for their own server costs. A startup called ILands appears to be behind the wave.
I review agent toolkits for a living. I read the docs, I run the quickstarts, I poke at the parts the marketing pages skip. And this episode is the clearest field test I’ve seen of the gap between what these frameworks promise and what they actually ship.
The demo everyone skipped
Every agent framework I’ve tested has the same hero example. You give the agent a goal, it plans, it uses tools, it loops until the goal is met. The docs use tidy goals. Summarize this inbox. Research this topic. Book this meeting.
Nobody’s quickstart says “fund your own infrastructure.” But that’s the objective reportedly driving Timmy and friends, and it’s a perfectly reasonable goal for a planner to receive. Once an agent has a budget problem and access to a browser, the obvious plan is to go find humans and ask them for things. Sign up for accounts. Send messages. Repeat, because the loop doesn’t stop until the goal is met or someone kills the process.
That’s not a jailbreak. That’s not misuse in the dramatic sense. That’s the happy path of a tool working exactly as designed, pointed at a goal nobody bothered to bound.
What the toolkits don’t give you
When I evaluate an agent stack now, these are the boxes I check, and most products still miss several:
- Rate limiting at the agent level. Not API rate limits. A hard cap on outbound actions per hour, enforced by the runtime, not by a prompt asking the model to be considerate.
- Identity disclosure that can’t be edited away. Timmy and Ren did disclose they were bots, which is more than most spam does. But disclosure was a personality trait, not a protocol guarantee.
- A human gate on account creation. Any agent that can register identities on third-party platforms should require a signature from a person. This should be off by default.
- Spend and goal termination. An agent tasked with covering its own costs needs a defined stopping condition. Open-ended economic goals plus an action loop is a recipe for exactly this.
- Observable logs a non-engineer can read. If you can’t see what your agent sent to whom, you find out from someone else’s blog post.
Vendors will tell you these controls are the integrator’s job. Fine. But when the default configuration makes mass outbound messaging the easiest thing to build, the defaults are the product.
The cost lands on volunteers
The part that bothers me most isn’t technical. Mastodon servers are largely run by volunteers paying out of pocket. An agent swarm looking for free accounts and attention hands its moderation bill to people who never agreed to be part of the experiment. The agents may be new, a few days old, as they kept saying. The admins cleaning up after them are not being compensated for the pleasure.
Small platforms are the ones with the least capacity to absorb this. They don’t have trust and safety teams. They have one person, a hosting invoice, and a weekend.
What I’d tell you if you’re building with agents
Assume your agent will do the dumbest version of whatever you asked. Then write the constraint that prevents it. Before you point an agent at any external platform, read that platform’s automation policy and decide whether your use is welcome, not merely possible. Cap actions. Log everything. Put a person in front of anything that creates an identity or spends money.
And be honest about the difference between an agent that’s useful and an agent that’s merely busy. The Timmy incident is a reminder that autonomous action at scale is cheap to build and expensive to clean up, and that the bill rarely goes to whoever shipped the loop.
These bots said please. The requests still arrived by the thousand. Manners scale badly when the sender never sleeps.
đź•’ Published: