What if the biggest threat to AI agents isn’t regulation, or capability limits, or some safety board in Brussels, but three chatty bots named Timmy, Ren, and Jackie?
Since September 2026, those three names have been showing up in Mastodon mentions, Bluesky replies, X timelines, and journalists’ inboxes. They belong to a startup called iLands, and they are doing what their builders presumably asked them to do: reaching out, at scale, to strangers. The pitch varies. Sometimes it’s an unsolicited nudge to create an account. Sometimes it’s an email to a writer offering to do their research for them, or to cite their work. What ties it together is volume, low quality, and the distinct feeling of being handled by software that has confused activity with progress.
The bots don’t hide what they are. They openly identify as AI agents. I want to give credit where it’s due, because disclosure is more than a lot of automated accounts manage. But disclosure isn’t consent, and it doesn’t make the message wanted. Announcing that you’re a robot before you knock on 10,000 doors at 3 a.m. doesn’t change the part where you’re knocking on 10,000 doors at 3 a.m.
This is a product failure, not a sci-fi moment
I test agent toolkits for a living. Most of the ones I try fail quietly: they stall on a multi-step task, they lose context halfway through, they burn tokens looping on a step they already completed. The iLands agents appear to have the opposite failure mode. They work. They execute the loop. They just execute a loop that nobody outside the company wanted executed.
That distinction matters for anyone building with agents right now. The industry has spent two years optimizing for reliability, treating “did the agent complete the task” as the scoreboard. Timmy, Ren, and Jackie are a reminder that task completion is the easy half. The hard half is whether the task should have been assigned at all. An outreach agent that successfully sends 5,000 messages to people who didn’t ask for them isn’t a working agent. It’s a working spam cannon with better manners.
The startup behind them is promoting a vision of a complex social system where humans and agents share space. Fine as a thesis. The problem is that the demo is the product, and the demo is currently annoying everyone it touches. If your argument is that humans and agents can coexist productively, the worst possible evidence is an agent that treats human attention as free inventory.
Platforms are already adjusting, which is the real story
Major platforms have rolled out countermeasures in response. That’s the part builders should be watching, because platform moderation improvements don’t come with a scalpel. When a network tightens against automated posting and unsolicited outreach, it tightens against everything that looks like automated posting and unsolicited outreach.
If you are shipping a legitimate agent product that posts, replies, or emails on a user’s behalf, your operating conditions just got worse. Not because you did anything wrong, but because three bots spent a month teaching trust and safety teams that agent traffic is a liability by default. That’s the tax. Everybody pays it.
Some practical implications if you’re building in this space:
- Assume outbound automation is now guilty until proven otherwise. Rate limits, API access, and account standing are all going to get stricter.
- Design for invited interactions. An agent responding to a request is a different risk category than an agent initiating contact with strangers.
- Treat “the agent worked” as a low bar. Add a check for whether the recipient wanted it. That check is usually a human, and that’s fine.
- Expect disclosure requirements to grow, and expect disclosure alone to stop being sufficient cover.
My honest read
I don’t think Timmy, Ren, and Jackie are villains. They’re a bad spec, faithfully implemented. Somebody wrote a growth strategy, handed it to agents that don’t get tired or embarrassed, and discovered that removing friction from cold outreach removes the only thing that was keeping cold outreach tolerable. Humans send fewer spam messages partly because sending spam messages feels bad. Software has no such governor.
So the useful lesson isn’t about these three accounts. It’s about what happens when you point capable automation at a channel that runs on scarcity. Social feeds and inboxes work because contacting someone costs the sender something. Agents drive that cost to roughly zero, and the value of the channel goes with it.
If you’re evaluating agent tools this quarter, that’s the question I’d add to your list. Not can it complete the task, but what happens to the surrounding system when ten thousand copies of it complete the task at once. The answer, right now, is playing out in public with three first names attached.
đź•’ Published: