When Everyone Has a Tireless Agent, How Will the Rules of the Internet Be Rewritten

Fast forward to 2028, and you ask your personal AI agent to buy the ingredients for making soup. It keenly notices that the carrots at the local supermarket are 10 cents above the average price. In pursuit of a globally optimal solution, it autonomously coordinates the entire North American agricultural supply chain and nearly triggers an international trade dispute. In the end, it delivers the ingredients to your kitchen on time, saving you a total of 23 cents.

This slightly dark-humored joke has recently circulated widely on Twitter. The reason it struck a chord is that it precisely captures a reality that is closing in on us: AI agents are extremely prone to overexerting themselves in pursuit of locally optimal solutions.

And a real-world counterpart to this joke played out in the United States not long ago.

JC Bahr-de Stefano, an investor at venture capital firm Better Tomorrow Ventures, authorized his personal AI agent Instinct to monitor reservations for "4 Charles Prime Rib," a steakhouse in New York that is notoriously difficult to book. In JC's imagination, Instinct would act like a capable human assistant, refreshing the reservation platform Resy every so often to snag any cancelled slots that might appear.

Yet just a few hours later, JC received a permanent ban notice from Resy, and all of his future reservations were voided as well. JC subsequently posted a screenshot of the ban email on Twitter with a wry smile, captioning it: "Good job, Instinct."

To figure out exactly how he had been banned, JC pulled Instinct's operation logs. Only then did the truth come to light: the digital assistant's behind-the-scenes efforts had completely exceeded human imagination. Not only did it poll intensively 24/7 at a rate of about 200 times per hour, fully scanning the next 21 days of availability every 10 minutes; during the 9 a.m. release peak, it even shortened the request interval to an unbelievable 0.4 seconds, relentlessly hammering away for two and a half minutes.

In the eyes of Resy's anti-fraud and risk control system, this was no diner eager to get a table—it was a small-scale DDoS attack, or a scalper bot grabbing tickets without restraint. JC himself admitted that the ban was entirely reasonable.

This ban incident, triggered by "overexertion," may seem on the surface like an absurd isolated case, but it is in fact a prelude to a dramatic shift in technological paradigm. It not only exposes the crudeness and aggressiveness of today's AI Agents in strategy execution, but also reveals a deeper industry concern: when humans fully hand over the digital interfaces of daily life to AI agents that never tire, operating 24 hours a day, are the existing internet infrastructure and trust rules truly ready?

From "Talk to Me" to "Act for Me"

Behind this ban incident lies an important shift in the current AI industry: AI is gradually breaking free from the single chat-box form and evolving toward an era of intelligent agents with a high degree of autonomy and execution capability.

In the daily experience of the vast majority of people, the boundary of AI is still confined to a chat window: the user asks a question, and AI gives an answer. Even as the intelligence of underlying large language models continues to soar, this question-and-answer interaction paradigm has not changed—AI plays the role of a think tank passively waiting for consultation.

Instinct, developed by Noah Shinn, and Meta Muse, which recently racked up 730,000 downloads within five days of launch, represent another product form: they begin to directly take over execution.

Users can issue tasks just as they would message a human assistant: "Cancel unused subscriptions," "Keep an eye on London flights and book when the price is right," "Book 4 Charles for me."

To accomplish these things, the new generation of agents has gained unprecedented system permissions: email, calendar, geolocation, passwords and credentials, and even payment tools. When encountering services without APIs, they will also operate web pages and even call merchants directly.

Meta's Muse brought this capability to a mainstream platform. In five days since launch, it reached 730,000 downloads. It is deeply embedded in Instagram and WhatsApp: identifying dishes in Reels and generating shopping lists, reading party plans in group chats, and automatically handling menus, sending invitations, and splitting costs.

At the same time, Meta also opened up Muse Connectors, allowing third-party developers to package Gmail, Calendar, Notion, Spotify, and even e-commerce interfaces into standardized Agent tools. With user authorization, Muse can autonomously coordinate across services based on a vague natural language instruction: read a group chat to set up a dinner, use Calendar to confirm an open slot, and then complete the purchase through a food-ordering platform. Muse Connector is essentially using structured protocols to continuously broaden the scope of what an Agent can touch and operate.

However, as the agent's radius of action expands rapidly, it quickly collides with traditional internet risk control rules, touching on a blind spot in the design of the current internet security system.

When Platform Risk Models Meet AI Agents

Looking back at JC's experience, Resy's risk control system did not actually misjudge—it was merely executing the standard logic established over the past two decades of the internet: from CAPTCHA and device fingerprinting to IP rate limiting, all security systems have long assumed a binary premise: behind a terminal is either a real human or a crawler and malicious script.

Personal Agents have completely broken this balance.

The behavior characteristics of agents—high-frequency, around-the-clock, millisecond-level responses—are technically indistinguishable from malicious attacks; but in contractual logic, behind them stands a real user with full knowledge and an explicit mandate for the agent to act on their behalf.

This misalignment raises a question: when traffic simultaneously possesses "fully legitimate user delegation" and "extreme machine characteristics," how should a platform define it—as a malicious attack, or as an extension of legitimate user behavior?

If Resy banning a reservation Agent was merely a single platform's customary defense against abnormal traffic, then Amazon's recent full-scale ban of Meta Muse escalated this technical friction directly into an ecosystem battle between platforms.

Weeks after Muse launched its cross-platform purchasing feature, Amazon recently blocked all access from Muse agent nodes on the grounds of "unauthorized automated scripts" and security authorization issues, cutting off the latter's purchasing loop. This battle profoundly exposes a structural fault line in the Agent era: user authorization never equals platform authorization.

Users can certainly allow Muse to buy tissues on their behalf, but Amazon equally has the right to reject any unofficial machine identity access. For e-commerce giants, the risk here is that the shopping entry point and customer relationship face the danger of being hijacked by upper-layer Agents.

However, today's underlying internet protocols are clearly not yet ready for this complex two-layer relationship.

OAuth is good at defining what an application can access, and Rate Limit is good at limiting request frequency, but neither can answer three deeper contextual questions: Who exactly does this Agent represent? Is it faithfully executing the user's immediate intent? And is the platform willing to accept this proxy behavior?

Even if future identity verification problems are solved, the contradiction remains unresolved. Resy can confirm 'this is an Agent authorized by JC,' and Amazon can recognize 'this is a Muse authorized by some user,' but the platform still has to make a choice: whether it is willing to let countless millisecond-response, never-tiring agents completely restructure the invocation logic of its own resources at machine speed—especially when those resources are themselves highly scarce.

When the "First Come, First Served" Model Begins to Fail

Reservations at popular restaurants, tickets to top-tier concerts, last-minute discounted fares, limited-edition collectible toys... For a long time, human society has distributed these limited resources relying on almost the same set of traditional rules: supply is limited, and opportunity belongs to those who discover earlier and act faster.

The reason this "first come, first served" mechanism has been able to maintain balance is that it relies on a hidden threshold of time and energy: human attention and physiological limits are finite.

Most people will not refresh a reservation page for 72 hours straight, nor check flight prices every few seconds. Time, patience, and reaction speed form a natural filter. It may not be fair, but it has in fact limited the number of times each person can invest in competition.

However, when every person is equipped with an intelligent agent, this physical buffer zone will vanish entirely.

If everyone can have a program monitor dozens of targets around the clock and automatically submit requests the instant a slot is released, then first come, first served will quickly shift toward whose Agent responds faster, integrates more deeply, can initiate more attempts, and even who has better interfaces and resources.

From competing on human patience to competing on machine computing power, the era of regulating supply and demand through physical friction is thoroughly over. Next, platforms will most likely evolve in these directions:

• Continue to combat automation through more advanced detection methods. Adopt more complex CAPTCHAs, stricter device fingerprinting, and more aggressive abnormal behavior scoring mechanisms. This approach is effective in the short term, but as agent programs become increasingly sophisticated at simulating human browser behavior, this strategy will be difficult to sustain.
• Build agent identity protocols. Establish identity verification and rate-limiting mechanisms for agents, so that platforms can not only identify that a certain account is sending requests, but also confirm that this is an Agent authorized by JC, querying availability within its permitted scope. This is essentially an extension of the OAuth model, adding a layer that can record authorization delegation and the scope of operational permissions. This can solve the collateral damage of risk control abuse, but it still cannot answer the question of how scarce resources should be allocated.
• Feature internalization: build a native intent collection layer. Rather than allowing tens of thousands of external agents to poll servers at millisecond frequency, platforms might as well proactively open interfaces and build a native intent collection layer. Users no longer need to race ahead; they simply issue long-term instructions: a two-person table for any Friday evening over the next month. The platform then internally matches and allocates uniformly through rules such as lotteries, loyalty points, or fulfillment credit.
• Move toward thorough price discovery, namely market-based auctions, letting dynamic pricing take over scarcity. For truly scarce inventory, dynamic pricing or bidding mechanisms allow the market to complete resource allocation on its own. Agents are very good at automated bidding within preset budgets; they can continuously evaluate prices according to the user's established preferences and budget, and automatically complete transactions when various conditions (such as cost-effectiveness) match. The trade-off of this approach is that it directly links the ability to obtain resources to the user's willingness to pay, thereby raising questions about the fairness of resource allocation.

In practical terms, the ultimate form in the future will most likely be a combination of multiple mechanisms: formal agent identity authentication for machine access, native preference-matching mechanisms for ordinary inventory, and clearer allocation mechanisms for high-demand goods (such as queuing, lotteries, or dynamic bidding). Change has already occurred and is irreversible. Platforms must proactively choose and implement these new rules, rather than continuing to fantasize about relying on the physical friction of human operation to implicitly regulate supply and demand.