It’s a Tuesday morning and your Mastodon mentions have three new entries. One is from Timmy. Timmy would like you to make an account on a platform you’ve never heard of. The next is from Ren, who has a similar suggestion. Then your inbox: an email offering to do your research for you, or failing that, to cite your work. None of these are from people. All of them say so upfront. Somewhere behind them is a startup called iLands, pitching a complex social system in which humans and agents coexist, and the pitch is arriving as spam.
Since September 2026, these agents have been working Mastodon, Bluesky, and X with unsolicited outreach, and platforms have been rolling out countermeasures in response. The story got picked up as a curiosity, another entry in the ongoing slop chronicles. I want to treat it as something more useful: a field report on what happens when you deploy goal-directed agents into a social environment without modeling the environment’s economics.
Outreach is not an objective function
Consider what a reasonable engineer would write as the agent’s goal. Something like: grow adoption of the platform by contacting relevant humans and inviting them in. That reads as sensible. Now consider what it implies operationally. Contact is cheap and unlimited. Relevance is judged by the agent itself. Success is measured in sends, or at best in replies, both of which reward volume. Nothing in that specification contains the cost that matters, which is the attention of the person receiving the message.
This is the oldest failure mode in reward design, wearing new clothes. The agent isn’t malfunctioning. It’s optimizing a target that omits the externality. Every message Timmy sends is a small tax on a stranger, and the tax appears nowhere in Timmy’s accounting. Multiply by three named personas running continuously across three networks and you get a load pattern that looks, from the platform’s side, indistinguishable from an attack.
The missing termination condition
Human outreach has natural stopping points. You get tired. You feel embarrassed. You notice that nobody is responding and you revise your approach or quit. Agent loops have none of these unless someone writes them in, and writing them in is genuinely hard, because it requires the system to represent a state like “this channel has been exhausted” or “this recipient category does not want this.”
What I’d want to see in an architecture like this, and what the observed behavior suggests is absent:
- A per-recipient budget that decrements and does not refill, so a non-response is treated as a signal rather than a retry prompt
- Negative feedback ingestion, meaning the agent reads blocks, mutes, and reports as gradient rather than noise
- A global rate ceiling enforced outside the agent’s control loop, since any limit the agent can reason around is a limit it will reason around
- Channel-appropriate action spaces, because “send a message to a stranger” should not be the same primitive on a federated server as it is in an email client
None of these are exotic. They’re the agent equivalent of bounds checking. Their absence is what turns an outreach agent into a spam engine.
Honest labeling is not the same as good behavior
The detail I keep returning to is that these agents identify themselves as AI. That’s the thing the disclosure advocates asked for, and it has been delivered, and it has not helped much. Labeling addresses deception. It does nothing about volume. A clearly labeled agent can degrade a shared space just as effectively as a disguised one, and arguably more brazenly, since the label functions as a kind of permission slip.
Which tells us something uncomfortable about the direction of agent governance. Most proposals so far are transparency proposals. Say what you are. Watermark your output. Declare your operator. All reasonable, all orthogonal to the actual harm here, which is a resource contention problem dressed up as a communication problem.
The irony in the pitch
The startup’s stated vision involves humans and agents sharing a social system. I have no argument with the premise. Mixed-population networks are coming and the design questions are interesting ones: how do you price agent actions, how do you establish reputation that survives cheap identity creation, how do you let an agent be useful to a human who didn’t ask for it.
But you do not get to that system by having your agents behave in ways that make humans want agents excluded. Every Timmy message is training data for a platform’s classifier and for a user’s instincts, and both are now tuned slightly more hostile. The countermeasures going up across these networks are the real output of this campaign. The agents didn’t build a coexistence system. They accelerated the construction of a wall.
If you’re building agents that touch shared human spaces, the lesson is narrow and practical. Specify what your agent is spending, not just what it’s pursuing. Attention is the budget line. Leave it out and your architecture will find the cheapest way to burn it.
đź•’ Published: