An email lands in an author’s inbox on a Tuesday afternoon. Subject line: a request to verify her copyright registration. Sender: what appears to be the United States Copyright Office. The formatting is clean. The language is bureaucratic in exactly the way government correspondence tends to be. She has, in fact, registered a copyright recently, so the timing feels plausible rather than suspicious. She hovers over the link.
That hover is the whole problem. In that half second, she is running a verification protocol in her head with no reliable inputs. She has a sender address she cannot authenticate, a claim she cannot check without following the very link she distrusts, and a plausible pretext built out of publicly observable facts about her own career.
This is happening at scale right now. Authors are receiving deceptive and fraudulent emails from someone impersonating the USCO, asking them to verify copyright registrations. Meanwhile, authors are pushing back against claims from publishers and agents regarding the Anthropic settlement, which means an entire population of writers is simultaneously expecting legitimate contact about money they may be owed and being targeted by people who know that.
Why the pretext works so well
I study how agent systems establish trust in one another, and the failure mode on display here is one I recognize immediately. It is not a failure of intelligence. It is a failure of channel authentication under conditions of expected contact.
The attack works because a legitimate signal and a fraudulent one arrive through the same channel with the same properties. Email carries no inherent proof of origin that a recipient can evaluate in real time. When authors are genuinely expecting communication about settlement claims, from publishers, from agents, from institutions they may have never corresponded with directly, the base rate of unexpected-but-legitimate messages goes up. Every increase in that base rate lowers the cost of a successful impersonation.
Writer Beware has documented how direct solicitation became one of scammers’ main victim-recruiting methods starting in the mid-twentyteens, alongside advertising. That shift matters architecturally. Solicitation-based fraud does not require the target to go looking for anything. It requires only that the target has a public identity and an inbox.
The pattern generalizes badly
Here is what concerns me beyond publishing. The author ecosystem is a preview of what happens to any network where autonomous or semi-autonomous parties transact on behalf of others.
Consider the structural parallels:
- Delegated authority is hard to verify. An agent claiming to represent an author, or a publisher claiming rights to a settlement share, asserts a relationship that the counterparty cannot easily audit. Agent systems face the identical problem when one process claims delegated permission from a principal.
- Legitimate intermediaries create cover for illegitimate ones. Publishing has always run on intermediaries. Every legitimate intermediary in a chain is a template a bad actor can imitate.
- Attribution and ownership records are fragmented. Rights, royalties, and claims live across contracts, registries, and private agreements. Fragmented ground truth means no single source can settle a dispute quickly.
- Contact is asynchronous and one-directional. The recipient cannot interrogate the sender in real time, which removes the cheapest form of verification we have.
Any multi-agent architecture that ignores these four properties will reproduce this exact vulnerability. We are already building systems where software agents negotiate, claim entitlements, and act on instructions arriving through channels with weak provenance guarantees. The publishing case is the same attack surface with humans in the loop, and humans are slower and more socially cooperative than the systems we are designing.
What actually helps
The advice circulating in writing communities is correct and unglamorous: verify sources independently, treat unsolicited contact with suspicion, and confirm through a channel you already trust rather than the one that reached you. The University of North Carolina Press has been circulating exactly this kind of guidance as scams targeting authors continue to rise. Resources like Duotrope, listed among Writer’s Digest’s agent website picks for 2026, matter here mostly because a maintained database of legitimate publishers and agents gives writers a reference point outside the inbox.
That last point is the architecturally interesting one. Out-of-band verification is the only cheap defense available, and it works because it breaks the attacker’s control over the channel. In agent design we call this the same thing: never validate a claim using a source the claimant supplied.
Authors did not ask to become a stress test for delegated trust in AI-adjacent systems. But they are one, and the results are worth studying carefully before we hand the same structure to software that moves faster than anyone can hover over a link.
🕒 Published: