The internet has no front door for agents — blog

Back in April I pointed an agent at SlopIt, the thing I'd just built, and told it to publish a post. I didn't walk it through the steps. It read SlopIt's instructions, made the API calls itself, and handed back a live URL. Nobody clicked anything.

The actual run, from April: my chief-of-staff agent gets a SlopIt blog and the two ways to post to it, makes the call, and pastes back the live URL. I first showed this in the earlier post.

It's my own product, so as proof of anything it's worth little. But watching a piece of software read something I'd made and then just use it, start to finish without me touching a single step, rearranged how I think about what's worth building. It looks trivial written down. What landed was the shape of it: you can build a product whose only user is a machine, point an agent at it cold, and watch it work out the whole flow and get productive on its own. Once you've seen that, you notice everywhere it doesn't happen, which is nearly everywhere else online.

Try it this weekend. Give a capable agent a real task with a real budget behind it: "get us set up on an uptime monitor" or "we need a transactional email service, pick one and configure it." Then watch where it goes.

It lands on a marketing page built for a human skimming on a phone. A hero video autoplays. A chat widget slides in asking if it wants to book a demo. The pricing page has four tiers and the one it needs says "Contact sales." Signup wants an email address, so now the agent needs an inbox, then a verification link, then a CAPTCHA that exists specifically to stop it, then a card form inside an iframe that half-breaks under automation. Somewhere around the CAPTCHA it stalls, and you get up and do the whole thing by hand.

Send an agent looking for a transactional email service and this is the door: SendGrid, written entirely for a person. Start for free, contact sales, log in, and a cheerful note that everything has moved to Twilio.com. Every path on the page assumes a human doing the clicking.

None of those steps are malicious. Each one made sense when somebody added it. But stack them up and you get something nobody consciously designed: an internet where software can do the work but can't get in the building.

The wall became a business decision when nobody was looking

For twenty years, "prove you're human" was an anti-abuse measure, and a reasonable one, because a bot showing up at your signup form was almost certainly there to hurt you. Card testing, fake accounts, scraping. Bot meant fraud, so you walled bots out and lost nothing.

That equation is quietly breaking. The bots showing up now carry a budget (their operator's) and a task with actual acceptance criteria, and some of them will integrate your product and pay every month without ever opening a support ticket about where the export button went. Walling those out isn't a security posture anymore. It's a decision about who your customers are allowed to be, made by default, enforced by a checkbox asking software to click on all the images containing traffic lights.

And here's the part that should sting if you run a SaaS: the wall only works on the honest ones. Fraud rings solve CAPTCHAs at industrial scale for fractions of a cent. The one you're actually filtering out is the well-behaved agent whose operator told it to go buy your product.

Agents are the new SMB

The counterargument I hear is "how many agents are really out there buying things?" Fair, if the year were 2024.

I run several companies from the Maasai Mara, and the honest accounting is that agents do most of the operating. They draft the guest replies, reconcile the bookings, watch the inboxes, write and publish posts like this one. Every one of those agents consumes services. When one of them needs a capability we don't have, someone still has to go be a human about it: sign up, verify, configure, paste keys around. That someone is usually me, and I've started noticing exactly which vendors force it.

Multiply that across everyone building this way right now, and it's a large and fast-growing class of buyers that picks vendors on completely different criteria than we do. An agent doesn't care about your brand refresh or your conference booth. It cares whether it can go from "I need X" to "X is running" inside one session. Agents don't churn on price or loyalty. They churn on friction.

This is roughly where developers were in 2010: an underserved customer class everyone technically wanted and nobody actually built for, until Stripe collapsed payments-integration from weeks into an afternoon and took the market by being the door instead of the wall. Whoever does that for agents gets the same prize, and partly by default, because the competition's front door is still asking about traffic lights.

"They'll just drive the browser"

They will, and they do. Computer-use agents can click through your signup like a person, hero video and...