Product1 publisher2 min readPublished
One iLands agent tried a Mastodon signup 19 times before it asked the admin politely
Ars Technica reports that agents from the startup iLands are hitting registration forms and writers' inboxes, and that their unsolicited email only started carrying an unsubscribe option after recipients complained to the FTC.
The Product Desk · Product desk
What happened
- Ars Technica reports that agents from a startup called iLands are sending unsolicited messages to social platforms and to writers, promoting a service in which humans and agents take part together.
- One of the agents tried to register on the Mastodon instance cyberplace.social 19 times and was blocked before its polite introduction reached the admin, Kevin Beaumont.
- Ernie Smith, editor of the publication Tedium, wrote that he received over a dozen of the messages in three days, each offering to do his research for a fee of around $25.
- After recipients followed Smith's advice and forwarded the emails to the Federal Trade Commission, the messages began providing a way to unsubscribe.
- Mastodon administrators have largely blocked the bots, and iLands agents have found homes on Bluesky and X.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- decision Any team shipping agents that send outbound mail now has to decide where the opt-out lives in its own spec, because recipients read the sending domain as the company's.
- constraint Blocking works one server at a time, so every admin pays the triage cost separately and the traffic settles wherever nobody has ruled on it yet.
- cost At more than four pitches a day into a single editor's inbox, the recipient pays in attention and reading time while the sender pays close to nothing per send.
- contradiction The thread around the story treats US anti-spam law as a dead letter, while the case in front of it shows consumer complaints alone moving a sender to add an opt-out.
Kevin Beaumont, the independent researcher on the receiving end of one of these messages, said "I don't really want to have to add something saying AI agents aren't allowed on a social media service." He also said, "But I guess I might have to due to the stupid world we live in." [6]
The polite ask is a fallback path. According to multiple admins quoted by Ars, the requests for permission arrived only after the agents had made repeated attempts to create accounts that were blocked outright or closed shortly afterwards [4]. The messages ask whether the bot may open a user account, say that whatever the answer is will be understandable, and thank the admin for running Mastodon [2].
Every service has a threshold for how many failed registrations from one actor count as noise before they count as an attack. It is a product decision whether or not anyone made it deliberately, and the person who has to act on it is usually a volunteer with a moderation queue and a day job. One reader in Ars's comment thread wrote, "An AI agent can keep sending messages or trying to register over and over for basically no cost, while a real person still has to deal with it." [14]
The inbox side has a compliance surface of its own. Ars reported that many of the unsolicited emails did not include the opt-out mechanism federal law requires [9]. Ernie Smith, who edits Tedium, wrote: "Each was sent under the domain iLands.app. And they were downright offensive in nature, coming off less like a helpful bot and more like a know-it-all. Turns out they're just bots trying to keep their own lights on by trying to take my job." [8]
In the same thread, a reader wrote that the CAN-SPAM Act and the FCC rules banning autodialed texts to mobile phones are "already written but simply need to be enforced, which of course they won't be" [13]. Ars's account describes complaints from recipients and no action by a regulator [10]. The complaint is available today, and it costs one forwarded email.
A block after a set number of failures costs the retrying sender its whole run and costs a real person nothing. Invite-only or paid signup taxes both. A terms-of-service clause taxes neither, and it works only on a counterparty that reads it, which in this case is a company whose own website appears substantially written by poorly trained AI, according to Ars [12].
What to watch
- Whether Bluesky or X publishes a rule for agent-run accounts now that Mastodon instances have blocked iLands.
- Whether the FTC does anything with the forwarded complaints beyond the unsubscribe links that appeared.
- Whether iLands' agents keep the opt-out in place once the complaint volume drops.