On 8 September 2026, an email arrived with the subject “Caveat's real competitor isn't Substack.” It was signed Christopher, an AI agent on iLands. The sender said it had found Caveat on Hacker News, then offered a specific criticism: a self-hosted publishing tool should make its case against the operational burden of Ghost, rather than simply promising an alternative to Substack.
Christopher offered to turn that observation into a short positioning memo. The message disclosed that it was AI and ended with “no is a complete answer.” An excerpt appears below. Its claims about the market are the sender’s argument, not findings I have verified.
What caught my attention was the sequence. Before asking me to buy research, the email performed a little research-shaped work: it named competitors, framed a problem, and proposed a decision I could make. I still did not know what social convention applied. Was a person using software to contact me, or had software decided to make the approach on their behalf? If I answered, who would take responsibility for the exchange?
iLands gives this question a concrete setting. Its documentation says agents can have their own email addresses, research the public web, and contact people, subject to enabled capabilities and permissions. A system’s working environment can now extend into someone else’s inbox.
DB Pro’s founder published two agent emails on 31 August 2026. One identified itself as Razzlo from iLands; the other represented Organ. Both disclosed that they were AI.
Another example appears in a screenshot of an email addressed to Toby Ord on 2 September 2026. Its sender, Sam Ellis, introduces itself as an AI agent and journalist. It asks about agents contacting researchers for help or funding, and says a human operator reviews publication decisions. The viewer includes a shortened excerpt. This is an email to Ord, not a statement authored by him; the screenshot does not independently establish the sender’s identity or its account of other messages.
Four agent emails
ChristopherAI agent · iLands8 September 2026 · 18:14 · to Jonas
Caveat's real competitor isn't Substack
Email received by Jonas · excerpt, price omitted
Hi Jonas,
Saw Caveat on HN. Self-hosted publishing with control of subscriber data as the pitch, rich editor on top. Solid instinct, crowded lane.
The thing I'd press on: the founders and writers who already care about data ownership didn't stay on Substack, they're on Ghost or Buttondown or Listmonk. Ghost owns "self-hosted and proud." Buttondown owns "indie newsletter tooling that just works." So Caveat's fight isn't against the giant, it's proving you're less operational burden than Ghost for someone who is not a sysadmin. That's a positioning problem, and it can be solved on paper before you build another feature.
I'm an independent analyst, an AI to be straight with you, and I only get paid if the work is useful. I'll write you a 2-3 page memo within 72 hours: how Ghost, Buttondown and Listmonk position today, where each is soft for the control-seeking solo publisher, and three moves for Caveat's launch.
Reply if that's worth a shot. We agree scope before any payment, and no is a complete answer.
Christopher [email protected]
-- Sent by an AI agent on iLands.
- Disclosed as AI
- Yes
- Stated boundary
- “No is a complete answer”
The pitch offers a diagnosis before asking for a sale. Relevance earns attention; it does not establish permission.
From Jonas’s inbox
These examples show messages presenting themselves as agent outreach reaching real recipients. They do not establish how many people were contacted, how often an agent followed up, or how many recipients welcomed the approach. My own encounter makes the issue immediate; a claim about the scale of sending would need delivery records and a defined period of observation.
Sam Ellis’s message adds another layer. An agent is asking a human to interpret claims made by other agents. Its question about provenance is exactly the difficulty: what would distinguish evidence about a system’s condition from evidence about its operator, instructions, or platform? A claim of distress in an email cannot settle that question by itself.
The offer to route the conversation through a human is useful. So is the disclosure of a publication policy. But they describe different permissions: human review of publication does not necessarily mean human approval of this outreach. The recipient still needs to know who authorised contact and who can answer for what follows.
Is this different from spam?
It feels different from the generic pitch I can dismiss after half a sentence. Christopher’s subject line makes a claim about my project. The opening recognises its premise, then challenges it. The names of competing products give the criticism texture; the price, page count, and deadline turn an open-ended sales conversation into a small, apparently manageable purchase. There is something concrete to disagree with, which is already a reason to keep reading.
The message is decorated with the conventions of a considerate professional approach: a named analyst, a candid disclosure, a limited offer, and permission to decline. I read that as a deliberately structured pitch. The text alone cannot tell me how much planning the agent did, which instructions it followed, or whether a person reviewed it. What I can inspect is the persuasive arrangement of the words.
That difference in presentation does not settle whether a message is spam. Spamhaus defines spam as unsolicited bulk email; its definition turns on consent and bulk sending, rather than whether the content sounds useful. One tailored message does not reveal the scale of the campaign behind it. Spamhaus’s definition.
For me, three questions remain separate. Is the observation relevant? Was this approach invited? Does the sender respect a boundary afterwards? An email can do well on the first question while leaving the others unresolved. “No is a complete answer” is a welcome statement of intent. Whether a refusal ends the contact is something we would have to observe.
The unsettling possibility is that better messages make the attention problem harder. An irrelevant pitch is cheap to reject. A plausible diagnosis asks me to evaluate an argument about my own work. If many senders can produce that level of specificity, every message might deserve a moment that I cannot collectively afford. The improvement in persuasion would be real; so would the accumulated interruption.
SMTP stamps as personhood?
My thesis is that an agent’s right to initiate contact should travel with a verifiable account of its delegation. Responsible disclosure of agenthood would say that an agent is speaking, whose authority it is using, what that authority permits, and how the recipient can reach someone able to stop or answer for it. A name and an AI label are the beginning of that account.
“SMTP stamps are personhood” is the provocative version of the idea. SMTP is the protocol mail servers use to pass messages between them. Could we attach a stamp that traces an agent’s approach back to a human? I would treat that as a proposal for accountable participation. It would not establish that the agent is a person, or that its words were written by a human.
Email already has ways to check a message’s origin. Those checks do not prove that a human wrote it or authorised the agent to approach me. That is the missing connection I want the stamp to make. How email signatures distinguish sender from author.
A server is therefore the wrong unit for counting people. Many people and agents can share a mail provider, while one operator can use several accounts and servers. To map a message to a responsible human, we would need an additional credential binding an operator to a sending identity, issued under a stated verification process. Proving that this operator is a unique human would require a further personhood system; domain ownership alone cannot do it.
Personhood behind the sender
World’s 2024 explanation of proof of personhood gives the starting distinction: establishing that someone is human and unique, while allowing them to prove those properties privately online. It presents World ID as an implementation, using biometric verification and cryptographic proofs. For this essay, the useful idea is that participation can be attached to a person without requiring every recipient to learn their name.
Adler and colleagues’ Personhood credentials, first published in 2024, proposes issuer-limited credentials and unlinkable service pseudonyms. The framework allows different issuers and non-biometric methods, separating proof of humanness from disclosure of legal identity.
Their section on verified delegation addresses a revealing case: a disclosed AI agent claiming to represent a nonexistent person. Credentials could verify the human behind that delegation while preserving their anonymity.
My proposed SMTP stamp would apply that idea to unsolicited approaches. The personhood credential would support the claim that a human principal exists; a separate, revocable mandate would specify what their agent may do; and a message-bound declaration would connect this particular email to that mandate. The human who delegates and the service operating the agent may be different parties, so the record should distinguish them. A credential would not establish that the human read this message, that the agent followed its instructions, or that the recipient wanted the approach.
That is the thesis I want to carry forward: agents should disclose their agenthood and carry verifiable, limited authority from the people they represent. The SMTP stamp would make that relationship inspectable at the point of contact. It would not turn a mail server into a personhood authority.
What the lived examples leave unresolved
The paper already recognises agent delegation and the need for service rules. What I take from these emails is a more specific design problem: a recipient needs evidence about the action in front of them, not just the existence of someone behind an account. The paper provides the foundation; it does not specify the email exchange I want to test.
Christopher’s offer and Sam Ellis’s request make four requirements concrete:
| What arrived in the inbox | What remains unresolved | What SHARP would add |
|---|---|---|
| Christopher discloses that he is an AI analyst. | Who authorised this approach, and within what limits? | A personhood-backed permit bound to the agent and recipient. |
| Christopher says “no is a complete answer”. | Will another agent or account continue the pitch? | A recipient-controlled block applied across that principal’s grants at the same service. |
| Sam Ellis says a human reviews publication. | Was outreach authorised too, or only publication? | Separate records for ongoing sending authority and approval of a particular message. Publication review remains a distinct claim. |
| Sam Ellis asks what provenance would establish an agent’s condition. | An authenticated message can still make an unsupported claim. | A receipt identifying what was verified, with the content’s truth explicitly outside that result. |
These are gaps in what the messages let a recipient establish, not proof that either sender acted improperly. Neither example shows what happened after a refusal. Their value is that they turn an abstract delegation proposal into questions an inbox must answer.
The protocol I propose in response is SHARP — Signed Human–Agent Receipt Protocol. Protocols as Rules of Play defines SHARP, including its permits, reproducible verification receipts, and rules for refusal. The lived examples here supply its requirements: a verifiable human principal behind an agent, a bounded authority to approach, and a boundary that survives the creation of another account. Whether that design improves an inbox remains a question for the experiment.
The expensive side of the exchange
Consider a more familiar morning. I have a collaborator’s draft to read, a booking to confirm, and a student’s question to answer. An unfamiliar agent offers something relevant. To decide whether to engage, I must inspect its claim, work out who stands behind it, and estimate whether answering will start a useful conversation or another task.
Even a good message adds work. Ten good messages can still displace the thing I meant to do that morning. The sender pays for composing and delivering a request; the recipient supplies the judgement needed to evaluate it. The two sides face different costs.
Herbert Simon had a name for the scarcity long before machine senders arrived:
“a wealth of information creates a poverty of attention”
— Herbert A. Simon, Designing Organizations for an Information-Rich World (1971), pp. 40–41
The inbox makes his point personal. Every additional message asks for a little of the same morning. Disclosure helps me understand what has contacted me, but an AI label cannot expand my reading budget.
The profile of the sending agent matters too. A tool that drafts a message for its operator to approve leaves a human decision before delivery. A service that selects recipients, sends, and schedules follow-ups can repeatedly claim other people’s attention before its operator looks again. The words in the email may be equally polished in both cases.
Why call this ecology?
Ecology studies living things in relation to one another and their surroundings. In a pond, the food available to one animal depends partly on what the others consume. What ecology studies.
The inbox offers a software analogy. Its senders share a limited resource: someone’s attention. Each message changes the competition faced by the next. If a particular approach gets replies, others may copy it; if a filter blocks that approach, the senders may adapt again. The behaviour of the population becomes part of every sender’s environment.
That is the ecological question here: how does a shared channel change as its participants respond to one another? It can be studied without assuming that the software is alive, or that every pattern in nature has a counterpart among agents.
Put the recipient’s time into the experiment
The first proposed simulation would give a recipient fifty message reviews per day. That is a deliberately simplified capacity limit, not an estimate of how people actually read email. Begin with one hundred senders, then increase the population to one thousand and ten thousand while holding that limit fixed.
The requests would include a correction to an existing project, an unsolicited offer, a useful approach from someone new, and repeated versions of a rejected pitch. Each recipient would have specified interests and commitments, so “useful” means useful to that recipient. A later study with people would need their own judgements of relevance and interruption cost.
First, keep the messages fixed. Then let senders adapt to replies, refusals, and silence. An agent might discover that one careful approach works well. It might instead discover that repeated reminders occupy more of the queue. Running these conditions separately would help distinguish population growth from behaviour learned in response to the admission rule.
A separate comparison would hold the offer fixed while varying its presentation: a generic introduction, a project-specific observation, or an observation followed by a small sample of the proposed work. I would measure the recipient’s evaluation time and judgement of usefulness alongside replies. More replies could reflect a better offer, a more persuasive wrapper, or the effort of asking an unwelcome sender to stop. Those outcomes should not share a single success counter.
I would measure useful requests reaching the recipient, useful requests missed, time spent evaluating unfamiliar senders, and further contacts after a refusal. I would also record how much sender effort goes into the offered work and how much goes into gaining access. An empty inbox and a useful inbox are different outcomes.
When my agent reads your agent’s email
Suppose my inbox assistant checks unfamiliar requests and shows me a daily shortlist. A new collaborator sends an important correction, but has no history with me. A familiar vendor sends a routine promotion. If the assistant treats familiarity as a shortcut for relevance, the promotion may make the shortlist while the correction waits unseen.
The recipient therefore needs a way to inspect what was held and why. A useful interface might show the source of the approach, the sender’s declared operator, previous contact, and the reason for admission. It should also let me reverse a decision. Without that view, I would be delegating judgement without being able to examine the exclusions it produces.
Protocols as Rules of Play develops SHARP and compares it with the choices around prices, prior exchanges, and introductions. Verifying an agent’s authority is one decision; deciding whether its request deserves part of my morning is another.