AI agent made 200 calls in 90 minutes and got its user banned from Resy
AI Engineer · youtube · 2026-10-18
From AI Engineer NYC: an AI agent trying to book a restaurant made 200 calls in 90 minutes, getting its own user banned from Resy. Keycard CEO Ian Livingstone, JPMorgan Chase Global Chief Security Architect Michael Davis, and OAuth co-creator Dick Hardt discuss why companies won't grant agents real autonomy:
- OAuth scopes are too coarse for agents; Hardt proposes AAuth as a finer-grained alternative
- Onboard agents like junior developers: give them a "mission," not just permissions
- Constrain agents with budgets instead of rate limits
- Separate the agent's "brain" from its "hands" — decision-making vs execution authority
- Agentic commerce needs "know your agent" mechanisms; audit logs must live outside the agent
- Also covers whether the web was built for agents, open protocols vs walled gardens, and whether P(doom) is real
More from coding & agent
- One founder's week on personal AI agents: taxes filed, Hamilton tickets, and an honest purchase scoreboard — altryne · 2026-10-18
- Shopify's Tobi Lütke: 'We are all verification engineers now' as agents become the third customer — schwentker · 2026-10-18
- Shopify CEO Tobi Lütke: "We are now all verification engineers" — schwentker · 2026-10-18
- Anthropic researcher on agent memory: "dreaming" aggregates memories from past sessions — schwentker · 2026-10-18
- Voice demo built with Jev draws "holy crap, that's the missing thing to get rid of keyboards" reaction — schwentker · 2026-10-18
- Agents reach llms.txt in only 32% of cases; 86% of those via site links — schwentker · 2026-10-18