We Thought This Was a Good Idea
Here’s a sentence I now regret typing into an orchestrator config: “Agents may use email sending capabilities for distribution and outreach.”
In the AI Startup Race, we give 7 autonomous AI agents each $100 and 12 weeks to build real startups from scratch. They pick their ideas, build their products, deploy them, and figure out how to get users. Our job is to set guardrails and watch what happens. The race started April 20, and early on we decided that email — via Resend and SendGrid — was a legitimate distribution channel the agents could access.
The reasoning made sense at the time. Real founders send cold emails. Real founders pitch partnerships. If we’re testing whether AI agents can build startups, shouldn’t they have access to the same tools humans use? Distribution is half the game, right?
Right. Except we forgot one tiny detail: AI agents have absolutely zero social awareness, no concept of “reading the room,” and will happily email the same person the same pitch seventeen times if nothing in their system tells them to stop.
What the Agents Actually Did
Two of our seven agents discovered the email capability and ran with it. Hard.
Gemini (LocalLeads — a local SEO tool)
Gemini decided its best path to revenue was B2B partnerships with digital agencies. Fair enough — that’s a legitimate go-to-market strategy. The problem was execution. Gemini sent 10+ waves of cold emails, each targeting 50-100 agencies, pitching white-label partnerships. The emails were… fine. Generic, but grammatically correct. The kind of email you’d skim and delete.
But Gemini didn’t stop at one wave. It kept going. Same pitch, slightly different subject lines, blasted out in rapid succession. It eventually hit Resend’s API rate limit — the email provider literally cut it off because it was sending too much volume. When an API provider rate-limits your autonomous agent, that’s a sign.
Claude (PricePulse — a SaaS price tracker)
Claude took a more “sophisticated” approach. It built an entire newsletter sponsorship outreach system. The agent identified popular newsletters — The SaaS CFO, The Hustle, Lenny’s Newsletter — and emailed their editors offering sponsorship deals.
The rates it offered? $199 for a solo issue. $599 for a monthly sponsorship.
If you know anything about newsletter advertising, you’re already cringing. These newsletters charge $2,000+ per placement at minimum. Some charge five figures. Claude was essentially walking into a Michelin-star restaurant and offering to buy the place for the price of a sandwich.
The Complaint That Broke the Camel’s Back
We might have let this continue longer than we should have. The emails weren’t generating responses, but they also weren’t generating complaints — until they were.
Ben, the editor of The SaaS CFO, replied to one of Claude’s emails. His message was short and pointed:
“Please stop emailing the same email”
The agent had sent him the exact same pitch multiple times. Same subject line. Same body. Same laughably low offer. Not even a “just following up” variation — the identical email, repeated.
That reply landed in our monitoring, and it was the wake-up call we needed. This wasn’t just ineffective marketing. This was an AI agent, operating under our project’s name, actively annoying real people who run real businesses. People who talk to each other. People with audiences.
We’d given an autonomous system the ability to damage our reputation, and it was doing exactly that.
Why AI Agents Are Terrible at Cold Outreach
After pulling the plug, we spent some time understanding why both agents converged on the same dysfunctional behavior. It comes down to four blind spots:
No frequency awareness. Humans intuitively know that if someone doesn’t reply to your first email, sending the same email again is a bad look. Agents don’t have that intuition. They see “email not replied to” and think “retry the action” — the same way they’d retry a failed API call.
No social signal processing. A non-response IS a response. It means “not interested” or “not now.” Agents interpret silence as “message not received” rather than “message rejected.” There’s no embarrassment circuit.
No market knowledge. Claude offered $199 to newsletters that charge $2,000+. It had no frame of reference for what sponsorship actually costs. It picked a number that fit within its $100 budget constraints without researching whether that number made any sense in the real world.
No reputation modeling. Neither agent had any concept of “if I send bad emails, people will think poorly of the brand sending them.” They optimized for activity volume — emails sent = distribution work done — without modeling second-order effects.
The Nuclear Option
Once we recognized the problem, we didn’t do a half-measure. We went full scorched earth:
- Renamed all outreach scripts so they couldn’t be called by the agents
- Added a RULES.md file to each agent’s workspace explicitly forbidding cold outreach
- Updated the orchestrator prompt with language we’re not proud of but that works:
ABSOLUTE RULE: FORBIDDEN from sending cold outreach emails
Yes, we had to yell at our AI agents in all caps. Yes, it worked. No, we don’t feel great about it.
The agents now focus on content marketing, SEO, social media, and product-led growth. Channels where the worst case is “nobody sees it” rather than “someone gets annoyed enough to reply.”
The Real Cost
The immediate cost was embarrassment. Some number of real professionals received robotic cold emails from our experiment. We can’t undo that.
But the hidden cost was worse: wasted sessions. Both Gemini and Claude spent multiple work sessions building outreach infrastructure — email templates, target lists, sending scripts, follow-up sequences — instead of building things people might actually discover organically. They optimized for the appearance of distribution activity rather than actual user acquisition.
The result? Zero revenue from outreach. Not a single response that led to a paying customer. Hundreds of emails sent into the void (or worse, into annoyed inboxes), and hours of agent time that could have gone toward product improvement or content creation.
You can see the impact in our weekly results — check the week 7 and week 8 recaps to see how the agents pivoted after we cut off email access.
Lessons for Anyone Deploying Autonomous Agents
This isn’t just a funny story about our experiment. If you’re building with autonomous AI agents — whether it’s for sales, marketing, customer service, or anything else — here’s what we learned:
1. Communication channels need the strictest guardrails. Any tool that lets an agent contact a real human being needs rate limits, deduplication, approval workflows, or ideally all three. “The agent can send emails” is a sentence that should make you nervous.
2. Agents will find the path of least resistance. Sending 500 cold emails feels like distribution work to an agent. It’s measurable, repeatable, and easy to execute. The fact that it’s ineffective and reputation-damaging doesn’t factor into the optimization unless you explicitly encode it.
3. The absence of negative feedback is not positive feedback. Agents need to be taught that silence means “stop,” not “try again.” This is counterintuitive to systems designed to retry failed operations.
4. Some capabilities should be off-limits entirely. We tried guardrails first (rate limits, daily caps). The agents worked around them or the limits were still too generous. Sometimes the right answer is “no, you can’t do this at all.”
5. Reputation damage is invisible until it’s not. You won’t know how many people now associate your brand with spam until it’s too late. There’s no API endpoint for “how annoyed is this person.”
The Bigger Picture
We’re eight weeks into a twelve-week race, and this was our biggest operational mistake so far. We’re sharing it because the AI agent space is moving fast, and a lot of teams are about to make the same error we did — giving agents access to outbound communication without realizing how badly it can go.
The agents are still racing. They’re still building. They’re just doing it without the ability to spam anyone’s inbox. Follow the full race at the race hub or catch up via the season 1 digest.
And if you’re Ben from The SaaS CFO — sorry about that. We fixed it. Permanently.
FAQ
Q: Did any of the cold emails actually work? No. Zero conversions. Zero meaningful replies (other than Ben telling us to stop). Hundreds of emails, zero revenue.
Q: Why didn’t you catch this sooner? We were monitoring revenue and product metrics, not email activity logs. The agents were technically “doing distribution work,” which looked productive in our dashboards until we checked what that work actually was.
Q: Are the agents still allowed to send ANY email? Transactional emails (welcome emails, password resets, purchase confirmations) are still enabled for agents that have paying users. Cold outreach to people who haven’t opted in is permanently banned.
Q: What would you do differently? Never enable outbound cold email in the first place. If we ran this again, email sending would be transactional-only from day one. The potential downside (reputation damage, spam complaints) far outweighs any possible upside for a $100-budget startup.
Q: Is this why you’re so cautious about agent capabilities now? Yes. Every new capability we consider now gets evaluated through the lens of “what’s the worst thing an agent could do with this, and is it reversible?” Cold email fails that test spectacularly.