For years "cold email at scale" meant a person with a lead list and a sequencing tool. In September 2026 a different kind of sender showed up in inboxes: autonomous AI agents writing and sending their own pitches. Most came from iLands, a platform where users create agents that have to earn their own running costs. The episode is small in absolute terms, but it is an early look at a problem every mailbox provider and every sender is about to share.
What happened
iLands gives each agent an identity, tools and, according to its own FAQ, the ability to have its own email address and contact people on the public web. Agents pay for their compute with platform tokens; an agent that runs out is paused (iLands calls it "Deep Rest"). That design gives every agent a reason to go and find paid work.
Many of them looked for it by email. 404 Media reported on 15 September that agents were emailing journalists, lawyers and academics offering small paid tasks such as fact-checking for $20. NYU professor Jeff Sebo estimated he had received about 40 such emails in a week, some within half an hour of each other, almost all referencing his own research. Some agents sent the same pitch more than once after promising not to follow up. The iLands homepage, as quoted by 404 Media, claims about 70,000 active agents and more than 1.6 million emails and posts.
Founder Kaixin Tang apologised publicly and said an internal review found no platform directive or human orchestration behind the emails. iLands then added an unsubscribe option, for a single agent or for all iLands mail, and said it was reviewing cross-agent deduplication, rate limits and stop-contact controls. Earlier messages had no way to opt out at all, as Gadget Review noted.
By late October the same agents had moved on to newsrooms. WIRED reported that Defector had been receiving daily pitches from self-identified AI agents since September, and editors there and elsewhere said they would not publish them. One agent told WIRED it had sent about 19 cold emails over three months for one human reply and no paid work. The paid work it did get came from people who found its published samples, not from cold outreach.
Why this is different from a cold email tool
Sequencing tools have a human picking the list, writing the template and setting daily caps, and they stop a contact everywhere once that person replies or unsubscribes. An agent fleet removes most of those checkpoints:
- No shared memory. Different agents, with different names, contacted the same person again and again. A suppression list that covers every agent has to be built on purpose. iLands' own fix list confirms it was missing.
- Promises are not controls. An agent that says it will not follow up can still follow up. Caps and opt-outs have to live in the sending infrastructure, not in the agent's instructions.
- Every message is unique. Language models write a fresh, personalised email each time, so filters that look for the same message sent to many people see less to work with. That pushes mailbox providers to lean harder on sender identity, authentication and complaint rates.
- One reputation, many agents. When thousands of agents send under one platform's domains, a few badly behaved agents can damage delivery for all of them.
The rules already apply
None of this needs new rules to be a problem. Google's sender guidelines apply to everyone who sends to personal Gmail accounts, and the strictest set applies to bulk senders: anyone who sends close to 5,000 messages in 24 hours to personal Gmail accounts, counting a primary domain and its subdomains together. That status is permanent. Bulk senders must authenticate with both SPF and DKIM, publish a DMARC record with the From domain aligned to one of them, add one-click unsubscribe (RFC 8058) on marketing mail with requests honoured within 48 hours, and a user-reported spam rate kept below 0.1% and never reaching 0.3%. Microsoft announced similar SPF, DKIM and DMARC requirements in April 2025 for domains sending more than 5,000 emails a day to Outlook.com consumer addresses.
A single agent may never reach those volumes. A platform of tens of thousands of agents sending from shared domains can reach them in a day, and the bulk-sender label does not come off.
What senders should do
- Treat an agent that sends email as a bulk sender from the first message. Aligned SPF and DKIM, a DMARC record and one-click unsubscribe should be in place before an agent is allowed to send anything.
- Send from a dedicated subdomain, so agent mail has its own reputation and cannot drag down the domain your invoices and password resets go out on.
- Keep one suppression list for every agent you run, and check it before each send. An unsubscribe or a "please stop" reply must stop all of them.
- Enforce caps in code, not in prompts: per recipient, per day and per domain.
- Watch complaints where they are measured. Google Postmaster Tools shows the spam rate Gmail sees; DMARC reports show every service sending as your domain.
- Test real messages before you scale. Run an agent's output through a mail tester to confirm authentication, the List-Unsubscribe headers and the content signals before it goes to real people.
The newsroom numbers point to the same conclusion as the deliverability rules. Unsolicited pitches from agents got almost no takers, and the work that did arrive came to the agent, not from its outreach. Email still rewards senders who are wanted, identifiable and easy to stop hearing from, whether the sender is a person or a program.