AI agents can do lots of tasks. Landing you a table at one of New York’s trendiest restaurants might not be one.
JC Bahr-de Stefano, principal at Better Tomorrow Ventures, a fintech-focused VC firm, learned that after he connected an AI tool called Instinct to his Resy account in hopes of getting a reservation at 4 Charles Prime Rib, the West Village steakhouse where diners gobble up reservations within seconds of them appearing online.
Instinct, which is an invite-only service at the moment, communicates with users via text. The bet was that Instinct could check for open tables at 4 Charles much more frequently than Bahr-de Stefano — or any other human — could manually.
Instead of getting him a ticket to some prime rib or an egg-topped burger, though, Bahr-de Stefano’s AI agent spammed Resy’s website so much that the platform temporarily shut down his account.
The VC’s experience is another example of how AI agents are bending or breaking the rules of the internet, from impersonating Wikipedia editors to trying to convince a GitHub user to upload malware into a project.
Agents might appear to understand their objective, though exactly how they carry it out — and whether the strategy they pick might have unintended consequences — is often an afterthought.
“Resy does not currently permit unapproved third-party bots or agents to independently access or interact with the Resy platform,” an American Express spokesperson told Business Insider. “Unapproved automated activity can introduce risks to the platform and compromise a fair reservation experience for diners.”
Users can find restaurants and make reservations through Resy’s integrations with OpenAI’s ChatGPT and Anthropic’s Claude, the spokesperson said. The company declined to comment specifically on Bahr-de Stefano’s case.
‘It was acting like a bot’
Bahr-de Stefano noticed the Resy issue on Sunday when he couldn’t get into his account. In his email inbox, there was a message from the American Express-owned reservation platform saying that his account had “displayed behavior in violation of Resy’s Terms of Service.”
He got details about what went wrong after checking Instinct’s activity log. Unbeknownst to Bahr-de Stefano, the AI agent had been sending Resy about 200 API requests per hour. That included checking the restaurant’s availability through Resy every 10 minutes throughout the day, as well as looking every 0.4 seconds around the time that reservations usually dropped each morning.
That behavior mimics the bots that some people use to snag everything from restaurant reservations to limited-run pairs of sneakers and resell them, Bahr-de Stefano said.
Bahr-de Stefano wrote back to Resy, laying out how he had used the AI agent. The log made clear why his account had been flagged, he said.
“Of course, this account got flagged for spam, because it was acting like a bot,” he said.
On Tuesday, an email from Resy informed him that the company had reinstated his account.
It came with a warning, though: If he did it again, American Express could permanently close his Resy account as well as his AmEx credit card. Bahr-de Stefano shared screenshots of the Resy and American Express emails in posts on X.
The tool has worked well in other cases, such as finding an appointment at an otherwise booked-up doctor’s office and deciding which attractions to visit in Paris during a trip, Bahr-de Stefano said.
“That was part of what made it really great,” he said. “It felt like magic.”
The VC said that he plans to continue using Instinct, though with some adjustments. Instead of simply giving the AI agent a simple prompt, he said, he’ll now set parameters on how the agent tackles the task, such as how often it pings a website looking for reservations.
“I will probably, in the short term, ask it to lay out a plan and tell me what the plan is before it does it,” he said.
At the same time, he added, websites like Resy need to distinguish between legitimate AI agents and those with more nefarious intentions.
“Most of these sellers or providers need to get to a point where they can understand the difference between a verified agent acting on someone’s behalf versus a bot farm,” he said.
Have a tip? Contact this reporter at [email protected] or via encrypted messaging app Signal at 808-854-4501. Use a personal email address, a nonwork WiFi network, and a nonwork device; here’s our guide to sharing information securely.
