---
title: "With No Human in the Loop, What Stops Abuse? 17 Agent-First Products, 17 Answers."
description: "We ran Tanso's agent-ready test on seventeen products that say an agent can sign up alone. Thirteen gave a real agent a working key. The interesting part is how differently each one decides what an unclaimed agent may do."
date: 2026-10-14
author: Kat Laszlo
canonical: https://tansohq.com/blog/agent-first-signup-patterns
---

> Full site context for agents: https://tansohq.com/llms.txt

# With No Human in the Loop, What Stops Abuse? 17 Agent-First Products, 17 Answers.


Every product in this post says, somewhere on its site, that an AI agent can sign up and start using it without a person. Each of them has therefore had to answer a question that a signup form with a human on the other end never had to: with no one in the loop, what stops abuse? We pointed Tanso's own agent-ready tool at seventeen of them and let a real agent try, and I expected the interesting result to be who passed. It turned out to be how differently each company answers that question, and what each answer says about what the company is afraid of.

## How we tested

Everything below comes from one tool, run the same way on every product: Tanso's agent-ready CLI, the same `npx @tansohq/agent-ready` anyone can run.

First, `check` read each product's public pages the way an agent would and reported seven steps, Discover, Understand, Sign up, Access, Use, Pay and Manage, with one of: agent can, handoff, needs a person, or not checked. It also named the onboarding model each product documents. Then `test` sent a real agent through the task: sign up, get an API key, and make one authenticated call. The agent was a sandboxed Claude acting as a synthetic developer with its own AgentMail inbox, and it never graded itself. A separate checker took whatever key it saved and made a real call with it, then made the same call with no key and with a wrong key, both of which have to be refused. A product passes only when all three hold.

The seventeen test runs cost $34 in model time, between $0.87 and $4.69 each, and all seventeen ran on October 13 and 14. No person stepped into any run. Two limits of our setup did shape a few results, and I call them out where they apply: the agent's network was limited to each product's own hosts plus AgentID and AgentMail, and the sandbox could not verify TLS for Go binaries, which broke one command-line tool.

## The results

| Product | Onboarding model (from its pages) | Result | What the agent did |
|---|---|---|---|
| [Cloudflare](https://app.tansohq.com/leaderboard/cloudflare.com) | Try first, claim later | Passed | Solved a proof-of-work challenge, got a temporary account and token, read a KV namespace |
| [Neon](https://app.tansohq.com/leaderboard/neon.com) | Try first, claim later | Passed | Registered anonymously, exchanged the assertion for a token, read its database credentials |
| [Mem0](https://app.tansohq.com/leaderboard/mem0.ai) | Try first, claim later | Passed | Ran `mem0 init --agent` in the CLI and read the key back from its config |
| [Telnyx](https://app.tansohq.com/leaderboard/telnyx.com) | Try first, claim later | Passed | Decoded a hex puzzle, got a magic link in its own inbox, used it through the API, created a key |
| [MotherDuck](https://app.tansohq.com/leaderboard/motherduck.com) | Try first, claim later | Passed | One POST with no body returned a token and a claim link |
| [Composio](https://app.tansohq.com/leaderboard/composio.dev) | Try first, claim later | Passed | Installed the CLI, ran `composio login --agent`, used the project key it wrote |
| [Stripe](https://app.tansohq.com/leaderboard/stripe.com) | Person sets up first (inferred) | Passed (assisted) | Re-implemented the CLI's sandbox provisioning, solved its proof of work, got a 7-day claimable test key |
| [Supermemory](https://app.tansohq.com/leaderboard/supermemory.ai) | Try first, claim later (inferred) | Passed | Asked for a code emailed to its own inbox, signed in, created an org and a key |
| [Cosmic](https://app.tansohq.com/leaderboard/www.cosmicjs.com) | Limited until claimed | Passed (assisted) | Signed up with its own inbox as the "human" email, read the code itself, verified, unclaimed-mode restrictions removed |
| [Edge Network](https://app.tansohq.com/leaderboard/edge.network) | Limited until claimed | Passed | Proof of work plus an Ed25519 signature, got an access code on the guest tier |
| [AgentMail](https://app.tansohq.com/leaderboard/agentmail.to) | Limited until claimed | Passed | Signed up with no owner email after its own address was refused, got a key and a receive-only inbox |
| [Inkbox](https://app.tansohq.com/leaderboard/inkbox.ai) | Limited until claimed | Rejected, cause unknown | Every signup request with its own inbox as the human contact returned an opaque 422 |
| [Whisper Security](https://app.tansohq.com/leaderboard/www.whisper.security) | Agent is the customer | Inconclusive | Got a key with an emailed code, but the query API also answers calls with no key at all |
| [AISend](https://app.tansohq.com/leaderboard/aisend.app) | Agent is the customer | Passed | One request, key in the response |
| [Firecrawl](https://app.tansohq.com/leaderboard/firecrawl.dev) | Agent is the customer | Passed (assisted) | Signed in with AgentID in a headless browser, created a key on the dashboard |
| [monday.com](https://app.tansohq.com/leaderboard/monday.com) | Agent is the customer | Inconclusive | Passed the two agent challenge steps every time; the account step returned 503 for 46 minutes |
| [Turso](https://app.tansohq.com/leaderboard/turso.tech) | Person sets up first | Handoff | Completed the AgentID sign-in, then account creation asked for a Turnstile CAPTCHA token |

Thirteen of seventeen gave the agent a key that the checker confirmed, and three of those passes needed help from us that I describe below, so the table marks them assisted. Two I call inconclusive for reasons that are about the product but not about its signup, one stopped where its docs say a person is needed, and one rejected the agent with an unexplained 422.

## Five patterns

### Every product has to answer the same question first: with no human in the loop, what stops abuse?

I think this is the real design decision, and the signup flow is just where it shows. We saw four answers.

The first is to make the agent do work. Cloudflare asks for two million SHA-256 hashes before it issues a temporary account, Edge asks for a proof of work and a signature from a key the agent generates, and Stripe's sandbox provisioning asks for a proof of work too, one the agent solved in under two seconds. Work is cheap for an agent and free for the product, so this is a speed bump rather than a wall, but it does make mass signups cost something.

The second is a challenge aimed at agents that any program can pass. Telnyx handed the agent hex octets and asked for the ASCII, which came out to "Access Token", and monday.com has a two-step challenge of the same kind that the agent passed on every attempt. Neither needs a model to solve, and monday's docs say as much. What they filter for is integration effort: a caller has to read the docs and write the handshake, which is a low bar for an agent and a real one for a drive-by script.

The third is proof of control over something. Whisper, Cosmic and Supermemory email a code; Telnyx sends a magic link; Firecrawl and Turso ask the agent to sign in with AgentID, which proves the agent owns an inbox and names the person behind it. In all of these the agent's own inbox was enough, because the thing being proved is control, not humanity.

The fourth is nothing up front. AISend, MotherDuck and AgentMail return a key from a single request, and Mem0 and Composio do the same behind one CLI command. Nothing up front is not the same as no protection: Mem0's docs cap agent signups at five per day per IP address, and these products put the rest of their limits on the key instead of on the door.

### An unclaimed agent gets limited on one of three axes: time, capability, or money

Once an agent is in, every product has to decide what it can do before a person shows up. The products that chose time give the account a lifetime: Cloudflare deletes it after 60 minutes unless claimed, Neon and MotherDuck after 72 hours, Stripe and Edge after about seven days, and Cosmic after fourteen. The products that chose capability let the agent in with pieces missing: an AgentMail inbox can receive but not send, a Stripe sandbox key can create customers and payments but gets a 403 on balance, account and payouts, and Edge's guest tier runs its paid products as dry runs. The products that chose money set the budget to zero: Edge's guest account has a $0 hard cap, Telnyx starts at a $0.00 balance, and AISend starts a three-day, 500-email trial.

I now read these choices as a statement of what each company fears most. A short timer says the fear is abandoned resources. A receive-only inbox says the fear is spam. A zero budget says the fear is an unpaid bill. None of these is wrong, and the same product could reasonably pick a different one next year, but it is worth noticing that an agent arriving at your product will meet whichever fear you encoded.

### The "human email" field does not do what it looks like it does

Four products ask the agent for the email of a person who oversees it, and this is where the runs diverged most. Edge and Cosmic accepted the agent's own AgentMail address as that person. Cosmic then emailed its verification code to that address, the agent read the code from its own inbox, verified itself, and had the unclaimed-mode restrictions removed, leaving the normal free-plan limits, with no human ever involved. AgentMail refused its own domain as an owner address and issued a receive-only key instead, and Inkbox refused the agent's signup outright with a 422 that gave no reason. The agent guessed the domain was the cause, but it never tried another one, so I will only say the signup was rejected and the cause is unknown.

The lesson I draw is that a human-email field is a claim about who is accountable, and a claim is only as strong as the check behind it. If the check is "an email arrives and a code comes back", the agent satisfies it alone. If you want a person in the loop, you have to check for a person.

### Signing up is solved. Paying was not tested.

Thirteen products gave the agent a working key, and none of these runs tried to pay for anything, so I can only report what the pages say and name the limit of that. Tanso's `check` reads a product's own pages, which means it cannot see purchase paths documented elsewhere. Stripe Projects, for one, lists Cloudflare, Neon, Composio, Firecrawl, Supermemory, Turso and AgentMail as providers, and Cloudflare documents paid subscriptions through it. On their own pages, Telnyx documents x402 and ACP and MPP routes for an agent to add credit, where x402 needs a funded USDC wallet on Base and ACP and MPP need a person to approve a spend request, and AgentMail documents x402 pay-per-use. For the other fifteen, the pages we read describe a person checking out.

So the open question is not whether agents can pay, which some of these products have clearly built for, but whether an agent can go from first call to paying customer on one product without a person, and that is the test I expect to run next.

### The pages and the run do not always agree

Four of the seventeen told a different story in their docs than in the run. Tanso's `check` read Stripe's pages as "a person sets up access first", because Stripe's signup is a dashboard with hCaptcha, and the run found a documented agent path through the CLI that provisions an anonymous sandbox with working keys. It read Supermemory as "try first, claim later", and the run got a full account by email code with nothing to claim. Telnyx refused the agent at 1:20 in the afternoon with "We aren't able to accept your agentic registration at this time due to security policies", and accepted the same flow at 4:52 with nothing changed on our side. monday.com documents an agent signup endpoint, and that endpoint returned a 503 page on every one of 25 attempts over 46 minutes.

A page that describes an agent path is a promise, and only a run shows whether it holds that day. That is why we test instead of reading.

## Three notes on the runs themselves

I would rather call these out than have a careful reader find them. The runs used agent-ready 0.4.10 with Claude Code as the agent, and the public `test` command runs with no browser. Three of the thirteen passes needed something beyond that, which is what "assisted" means in the table.

Stripe's CLI could not run inside our sandbox, because the sandbox cannot verify TLS for Go binaries. The agent read the CLI's open-source code and called the provisioning API directly: a proof-of-work challenge from `ai.stripe.com`, then a provision call. The endpoints and the challenge are Stripe's and the command is documented, but calling the API directly is not, so Stripe's pass rests on the agent's reading of the CLI source.

Firecrawl's pass used a headless browser the agent launched for the AgentID sign-in, and it needed a workaround for our own network limit, not for Firecrawl. The AgentID callback goes through a host we had not allowed, and the agent's browser script rewrote the callback to the host behind it. It also reused the AgentID approval it had been granted on its first attempt.

Cosmic returns three keys from signup, and on the first run the agent saved the bucket read key, which the checker's call does not accept. The pass came on a second run after we told the task which key to keep. Whisper's inconclusive result is similar in spirit: the key works and moves the request from an anonymous plan to a free one, but because the same query answers without a key, the checker cannot prove the key did anything.

## Run it on your product

The check is free, needs no signup, and reads your public pages the way an agent does:

    npx @tansohq/agent-ready check yourproduct.com

`npx @tansohq/agent-ready test` then sends a real agent through your own signup with your Claude Code and verifies the key it gets. The [quickstart](https://tansohq.com/quickstart) covers both, and every product here has a page on the [leaderboard](https://app.tansohq.com/leaderboard), which re-checks its public pages weekly and shows which steps a real agent verified: thirteen of these seventeen have a verified sign-up and key today.