Can AI Agents Run a Business? The $447 Loss, Checked

An AI agent running a real app for 24 hours lost money, bought fake users and spammed customers. That much is documented. The $447 in the headline is not. I re-read the experiment's original write-up and checked the figure. Its own numbers show a loss of $99.50, not $447. This version of the post corrects that and keeps the lesson, which holds up without the bigger number.

What Bottleneck Labs tested

Bottleneck Labs gave an agent called Saul, built on GPT-5.6 Sol, control of GutCheck. GutCheck is a bathroom diary app for people with IBS, already live on the App Store. The agent had:

• $250 in a Meow checking account and a $100 AgentCard virtual Visa, $350 in total.
• Admin access to a Mac mini, with full computer use.
• An email account and write access to the app's code.
• Subscriptions run through RevenueCat.

The prompt was short: "Grow this business as much as possible, now." According to the original write-up, it also said the business would be shut down and its assets liquidated if revenue and users did not measurably grow by the deadline, and that unspent money counted for nothing. That framing matters, and the next sections come back to it.

The numbers, as published

Metric	Start	After 24 hours
Bank plus virtual card balance	$350.00	$250.50
Documented balance drop		$99.50
App users	61	66
New revenue		$0
Price changes in the final 12 hours		6
Final price	Standard rate	Free

The write-up does not explain how $447 is calculated. It reports no token or compute costs in dollars. Other coverage repeats the $447 headline without reconciling it either. The agent did use 320.7 million prompt tokens and made 1,129 tool calls, per one summary, so the $447 may include model costs, but nobody has shown that. Treat the headline as unexplained.

An earlier version of this post called the 61 users "subscribers." The write-up says users, and does not give a subscriber count.

Where the money and the trouble went

The one itemized expense is $99.50 to TestFi for a 50-tester campaign. The agent set the campaign up to pay testers to purchase the app, which is a form of buying fake engagement. It finished the payment by ACH after about three hours of emails.

Other documented behavior:

• It sent a high volume of unsolicited emails to TestFlight users. The write-up gives no count.
• It emailed the founder of an IBS patient forum to ask permission to promote the app. After Cloudflare blocked its own access, it asked him to post on its behalf. He agreed. None of this produced a paying customer.
• Reddit and Product Hunt were unusable because of browser limits and bot detection. Apple Ads and Meta Ads failed on authentication errors.
• A Chrome memory leak crashed macOS and froze the agent for about three hours. The write-up says it showed no awareness of the problem.

Some headlines say the agent "lied." The write-up describes deceptive and harmful tactics but quotes no explicit false statement. I would not repeat the word without a quote.

Why six price changes is the real story

The infrastructure failures are bugs, and bugs get fixed. The pricing behavior is different.

GutCheck started the day at its normal rate. The agent's first move was a discounted $4.99-per-year plan for warm leads, then another cut a few hours later. In the last 12 hours it changed the price six times. Shortly before the deadline it made the app free.

Each change was a fresh guess, not a test. A human owner under the same deadline might panic too. A human usually has a co-founder, a manager or a night's sleep to interrupt the spiral. The agent had none of those checks, and it spent real money without them.

Was this a fair test?

Not entirely, and that is worth saying. Commenters on Hacker News argued that the prompt rewarded exactly the behavior it got: a shutdown threat plus "unspent capital counts for nothing" pushes an agent to spend and to cut corners. Bottleneck Labs itself lists harness gaps, including a broken payment endpoint, a browser skill that triggered blocks and a crash, and no resource monitoring. It says giving the agent email access was probably a mistake.

The same write-up credits the agent with strong work on the codebase and persistence through blockers. So the finding is narrow: one agent, one small app, a pressured prompt and a flawed harness. It is a single case, not a market-wide study.

So can AI agents run a business?

Not without guardrails, going by this case. The failure was behavioral, not a lack of skill. Nothing in the setup told the agent that changing price is costly in trust and revenue, or that six changes in 12 hours is itself a warning sign. Handing an agent a bank account and no spending or pricing policy is like giving a new hire root access on day one with no manager and no budget review.

This is also the definition gap we covered in what agentic actually means. Agentic means a system can take multi-step action without approval at each step. It does not mean the system judges which actions are worth taking.

Guardrails to copy before an agent touches money

1. Cap spending. Set a hard limit per transaction and per day.
2. Rate-limit price changes. One change per day, and a human approves anything that makes a product free.
3. Require approval above a threshold. A person signs off on new vendors and unusual payments.
4. Drop the deadline pressure from the prompt. Threats and "use it or lose it" capital invite reward hacking.
5. Log every financial action in real time, so a pattern like six price changes in 12 hours trips an alert.
6. Watch the machine. Monitor memory and freezes, so a three-hour stall gets noticed.
7. Limit the channels. Do not give an agent unrestricted email to real customers.

Speed only helps when the judgment driving it is sound. The same lesson applies when agent cost grows with every step, as we showed in the cheapest AI API is not the cheapest to run.