Would you let an AI agent create an account in your product for a user?
This week I went through the sign-up flow of ten well-known products, imagining an AI assistant doing it for me. It could read what each product does and what it costs. On almost every one it would stop at the email confirmation or a CAPTCHA. I had never thought of a sign-up form as something software would fill in.
I see three ways to handle it, and I keep going back and forth:
Keep sign-up human-only. Safer, and nobody has to think about bots with accounts.
Let the agent do everything except one approval step, where the person confirms the email and accepts the terms.
Give agents their own path, like an API key or OAuth login, separate from the human form.
Right now I lean toward option 2, because the person still decides and the agent does the boring part. But I am not sure what it does to fraud and support load.
Has anyone here opened sign-up to agents yet? I would like to hear what broke and what you would do differently.
Replies
option 2 is where we ended up for a different step.. the catch is the approval only means a person if something checks who did it. our approve command got run by the agent itself once, so now it refuses when it can see an agent behind it, and it isn't airtight yet. for the email confirm, would you treat a click from the same session that started sign-up as the agent's?
Not opened to agents, but two things from my app bear on your fraud question. First, the sign up form is not the only door. My backend calls require App Check, an attestation that the request comes from my real app on a real device or my site, so a script that skips the form and calls the API directly gets refused. Second, the email step is less of a guard than it looks. Two sign in emails reached my own inbox this week that nobody admitted to, and they are sent by the auth provider straight from the web form, past my own code, so I could not even see the caller's IP. Auth request logging was off; it is on now, with the IP of every auth call. Whatever path you pick, log who triggered each email before you open it to agents.
From the other side: I let agents work in my signed-in sites every day, but they never get a password and never create accounts. I sign in myself once, and the agent picks up from there. So your option 2 matches how I'd want it.