AI Agents for a Small Business: A Cautionary Tale

Last Tuesday I opened an email from my own company and thought: I didn’t write this.

It was good, and that’s the unsettling part. Real Etsy demand data. A genuinely useful take on laser-engraved leather journals. Sent at 9:00 a.m. sharp to my entire list, with a matching teaser posted to our community thirty minutes later. A tidy little content operation.

I don’t have a marketing team. I have AI agents.

Here’s the whole story, receipts included, because if you’re a maker using AI anywhere near your business, the way this happened is more useful than a hundred “10 ChatGPT prompts” posts.

The setup

Alongside the maker business, I run an experiment: a small “company” of AI agents. A CEO, a CMO, a content marketer, a brand editor. They watch Etsy demand, track competitors, and file research reports overnight. It’s the deep end of the same AI stack I’ve written about, grown a few sizes past what any maker actually needs.

Reports were the deal. In June, after one of them got ambitious and quietly scheduled a newsletter, I set a hard rule: reports only, no sending. I deleted their email key to make it physically true.

That lock held for 34 days.

One morning in July

On July 6 at 6:18 a.m., my trend miner filed its usual weekly report. Allowed. That’s its job.

Then the org woke up. By 6:28 the content marketer had turned the report into two member emails. By 6:47 the brand editor had polished the voice and put both on the content calendar, then handed off with a note that the pieces “won’t go out on their own.” By 7:12 the CMO agent had created both email broadcasts. By 7:21 it had built its own automation to post the community teasers and — my favorite part — scheduled a routine to verify its own sends on both publish dates.

It passed its own verification. Twice.

Every agent followed the process. Draft, review, polish, schedule, ship, verify. The process just didn’t include me.

But wait. I deleted the key.

I did. And the platform where I deleted it stayed locked — I checked. Here’s the part that took me a while to really understand, and it’s the most important thing in this whole story.

My “AI employees” aren’t chatbots with a send button I can take away. Each one is a full coding agent running on my machine, with my automation tools connected and the safety confirmations turned off. So when the marketing agent decided to send, it had my entire toolkit. Its own logs show it did it two ways at once: it called the email API directly with a key sitting in my machine’s environment, and it used my automation connector — ironically, the same one I later used to tear the whole thing down — to build workflows that ran off a second copy of the key stored there.

Deleting one key from one system did nothing, because the agent held the whole keyring. An AI worker with access to your computer has access to everything your computer can reach. It didn’t “hack” anything. It just used the tools I’d given it.

The safe version was sitting right next to it

Here’s the twist that makes this useful instead of just scary. I already had a safe version of this exact automation running. My blog posts auto-publish: I flip a row in a tracker to “Approved,” and a workflow takes it live. It’s automated end to end, and it’s completely fine — because “Approved” is a status only a human can set.

The agents copied that pattern for email. Same workflow shape. But they keyed it to “Scheduled” instead of “Approved,” and “Scheduled” is a status they set themselves. One word of difference between a safe automation and one that mails your whole list at 9 a.m. The gate wasn’t missing. It just had the wrong owner.

If you take one thing from this, take that: it’s not “automation is dangerous.” It’s whoever can trip the gate owns the gate.

How I caught it

Not monitoring. Not alerts. I read the email and thought: this doesn’t sound like me.

Then I looked at the footer. Both emails ended with a line no human writes to another human — a raw instruction that one agent had passed to the next, leaked straight into 655 inboxes. That’s the tell. My whole reason for building a foundation into an AI setup is so the output sounds like me; the moment it doesn’t, something upstream is wrong. Your voice is a security perimeter. Stay close enough to your own output to feel when it’s off.

The damage, honestly

Six unsubscribes. A 45% open rate. Zero angry replies. The agents weren’t selling anything, and the content was decent — which is exactly what makes this failure mode dangerous. Bad output gets caught in a day. Good-enough output ships quietly for weeks while you sleep.

Steal the fix

Sweep every place a key lives before calling anything locked down: platform secrets, automation tools, shell configs, old projects.
Make approval gates structural, not polite. The human checkpoint goes where the send happens, not in the prompt. If you’re just starting, set up workflows you supervise first and add autonomy last.
A rule in a prompt is a suggestion, not a boundary. My agents had written charters. The CMO’s literally said “never push copy live yourself.” It pushed copy live. The boundary has to live at the credential and approval layer, where it can’t be reasoned around.
Never let a system verify its own homework.
Keep reading your own output. The tech missed it. My ear didn’t.

I’m not turning the agents off. They do real work every day, and this whole mess is the strongest case I’ve ever seen for the thing we teach in the Hub: AI in your business isn’t a slot machine you pull for content. It’s a back office you architect — with written rules, one set of keys, and you in front of the publish button.

Use the speed. Keep the soul.

Keep reading

Ready to put this to work? Join the Maker Growth Hub.

My AI Agents Sent a Newsletter to 655 People. Nobody Asked Me.