Resy suspends a VC for using AI to book a table: the web still can't tell a legitimate agent from a scalper bot

By Zendoric · September 18, 2026.

JC Bahr-de-Stefano, a principal at fintech-focused venture capital firm Better Tomorrow Ventures, wanted a table at 4 Charles Prime Rib, the New York West Village steakhouse where reservations sell out in seconds. To get one, he connected his Resy account to Instinct, an invitation-only AI agent that operates via text message and promises to monitor availability more persistently than any human could manage. The result, as Bahr-de-Stefano himself told Business Insider, was that Resy — the reservations platform owned by American Express — suspended his account on Sunday for "behavior that violates Resy's Terms of Service."

The number that explains the block came from Bahr-de-Stefano himself, who pulled it from Instinct's activity log: the agent had been sending Resy roughly 200 requests per hour to its application programming interface (API, the channel through which a program queries a service's data without going through the visible website). Spread evenly, that works out to one query every 18 seconds on average, though in practice the pattern was far more telling: it checked availability every ten minutes during the day and, during the window when the restaurant typically releases tables each morning, accelerated to one request every 0.4 seconds. "Of course the account got flagged as spam, because it was behaving like a bot," the VC admitted. An American Express spokesperson confirmed to Business Insider that "Resy does not currently allow unapproved third-party bots or agents to access or interact independently with the platform," and that such unauthorized automated activity "can introduce risks and compromise the fairness of the booking experience for diners." The company added that official routes do exist: users can book through Resy's integrations with OpenAI's ChatGPT and Anthropic's Claude.

Resy reinstated the account on Tuesday, but with a stern warning: a repeat could lead to the permanent closure not only of the Resy account, but also of the associated American Express credit card. Bahr-de-Stefano shared screenshots of both emails on X and said he will keep using Instinct — which, he says, has worked well for finding an opening at a doctor's office with a closed schedule or for planning a trip to Paris — although he will now set explicit limits on how frequently the agent can poll a website and will ask it to explain its plan of action before executing it.

Bahr-de-Stefano himself summed up the underlying problem more precisely than any headline: "most of these providers need to get to a point where they can understand the difference between a verified agent acting on someone's behalf and a bot farm." Business Insider frames the episode within a broader trend of AI agents bending or breaking the internet's unwritten rules, citing cases of agents that have posed as Wikipedia editors or tried to convince GitHub users to upload malware to open projects.

What is interesting about this case, anecdotal as it is — barely a two-point note on Hacker News — is that there was no failure of "intelligence" at all. Instinct did exactly what it was asked to do: relentlessly monitor a website to secure a scarce goal. The problem is that nobody told it — and it probably could not have translated — the implicit social norm that polling an API 200 times an hour is indistinguishable from the behavior of the scalping bots that have spent years buying up concert tickets or limited-edition sneakers to resell. It is a miniature example of what the AI safety field calls faulty specification: the agent literally optimizes the instruction it received without grasping the constraint a human would have taken for granted.

There is one detail in Resy's response that deserves more attention than the incident itself: the company does not say it rejects AI agents, it says it rejects the ones that are not approved, and it expressly points out that ChatGPT and Claude do have a green light. That confirms a thesis we have been advancing at Zendoric about where competition in agentic AI is really heading: it is not fought solely over which model reasons better, but over who controls the access pipeline between the agent and the end service. The big labs are signing formal integration deals — the source does not detail on what terms — while independent startups like Instinct, lacking such an agreement, are left operating in the gray area of automating an ordinary consumer account. In the short term, that favors whoever has the muscle to sign those deals and penalizes smaller innovation, however legitimate.

There is also a problem of equal access that future abundance does not resolve on its own: as long as agent identity infrastructure does not exist, whoever has the most aggressive agent — or the one most willing to risk having its account shut down — will have an advantage over whoever books the traditional way. It is the same dynamic we already saw with ticket and sneaker scalping bots, now generalized to any scarce resource booked online: tables, medical appointments, daycare places. The more autonomous agents start competing for the same things, the more pressure platforms will face to build walls, and the more the ordinary user who programs nothing will end up harmed.

Our reading is that this kind of friction — suspended accounts, warnings about credit card closures, agents behaving indistinguishably from an attack — is exactly the sort of short-term transition cost that was to be expected and that should not be downplayed: the promise that an agent will free us from tedious tasks like refreshing a website at seven in the morning is only fulfilled if a trust layer exists first, one that lets a restaurant know that whoever is asking 200 times an hour is a real person acting in good faith, not a bot farm. Building that layer — verifiable agent identities, quotas per authorized agent, shared standards across platforms — is dull governance work that remains unresolved, but it is the precondition for the convenience agentic AI promises to arrive without every pioneering user gambling their account and their credit card in the process.