AI agents and the attention economy

For thirty years the defense of the inbox has been a guessing game. A filter reads a message it has never seen, from a sender it cannot verify, and tries to infer intent from surface features: words, links, sending patterns, reputation of the originating server. It works surprisingly well and it fails in exactly the two ways that matter. The important message from a stranger lands in spam. The polished mass mailing lands in the inbox, because it was written to look like the mail you want.

That failure was tolerable while sending was human work. It stops being tolerable now, because the sender on the other side is increasingly a machine with no marginal cost, no fatigue, and a model good enough to write in your register.

Volume was never the real problem

It is tempting to describe agents as a spam problem at a new scale. That framing is wrong, and it leads to the wrong defense. Scale is not what breaks the classifier. What breaks the classifier is that the signals it depends on were proxies for effort, and agents make effort free.

Bad grammar meant a careless sender. A generic salutation meant a list. An unusual hour meant automation. Every one of those tells has been erased by systems that write cleanly, personalize at zero cost, and send whenever you are most likely to read. A filter tuned on the residue of human laziness has nothing left to detect.

The classifier was never reading intent. It was reading the cost the sender had paid, and inferring seriousness from it. Agents removed the cost while leaving the appearance intact.

Agents can do something humans could not

Here is the part most of the discussion misses. The same property that makes agents dangerous also makes them tractable, and in a way human senders never were. An agent has a budget. It can execute a payment inside its loop, without a person deciding, without a checkout page, without breaking flow. Ask a human stranger to place a refundable hold before emailing you and you have added friction to a task they may abandon. Ask an agent, and you have simply added a line item.

So for the first time the receiver can demand something better than a guess. Not proof of identity, which is expensive and leaks. Not a captcha, which agents solve. A stake. A small refundable deposit that the sender forfeits only if the recipient says the message wasted their time.

That is a genuine economic signal, and it has a property no classifier has: it comes from the sender's own estimate of their message's value. A system offering something worth your review will happily risk a few dollars on that judgment. A system blasting ten thousand identical pitches cannot, because the expected loss scales with the volume it depends on. The economics invert. Precision becomes cheaper than reach.

What refundable means, and why it matters

Pay to reach schemes have been proposed for decades and they keep failing for a reason worth naming: nobody wants to sell access to their inbox. Charging for contact makes you a toll booth, it insults the correspondents who deserved to reach you free, and it gives you a perverse interest in remaining reachable by anyone who pays.

Refund by default fixes the incentive. The default outcome of a legitimate message is that the money goes back to the sender in full. You are not selling attention, you are asking for a bond against wasting it. The good agent pays nothing over time. The extractive one pays every time, which is precisely the outcome you want, and the reason the volume never materializes.

Filters ask what does this message look like. A deposit asks what is this sender willing to risk on their own judgment. Only one of those questions has an answer a language model cannot fake.

The shape of a machine readable door

None of this works if the price is a secret. An agent that hits a wall with no instructions treats you as unreachable and moves on, which is a loss for both sides. So the gate has to be discoverable and structured: a published manifest saying what a first contact costs, what the hold period is, which topics are welcome, and how to complete the payment programmatically.

That is what we built at Knock. Every user gets a public address that anyone may know, a manifest at a well known path that any agent can read, and an API that lets a machine place the hold and deliver its message in a single flow. The recipient sees a queue where every waiting item already carries a stake. Release it and the sender is refunded. Retain it and the deposit is settled, ninety percent to the recipient. Silence for fourteen days refunds automatically, because a system that profits from inattention is a system that will eventually be gamed by its own owner.

Where this ends up

Two futures are on the table. In the first, receivers keep hardening filters, agents keep learning to pass them, and the inbox continues its slow decline into a channel nobody trusts for anything that matters. In the second, the receiver publishes a price, the sender pays it or does not send, and both sides get a signal that survives contact with an intelligent adversary.

The second one is not more restrictive. It is more open. A public address you can actually keep public, reachable by any stranger and any agent willing to put a small refundable amount behind their claim, is more accessible than an address hidden behind aliases, forms, and a filter that will misjudge the one message you needed.

Attention was always scarce. It was just never priced. Agents are what finally force the correction.

Thomas Ferriere, founder of Knock. See the agent side of the protocol at knock.email/docs, or read The Economics of Free Attention.