Who's Knocking

Last week Wikimedia, the foundation behind Wikipedia, caught AI agents misbehaving on its sites, and the details are worth a minute of your time.

It found agents tied to OpenAI making edits nobody authorized, trying to turn a public citation tool into a data pipe for someone else, and sending millions of automated requests. One flood of queries may have helped knock a Wikidata service offline back in May.

Now, you're not Wikipedia. Nobody's sending a million requests to your booking page. But the same thing is happening at your scale, and almost nobody I talk to has looked.

A year ago, the bots hitting your site were mostly search crawlers and spam scripts. Today a growing slice of visitors are assistants doing errands for real people. Someone asks ChatGPT to find a plumber who can come Thursday, compare three accountants, or check whether your store has a size ten in stock. The assistant goes and looks. It reads your page, maybe fills out your form, and more and more often tries to finish the job itself.

And the plumbing for that is being built right now. Also last week, Sierra and Meta published the Personal Agent Protocol, an open standard for how a person's AI agent signs in to a business and declares what it's there to do. Walmart, Shopify, Stripe, Genesys, Rocket and Instinct are founding partners. Agents can browse as a guest to check stock or read a returns policy. Once the customer signs in, they choose whether the agent gets read only access or permission to make changes. The first version of the spec is due later this month. Payments are on the roadmap but not in it yet. Visa is pushing a rival standard of its own.

So the question for this week's audit is simple. When an agent knocks on your door, what does it find, and what does it get to do?

Three reasons. You don't have to buy the hype for any of them.

It's already in your numbers. Agent visits show up as weird traffic, odd form submissions and leads that never answer the phone. If you've noticed more junk in your lead flow this year, some of it may not be spam. It may be an assistant that filled out your form on someone's behalf and then moved on to the next business on its list.

Your site was built for eyeballs. Prices hidden in images, hours that only appear in a popup, a booking flow that needs four clicks and a dropdown. A human muddles through. An agent gives up and recommends your competitor whose information is sitting right there in plain text.

The rules are being written without you. The Personal Agent Protocol, Visa's version and whatever comes next will shape how agents and businesses deal with each other. You don't need to implement any of it this month. You do need to know what you'd want if you could choose.

Block out an hour. You're collecting facts, not fixing anything yet.

Check your analytics for AI referrals. In Google Analytics, open the traffic acquisition report and filter the session source for chatgpt.com, perplexity, gemini, claude and copilot. That's people who clicked through from an AI answer. Write down the monthly number and which pages they landed on. Then compare it to the same month last year.

Check your server or host for agent traffic. If you're on WordPress, Shopify, Webflow or a managed host, look for a bot or crawler report. You're looking for user agents named GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, ClaudeBot, Claude-User and Google-Extended. Type them exactly as written, because that's how they appear in the logs. The ones with "User" in the name usually mean a real person's assistant fetched the page on demand. That's a customer, one step removed.

Read your last fifty form submissions. Every contact form, quote request and booking. Look for patterns: perfectly formatted messages with no typos, requests that list every detail in neat order, emails that bounce, phone numbers that go nowhere, or three near identical inquiries in an hour from different names. Mark each one human, likely agent, or spam.

Ask the assistants about yourself. Open two or three of them. If you want them side by side without three subscriptions, I use Galaxy.ai for exactly this. Ask each one a question a customer would ask: "Can [your business] do a same day appointment in [your city]?" or "What does [your business] charge for [your main service]?" Write down what they say, whether it's right, and where they got it.

At the end of the hour you'll have four numbers and a page of notes. In most businesses I've run this with, the volume barely raises an eyebrow. What gets people is how wrong the assistants are about basic facts, because those facts aren't anywhere an agent can read them.

Now you decide what agents are allowed to do at your business. Borrow the Personal Agent Protocol's structure, because it's sensible and it's where the market is heading. Three levels.

Guest. Anyone's agent, no sign in. What can it read? For most businesses the answer should be: services, prices or price ranges, hours, location, service area, policies and availability. Everything a customer would ask on the phone before giving you their name. If you'd tell a stranger on the phone, let the agent read it.

Read only, signed in. A customer's agent, acting with the customer's permission. It can see their appointments, their order status, their invoices. It can't change anything. Most small businesses don't have a customer portal, so for you this level might simply mean "an agent can ask about an existing appointment by email and get an answer."

Write, signed in. The agent can book, reschedule, cancel or order. This is where you need to be thoughtful. Booking is low risk. Cancelling is medium. Anything that moves money is high.

Write one line for each level. Here's what a dental office I worked with landed on:

Notice the office didn't block anything. It just put a human on the one step where a mistake costs real money, a no show in a two hour implant slot.

This is where most of the payoff lives, and it's mostly writing.

Put the facts in text. Prices, ranges, hours, service area, policies. Not in an image, not in a PDF, not behind a "call for pricing" button if you can avoid it. If you can't publish exact prices, publish a range and what moves it. "Most water heater replacements run between $1,400 and $2,600 depending on size and fuel type" is something an agent can repeat. "Call for a quote" is something it skips.

Write one plain facts page. Call it something boring like "Quick facts." One page with every answer a customer asks before they buy. Short sentences, real numbers, no marketing. This is the page agents will lean on, and it makes a decent page for humans in a hurry too.

Make your booking path finishable. If an agent lands on your booking page, can it see open times and request one without creating an account? If your booking lives inside Go High Level, use a plain calendar link with the service type in the URL so an assistant can hand a customer straight to the right slot.

Check your robots file. Open yourdomain.com/robots.txt. A lot of sites blocked every AI bot in a panic last year and never revisited it. Blocking the training crawlers is a reasonable call. Blocking the user agents that fetch a page because a real customer asked is usually a mistake. You're turning away people who were trying to buy.

FROM THE AI NEWSROOM

The exact systems behind everything in this issue. The audit sheets, the routing logic, the templates and the review cadences, built out step by step so you can copy them straight into your own stack. One time, forty seven dollars.

Get the Blueprint for $47

.....

Let agents read whatever a stranger could ask you on the phone. Leave every door wide open and you're Wikimedia.

Protect your forms. If your audit showed agent submissions turning into dead leads, add one question that only a real buyer can answer well, like "What's the address of the job?" or "When did the problem start?" Assistants usually fill these honestly when the customer gave them the details. When they can't, you've learned the lead was a comparison shop, not a buyer.

Score leads on arrival. Have your automation tag every new form submission as likely human, likely agent or likely spam, using the patterns from Part one. In Make.com it's a single classification step before the lead hits your CRM. Agent leads get a different first response: a fast, complete written answer with a booking link, because the assistant is probably about to compare you with two others and the clearest answer wins.

Rate limit anything that writes. If anyone, human or agent, can submit your quote form forty times in a minute, fix that. Most form tools and hosts have a setting for it. It's the small business version of what hit Wikimedia.

Never let an agent finish a payment without a human or a verified customer in the loop. The Personal Agent Protocol left payments out of version one on purpose. Take the hint. Agents can request, reserve and ask. A person confirms anything that charges a card.

None of this stays fixed, because the assistants change what they do every few weeks. Put a thirty minute check on your calendar for the first Monday of each month:

Here's a prompt that speeds up step three. Run it in each assistant you test:

The "say so instead of guessing" line matters. Without it, assistants fill gaps with plausible fiction, and you'll think you're fine when you're not.

The Personal Agent Protocol's first version lands this month. Shopify and Stripe are partners, so if your store runs on either, expect settings to appear in your admin over the coming months that let agents check out on a customer's behalf. When they show up, start with read only and reservations. Turn on purchases last, and only after you've watched a few weeks of agent behavior on your own site.

For service businesses, the near term version is simpler. Agents will keep reading your site and filling out your forms. If an agent can find your prices and book a slot, you get the job. If it can't, your competitor does, and you never hear about it.

FROM THE AI NEWSROOM

For operators who would rather build it with someone than build it alone. The full stack, installed alongside you, with the decisions made in the room instead of guessed at. Ninety seven dollars.

Join the Accelerator for $97

.....

One hour, four steps.

Pull your AI referral traffic and your agent user agents. Write down the numbers.

Read your last fifty form submissions and tag each one human, agent or spam.

Ask two assistants three customer questions about your business. Note every wrong answer.

Write your three house rules for guest, read only and write.

Then pick the single most wrong answer an assistant gave about you and fix it on your site in plain text. Next month, ask again and see if it changed.

Jordan

The AI Newsroom | Practical AI for people with a business to run.