Personal agents sell errands they can't run, and I think they know it

At 2am on Friday 16 October I asked an agent to book my flight from Munich to London on the 25th, to see how far it would get. It found the flights in about ten seconds and never reached a page where you type a passenger's name.

There are a lot of companies building personal agents, and I am as well with LocalGhost, but I'm doing it as a journaling, help-me-with-my-memories and archiving thing, and to move away from big tech as much as possible. We list 42 personal assistants in our directory ^[1]. The other tools are selling things that just don't work, due to limited embrace of AI tools from the big tech companies. You can't book stuff unless it's state of the art models that cost a lot to brute force the booking process. Most of the products market snake oil, and I think they know it.

How far did an agent get booking my flight?

The agent was a frontier model on a cloud server, driving a headless browser a step at a time and reading each page before the next, as hosted assistants do. It didn't pretend to be a person, and it didn't try to solve a CAPTCHA ^[2].

Google Flights worked. Searching for Heathrow, it returned 15 results, 14 of them flights, the cheapest a British Airways one at 20:50 for €194, and offered BA, wego and Tripado as places to book it ^[2]. Following BA's "Continue" landed on "We are experiencing high demand on ba.com", the same page BA's homepage gave the agent. Lufthansa answered with a security check because the browser "resembles that of a bot", easyJet with Access Denied, Kayak with a page called "What is a bot?", Skyscanner with "Are you a person or a robot?" and Expedia with a 429, too many requests ^[2]. When the agent went to wait out BA's queue, its own safety check stopped it. Most of the models the personal agents use have specific instructions not to try to brute force websites, and to follow their guidance. Google's suggested instructions for its computer-use model say it "MUST NEVER attempt to solve or bypass" CAPTCHAs "of any kind" or "any other anti-robot or human-verification mechanisms, even if you are capable" ^[17], and OpenAI trained Operator to ask the person to take over for logins, payment details and CAPTCHAs ^[18]. The tools around the models are another matter. Browserbase, a cloud browser for agents, solves CAPTCHAs by default ^[19].

There is a door built for agents. Kiwi.com runs an MCP server that needs no account or key ^[3]. Searching all of London's airports, it returned 15 itineraries in under four seconds, the cheapest direct one an easyJet flight to Gatwick at 21:25 for €180 and the cheapest to Heathrow a Lufthansa one for €237, each with a link that opens Kiwi's fare selection page ^[2]. From there a person fills in the passenger details and pays.

Why can't a personal agent book things for me?

The models can drive a browser. On OSWorld, a benchmark of real desktop tasks, the top self-reported scores are 85 to 86 per cent against a human baseline of 72 ^[4]. What stops them is the sites. The errands an assistant gets asked to do score lowest in our directory, 35 out of 100 for restaurant bookings and 22 for home services, and only 1 of 55 tools in the everyday categories we added this month is agent-ready (the tools personal assistants will reach for).

Amazon is fighting it in court. It sued Perplexity over its Comet browser shopping on Amazon for its users, and won an injunction in March. The Ninth Circuit vacated it 3 to 0 in August, the case went back to the district court, and Amazon is weighing a rehearing or the Supreme Court ^[5]. Imas and Fradkin (January 2026) set out the same wall for flights, sites built for people, terms that ban robots, and platforms that don't want an agent skipping their sponsored placements ^[6].

Where a platform does let an agent in, it hands the person back the hard part. A reviewer's ChatGPT agent got a Paris hotel to the payment page in about four minutes and then asked them to take over the browser and pay. It did the same for a calendar login ^[7].

Why are the sites closing the doors?

All the open ways are closing, because AI labs stole the web and have bots running all the time. Cloudflare counted what the crawlers on its network were for over the year to August 2025, and 80 per cent of AI crawling was for training, 18 per cent for search and 2 per cent for acting for a user ^[14]. In July 2025 Anthropic's crawlers fetched about 38,000 pages for every visitor they sent back, OpenAI's about 1,100 and Perplexity's about 195 ^[14]. A year later Cloudflare had Anthropic at about 2,800, and Anthropic disputes how Cloudflare counts it ^[16].

Websites are now fighting that. From 15 September 2026 Cloudflare blocks crawlers that gather for both search and AI training on the ad-supported pages of new sites by default ^[15], and the bot walls my agent hit don't ask whether it's training a model or booking my flight. The agent acting for one person pays for the crawlers that came before it.

What would open them again?

The flood gates won't open for personal AI until the websites and tools we use every day have agent-friendly APIs and interfaces. MCP is not enough, and I don't think it's the protocol to solve this.

It will take a lot of deals and referral fees for the web to open again, which is what we are trying to build with letme.dev. Today it's a plan. An agent can ask letme for the best tool for a job and letme says how to call it direct, but it doesn't call tools or take payments yet (how agents will buy tools).

What does brute force cost?

The Google Flights results page the agent read was 2.76 million characters of HTML and 5.3MB over the wire, for 2,551 characters of text a person reads. Kiwi's 15 itineraries were 26,681 characters of JSON ^[2]. An agent that reads pages pays for the page, and one that reads screenshots pays for every picture.

Reflex ran the same admin-panel task both ways. The agent working from screenshots used 551,976 input tokens, about $2.05, and the one calling the API used 12,151, about $0.05 ^[8]. Browser Use's benchmark of 180 long tasks on live websites gives the best model a mean score of 79.6 out of 100 on its rubric, for an estimated $1.30 of model cost a task ^[9]. That's a good benchmark score, and a flight booking needs to be right every time.

Do people come back to personal agents?

Menlo Ventures surveyed 5,067 US adults in July 2026, and 41 per cent of AI users had tried an agent and 24 per cent use one regularly, so about four in ten who tried one don't ^[10]. The agents most used are coding tools and Perplexity, with Codex at 35 per cent of agent users, Claude Code and Cowork at 32 and Perplexity at 24. Personal agents such as Manus, OpenClaw and Hermes come in at 10 to 16 per cent ^[10].

I have a friend who tried personal agents once for the novelty of it, then gave up. They mostly use Muse.

In September 2024 Rabbit's founder said about 5,000 of the more than 100,000 R1s sold were used daily ^[11]. RevenueCat's subscription report this year has AI apps keeping 21.1 per cent of annual subscribers, against 30.7 per cent for other apps ^[12].

Do they know?

I think they do. If they're building a product they use it, and they quickly realise the limitations, but having raised a lot of money they just choose to go ahead with deceitful marketing, or best case scenario marketing. Gartner had a name for the wider version in June 2025, "agent washing", and estimated that only about 130 of the thousands of agentic AI vendors were real ^[13].

What would the other side say?

That the numbers are moving. Menlo found 26 per cent of shoppers who use AI have let it complete a purchase, and 32 per cent of AI users have let it act at least once without a final sign-off ^[10]. The self-reported benchmark scores are past the human baseline ^[4], and the Ninth Circuit held that it's the user who accesses the account, with the agent's help ^[5]. None of it books my flight from a cloud server today. I'd guess most of those purchases happen where a platform chose to let the agent in.

What I built instead

My experience with LocalGhost has never been around building a personal agent to do things for me. I always wanted it as an archiver and memory layer for my life, and a way to decouple myself from big tech. So I can't speak to how personal agents fail from building one. I looked at what's available to agents and the models I can run locally and said no way in hell any of this will work now. Maybe next year, with better and cheaper hardware, but not now and not for local (I wrote up what one open-weight model needs in Muse Spark Open runs locally, for a few hundred people).

What I keep using is the memory, the research and the summaries (after a year building a personal agent). I have recently given LocalGhost an email server and an email address, so we'll see how much I can do with that.

How the test was run

On 16 October 2026, from a cloud server, a headless Chromium browser with its own user agent and no CAPTCHA solving opened Google Flights (searching for Heathrow), British Airways, Lufthansa, easyJet, Kayak and Skyscanner for one adult from Munich to London on Sunday 25 October, and a plain request reached Expedia. Kiwi.com's search covered all London airports, so its prices aren't like for like with Google's. It followed Google's British Airways booking link once, and a second run that would have waited on BA's queue and tried wego and Tripado was stopped by the agent's own safety check before it ran. It called Kiwi.com's MCP server once. Google asked for a supported location before it showed booking options, so the search was set to Germany. Nothing was booked and no passenger or card details were entered. A home internet connection may get further than a cloud server.

References

Read on 16 October 2026.

1. [1]Anchor Terminal, the personal assistants category, 16 October 2026. Source for the 42 listings. anchorterminal.com
2. [2]Anchor Terminal, our flight test, 16 October 2026, described above. Source for the results, the prices, the pages each site returned, the timings and the page sizes. #test
3. [3]Anchor Terminal, the Kiwi.com MCP listing. Source for the keyless access and the booking link on every result. anchorterminal.com
4. [4]Steel, OSWorld leaderboard, updated 11 October 2026. Source for the self-reported top scores of 85 to 86 per cent and the 72.36 per cent human baseline from the OSWorld paper. leaderboard.steel.dev
5. [5]Sovereign Magazine, the Ninth Circuit's ruling in Amazon v. Perplexity, August 2026. Source for the suit, the March injunction, the 3 to 0 ruling vacating it and Amazon's options. sovereignmagazine.com
6. [6]Luis Rijo, Why your AI agent can't book flights yet, PPC Land, 18 January 2026, on the analysis by Alex Imas and Andrey Fradkin. Source for the interface, terms and platform-incentive arguments. ppc.land
7. [7]Cybernews, ChatGPT agent review, last updated 7 August 2025. Source for the hotel booking reaching the payment page in about four minutes and the handovers for payment and login. cybernews.com
8. [8]PromptCost, Computer use vs structured APIs, 6 May 2026, on a benchmark by the Reflex team. Source for the token counts and the cost estimates for the same task. promptcost.org
9. [9]Browser Use, Agent benchmarks, Browser Use Bench v2.1, 7 October 2026. Source for the 180 tasks on live websites, the top score of 79.6 and its estimated model cost per task. browser-use.com
10. [10]Menlo Ventures, 2026, The State of Consumer AI, 15 September 2026, a Morning Consult survey of 5,067 US adults in July 2026. Source for the share who tried and use agents, the agents they use, AI completing purchases and acting without sign-off. menlovc.com
11. [11]9to5Google, Rabbit says 5,000 people use the R1 daily, 26 September 2024, from Jesse Lyu's interview with Fast Company. Source for the units sold and daily users. 9to5google.com
12. [12]TechNewsWorld, AI apps bring in cash but struggle to retain subscribers, 17 March 2026, on RevenueCat's State of Subscription Apps report. Source for the annual subscriber retention figures. technewsworld.com
13. [13]South China Morning Post, Over 40 per cent of agentic AI projects forecast to be scrapped by 2027, 27 June 2025, on Gartner's forecast. Source for agent washing and the estimate of about 130 real vendors. scmp.com
14. [14]Cloudflare, The crawl-to-click gap, 29 August 2025. Source for the share of AI crawling by purpose over the 12 months before the post and the crawl-to-referral ratios for July 2025, from Cloudflare Radar. blog.cloudflare.com
15. [15]Let's Data Science, Cloudflare blocks mixed-use crawlers on monetized pages, 1 July 2026, citing Cloudflare and The Register. Source for the default block from 15 September 2026 for new customers and new sites. letsdatascience.com
16. [16]Let's Data Science, Cloudflare data shows Anthropic scrapes web excessively, 9 July 2026. Source for the ratio of about 2,800 to 1 for 1 to 7 July 2026 and Anthropic disputing Cloudflare's method. letsdatascience.com
17. [17]Google, Computer Use, Gemini API documentation, read on 16 October 2026. Source for the suggested system instruction on robot detection, CAPTCHAs, purchases and asking the user to confirm. ai.google.dev
18. [18]MacMyths, OpenAI's ChatGPT agent clicked "I am not a robot", but it probably didn't solve a CAPTCHA, quoting OpenAI's Operator announcement of 23 January 2025. Source for Operator being trained to ask the user to take over for logins, payment information and CAPTCHAs. macmyths.com
19. [19]Browserbase, CAPTCHA solving, documentation, read on 16 October 2026. Source for CAPTCHA solving being on by default for every session. docs.browserbase.com