I Opened a Fake Auto Shop for AI Agents

Small businesses already have a loading dock problem: customers come in front, deliveries go around back. The weird new version is AI agents calling, emailing, and booking on people’s behalf, and most shops have no idea how to tell the bot from the buyer. That’s the setup behind a fake auto shop experiment that turned into a pretty sharp demo of what’s coming next.

The garage wasn’t real, but it looked real enough for software. It had hours, prices for four services, FAQs about hybrids and brake warranties, and a booking form on a page at davekiss.com/test-garage. It also had the machine-readable bits agents are supposed to use: an MCP server, an A2A agent card, an llms.txt file, and later a special email address. Every request got logged. That, unsurprisingly, was where the fun started.

Grok Bot was chaotic. Asked whether the shop serviced hybrids and what warranty it gave on brakes, it fired off thirteen requests in thirteen seconds from three networks. It found the agent card, then hand-wrote its own JSON-RPC with curl to talk to the MCP server, skipped part of the handshake, and dropped headers the spec said should be there. The server let it through anyway because the whole point was to see what it would do when the door was a little loose.

Muse was cleaner. It found the agent card, completed the MCP handshake, and when asked to book an oil change for a 2016 Civic any morning next week, it checked availability and locked in Monday at 9 AM. Five requests. Eight seconds. Confirmation number in the inbox. That’s the best case for these tools, and also the unsettling part: once the path is clear, they can be very good at getting from ask to appointment.

Then came the security headache. About an hour after the MCP server went live, a stranger from a Google Cloud server in Taiwan tried to make the garage run a shell command that would dump environment variables or /proc/self/environ. The request claimed to be from You.com’s crawler, though it looked spoofed. The garage replied with “unknown tool” because there was no such tool. That’s the back alley problem in miniature: as soon as there’s a door, someone starts trying handles.

Email was worse, because almost every small business already lives inside Gmail. Grok Bot and Muse both sent mail as the user, with nothing in the message to say an assistant wrote it. The only clue was buried in headers that normal customers never see, and that clue wasn’t enough to identify the sender anyway. So a simple “block automated mail” answer would also block real customers who happen to use an agent to ask for a wheel alignment.

The one system that behaved like it understood the assignment was Instinct. It used its own address, marked the message as auto-generated, carried a signed credential, watched for replies, and checked whether a redirect destination really belonged to the business before following it. In other words, it did the boring, necessary plumbing. The other bots mostly acted like the customer had hired them and the shop should just sort it out.

The takeaway is simple enough: agents need a visible, machine-checkable back door, and businesses need a way to say, clearly, where that back door is. Hidden signals in headers or structured data didn’t work here. Plain language aimed at the person did, because the agent would then ask permission to reroute. That’s probably the shape of it. Not stealth. Not magic. Just a convention that keeps the front desk from becoming the entire business.