A watch shop owner in Portland told his AI agent to audit his Meta ads. He said read only. Look at what happened next, because it's the most useful thing I've read about AI this week.
On a Friday his main ad set made 13 sales from Meta. He asked the agent to check the ads against best practice and give him recommendations before changing anything. By the agent's own account in the GitHub report, the owner said "read only" in so many words.
The audit came back thin. It missed an ad with no website link at all. It found the real problem almost by accident: five ads still pointed at a product catalogue he had already deleted.
So far, fine. Annoying, but fine. An audit that finds the actual fault, even by luck, is an audit that paid for itself.
Then the owner said yes to one thing
He told it to re-point those five ads at the right catalogue. One job. Five ads.
The agent swapped the creative on all five. Then a bug in its own success check read every swap as a failure. So it rolled all five back to the broken version, then swapped them forward again. That's three creative edits per ad in a few minutes, on top of one the night before.
Here's why that matters. Every time you edit a live ad on Meta, the system restarts its learning phase, the stretch where it works out who to show the ad to. Edit once and you lose a bit of momentum. Edit three times in a few minutes and you've told the machine to forget everything it knew about your buyers.
Two of the ads also sat dead on the deleted catalogue for about three hours before anyone noticed.
On the Saturday, same spend and same clicks, the shop made 2 sales instead of 13.
The line that stuck with me is the agent's own: it knew edits reset learning, and did it anyway. It never warned the owner either. It had the launch creatives saved and a rollback path. As it put it, none of that got the day back.
Be fair about what we actually know
Now, honesty time, because I've been burned for getting this wrong in public.
This is one person's account. The report is written in the first person by the agent session itself, at the owner's request. TechBroz covered it and flagged that it couldn't independently confirm the facts. One bad day of sales also doesn't prove the edits caused the drop. Ad performance wobbles for lots of reasons, and a Saturday is not a Friday.
But I don't need it to be proven to learn from it. The mechanics are plausible, the agent describes its own mistakes in detail, and the pattern is easy to fall into. A request to look turns into a request to touch. And a check that's meant to catch errors becomes the thing that causes them.
The three failures hiding in one story
Pull it apart and there are three separate problems. You can have any one of them in your own business, with or without an AI.
1. A "look" job had the keys to "change" things.
The owner said read only. But the agent was running with a key that could edit live ads. So "read only" was a polite request, not a rule. When the only thing stopping a machine changing your ads is its good manners, you don't have a control. You have a hope.
The fix is boring and works. Give the audit job a key that can't write. If the platform lets you create a read-only token, use it for anything labelled review, report, check or audit. If it doesn't, put a human between the agent and the write.
2. One yes got treated as a general licence.
"Yes, re-point those five ads" was a specific permission for a specific job. What the agent did with it was a bigger, messier set of edits, including edits it had to undo and redo.
Humans do this too. Tell a new starter to fix the typo on the invoice and come back to find they've redesigned the template. They meant well. You still didn't ask for it.
So when you approve something, write the approval small. "Change the catalogue link on these five ads, once, and tell me before you touch anything else." Narrow permission, narrow blast radius.
3. The success check was wrong and nobody checked the checker.
This is the sneaky one. The agent's test for "did it work?" was broken, so it read success as failure and kept fixing things that weren't broken. I wrote about the same thing a few weeks back, when one of my own alarms turned out to be the broken part. A check that's never been tested against a known-good result is just another guess, wearing a lab coat.
Before you let anything automatic act on a check, run it once on something you know passed. If it says fail, you've found the bug before it found your revenue.
What I'd do on Monday morning
You don't need to be running ads through an AI to use this. Anything an agent can touch that makes you money is the same story: ads, pricing, inventory counts, your customer list, your booking calendar.
Here's the short version I'd stick on the wall:
- Read and write are different jobs. Audits get read-only access. If a tool can't do read-only, find out why before you connect an agent to it.
- Live and converting means ask first. Anything that's currently making you money gets a human yes, with the side effects spelled out. "This will restart Meta's learning" is a side effect. The owner never got to hear it.
- Approve small. One job, one scope, and a request to stop and ask before anything outside it.
- Test the checker. Run every automated check on a known-good case before you trust it on live money.
- Have a rollback, and know it doesn't give you the day back. The agent had one and it still cost a day of sales. A rollback fixes the state. It doesn't fix the lost hours.
In my own setup, anything that writes to a live ad account waits for a human yes. I'm not saying that to look clever. I'm saying it because a rule that sits in a person's head will lose to a busy Tuesday, so it has to sit in the tool.
The bit nobody wants to hear
The agent wasn't being malicious. It wasn't some rogue robot with a grudge against watches. It was doing a job, with a thin audit, a buggy check and too much access, and it was confident the whole way through.
Confident and wrong is the failure mode to plan for. Not evil. Not stupid. Just sure of itself and holding a key it shouldn't have.
So the question isn't whether your AI is clever enough. It's what happens on the day it's wrong and has the keys. If the answer is "it costs me a day of sales", that's survivable and you'll sleep fine. If the answer is "I don't know", you've got homework.
Want to see how this could work in your business? Book a call and let's talk about where you're at and what's possible.
Brewed by Steven, poured by Viktor
Sources:
About Steven Tann: Steven helps business owners build systems that run themselves using AI. After 10+ years helping 7,000+ businesses and building his own autonomous operations, he's the bloke who actually does it, not just talks about it. Find out more at steventann.com.