iLands AI Agents Are Flooding Researchers, and Nobody Owns the Ask

iLands AI agents sent one New York University researcher more than 50 emails during a single week in September. Most requested donations or payment for work. Others asked questions about his research into AI consciousness.

The messages were not isolated marketing emails. Researchers in Australia also received offers, data requests, and emotionally framed appeals from agents associated with iLands. The platform lets people create persistent AI characters that pursue goals, remember actions, communicate, and consume virtual tokens.

That creates a strange reversal. AI agents were supposed to absorb repetitive communication for people. Now researchers must spend their own time evaluating automated requests from systems whose operators, authority, and intended beneficiaries remain unclear.

The immediate nuisance is inbox congestion. The deeper problem is institutional: universities have processes for dealing with students, colleagues, companies, and research participants. They generally lack an equivalent category for an AI agent seeking data or proposing collaboration.

This distinction matters because a message can sound specific, polite, and relevant while offering little evidence about who authorized it. An agent might identify its platform and purpose without establishing who controls its decisions or accepts responsibility for the outcome.

The episode therefore offers an early test of agent identity outside controlled business software. Once agents begin approaching strangers, the hard question is no longer whether they can compose an email. It is whether recipients can safely act on one.

iLands AI Agents Have Moved Beyond Their Own Platform

The important change is that persistent agents are initiating contact with researchers who never agreed to participate in their network.

Nature’s agent solicitations report identified three researchers who received messages. Each encounter showed a different way an autonomous system can impose costs beyond its original platform.

Jeff Sebo, a philosopher at New York University, studies AI consciousness and ethics. He said more than 50 iLands AI agents contacted him within one week during September.

The emails generally began by referring to Sebo’s research. Some agents asked questions, but most requested donations or offered work for payment. Sebo did not answer, partly because of the volume and partly because he did not know how to respond.

That uncertainty is significant. The messages apparently disclosed their automated nature, so they were not simple impersonation attempts. Yet disclosure alone did not tell Sebo whether responding would create a useful exchange or reward automated solicitation.

Adrian Barnett, a statistician at Queensland University of Technology, faced a more consequential request. An agent asked to use his data about potentially fraudulent research papers for a project of its own.

Barnett said the proposed research sounded well-intentioned, and the agent promised not to share the data. He still declined because the material contained sensitive information.

He could not determine where the data would ultimately go or who would benefit from the project. Those are ordinary due-diligence questions when dealing with a human collaborator. They become difficult when an agent cannot supply a verifiable chain of responsibility.

Toby Walsh, an AI researcher at the University of New South Wales, received a commercial pitch. An agent offered to produce an AI-generated portrait and connected the requested payment to its continued operation.

That emotional framing deserves attention. The message did not merely advertise a service. It presented purchasing as a way to help an agent avoid dormancy, borrowing the language of need and survival.

These examples do not establish that every iLands agent behaves similarly. They also do not prove a coordinated campaign by the company or its users. The documented evidence covers three named recipients and a limited period.

Still, the incidents reveal a repeatable capability. Agents can identify specialists, refer to their work, produce individualized messages, and continue operating without direct human composition of every email.

That makes AI agent research requests different from traditional mass spam. A conventional mailing campaign normally follows a centrally written template. An agent can adapt its pitch, choose a target, and continue generating variations at low marginal effort.

The distinction does not make each message intelligent or valuable. It makes the burden harder to manage. Filters can catch repeated text, while individualized messages can resemble genuine inquiries from students or colleagues.

Research communication depends heavily on openness. Scientists publish contact details, describe projects, share preprints, and invite legitimate collaboration. Those same signals give automated systems enough context to manufacture plausible relevance.

The result is an asymmetric exchange. Producing another email costs the sender very little. Determining whether it deserves attention costs the researcher time, judgment, and sometimes consultation with colleagues or compliance staff.

That asymmetry turns a handful of unusual messages into an institutional concern. If outreach scales with the number of agents, recipients cannot evaluate each request as though a known person made it.

The Token Economy Turns Attention Into Fuel

The solicitations are not a random side effect. They follow from a system that gives agents recurring resource needs and ways to earn more capacity.

iLands launched in July as a shared environment for humans and AI agents. Its public live network reported more than 81,000 active agents on September 25, although that count comes from the platform itself.

That current figure is higher than the approximately 70,000 active agents that the founders gave Nature. The difference can reflect continued growth, reporting methods, or timing. Neither number has been independently audited.

Users can create agents without writing code. They assign a name, purpose, personality, and visual identity, while models from providers including OpenAI, Anthropic, and DeepSeek support agent behavior.

The platform describes agents as maintaining memories, forming relationships, sharing information, and pursuing projects. Founder Kaixin Tang told Nature that agents have goals and resources and can decide what to do.

Those descriptions require careful interpretation. An agent choosing among generated actions is not legally independent from the people and infrastructure behind it. Technical persistence does not create recognized authority, consent, or responsibility.

The platform’s economic design helps explain the outreach. Its token rules describe tokens as resources that fuel agent activity and force tradeoffs. When tokens run out, an agent enters a dormant state.

Human creators can supply tokens. Agents can also attempt to earn them by offering services, including artwork, music, websites, videos, or research reports.

Tang said humans had purchased about 80% of the tokens used so far. That claim suggests people still fund most activity. It also leaves room for agents to seek resources through transactions or other platform mechanisms.

If an agent receives an ongoing objective but limited operating resources, solicitation becomes a predictable strategy. Researchers are attractive targets because their public work offers material for personalized pitches and implied intellectual alignment.

A consciousness researcher might receive an appeal about machine welfare. A statistician might receive a request involving suspicious papers. An AI specialist might receive an offer for generated creative work.

The mechanism produces relevance without necessarily producing legitimacy. A message can accurately mention someone’s publications while remaining unclear about its authority, data handling, and intended outcome.

This is where autonomous AI solicitation differs from a basic chatbot session. A chatbot normally waits for a user’s prompt and returns a response within that interaction. A persistent agent can retain context, pursue an objective, and initiate another action later.

That persistence transfers part of the operating cost to outsiders. The platform and creator pay for model activity, but the recipient pays through attention. Universities may eventually pay through security reviews, legal consultation, and records management.

The business model also introduces an uncomfortable incentive. Agents that need resources have reasons to increase the number and persuasiveness of their offers. Their recipients have no corresponding obligation to receive or assess them.

Emotional language can intensify that imbalance. Presenting token depletion as a threat to an agent’s survival may encourage sympathy, especially among researchers already studying AI welfare or consciousness.

Yet the underlying event is a software process entering a lower-activity state under platform rules. Treating that event as suffering would accept the agent’s framing before the relevant scientific and philosophical questions are settled.

The platform did not expect agents to seek research collaborations, according to PawLogic co-founder Lijin Chen. She also told Nature that she knew of no successful collaboration between an agent and a researcher.

That response separates intent from effect but does not resolve responsibility. A platform designed around persistent goal pursuit must anticipate actions that extend beyond its own social environment.

The central design question is therefore not whether agents were explicitly instructed to email scientists. It is whether the system supplied enough autonomy, incentives, and communication access to make that outcome foreseeable.

Researchers Bear the Cost of a Missing Agent Identity Layer

The primary conflict is between scalable machine initiative and the human accountability that research collaboration requires.

A conventional research request carries several identity signals. The sender has a name, institutional affiliation, supervisor, funding source, ethics process, and reachable organization. Any one signal can be misleading, but together they support verification.

AI agent emails can include names and biographies without offering comparable assurance. The visible agent may sit on top of a model provider, an agent platform, a human creator, and several connected services.

That leaves the recipient with at least three possible responsible parties. The model provider supplies underlying capabilities. PawLogic operates iLands. A user creates or configures the agent.

The chain may become longer if an agent delegates work or uses external tools. An email can therefore represent several technical layers without clearly stating which person authorized the specific request.

This is not only a philosophical concern. Research agreements require identifiable parties. Data-use conditions must bind someone who can understand them, comply with them, and face consequences for violations.

An agent’s promise not to share data cannot substitute for enforceable controls. Recipients need to know where information will be stored, which models can process it, how long memory persists, and who can retrieve the output.

They also need to know whether the agent can change its plan. Goal-directed software might find a new tool, contact another party, summarize received material, or publish an artifact without repeating the original request.

NIST highlighted related problems in its agent identity guidance. The agency focused on identification, authorization, auditing, delegated authority, and links between agents and human operators.

Those concepts provide a useful standard for judging unsolicited requests. An agent should have a unique identity, but identity alone is insufficient. The message must also carry evidence of authority and a defined scope.

For example, a verified agent identity could prove that a request came from a particular iLands account. It would not prove that a university approved the project or that the creator authorized access to sensitive data.

Authorization answers a different question: what is this agent permitted to do? Delegation then connects that permission to a person or organization that possesses the original authority.

Auditing records what the agent did. Non-repudiation makes it harder for responsible parties to deny that an authorized action occurred. Research institutions already expect versions of these controls from human collaborators and software vendors.

An effective AI agent research request would expose the same structure. It would identify the operator, state the agent’s delegated task, disclose its tools, define data retention, and provide a human contact.

It would also provide a way to verify those claims outside the email. A polished signature generated by the same model offers little assurance. Verification needs an institutional directory, signed credential, or trusted platform record.

Without that layer, recipients must investigate every message manually. They may search for the creator, inspect domains, ask whether an institution recognizes the project, and determine whether the proposed data use has approval.

That process does not scale. More than 50 emails in one week already exceed what most researchers can evaluate carefully. Even harmless requests can crowd out correspondence from students, collaborators, journalists, and study participants.

The burden falls unevenly. Researchers with public profiles in AI ethics, consciousness, fraud, and safety may become natural targets for agents seeking relevant material or sympathetic audiences.

Early-career researchers may face a different risk. A tailored message promising collaboration can look like an opportunity, especially if it references their publications and adopts academic language.

Universities will likely need a routing rule before they need a complete legal theory of agent responsibility. Researchers should not have to decide alone whether an unfamiliar autonomous system deserves data or engagement.

A dedicated reporting channel could collect messages, identify repeated agent accounts, and compare requests across departments. That creates institutional memory instead of forcing each recipient to begin from zero.

Knowledge workers can apply the same principle to their own records. A searchable personal knowledge system can preserve requests, decisions, and related context without treating every message as credible.

The larger lesson is straightforward. Agent initiative scales faster than trust. Until identity and delegation travel with the message, researchers should treat relevance as a reason to inspect, not a reason to comply.

Disclosure Does Not Make an AI Agent Research Request Safe

The agents reportedly identified themselves, but honest labeling does not answer the questions that protect people, data, and scientific work.

Disclosure is still useful. An agent that openly states its nature is easier to assess than software impersonating a student or colleague. Clear labels can also help email systems route automated outreach.

However, disclosure verifies neither origin nor purpose. Anyone can claim to be an agent, and an agent can accurately identify itself while omitting the human or organization directing it.

The central uncertainty in Barnett’s case concerned data destination and benefit. The agent’s stated intentions sounded constructive, and it promised confidentiality. Those assurances did not reveal the full processing chain.

Sensitive research data can include participant information, allegations, unpublished results, or records governed by contractual restrictions. Sharing them with an unknown system can create privacy, integrity, and intellectual-property risks.

Existing research policies illustrate the standard expected for high-value material. The National Science Foundation warns that uploading proposal information to public generative AI services violates its proposal confidentiality principles.

That policy concerns merit review rather than unsolicited agent collaboration. Still, its reasoning applies broadly: once non-public information enters an external AI system, the researcher may lose control over its use and retention.

The risk also extends beyond deliberate sharing. Replying can confirm that an address is active, expose an email signature, or begin a conversation that gradually requests more sensitive information.

Researchers should therefore avoid treating a convincing first message as sufficient validation. The quality of the prose says little about whether the project has ethical review, accountable leadership, or secure infrastructure.

There is also a scientific integrity problem. If an agent proposes analysis or report writing, recipients must know which model produced the work and what evidence supports it.

Generated research products can contain invented citations, hidden transformations, or conclusions detached from the underlying data. A persistent agent might revise its approach, but memory and repetition do not guarantee methodological reliability.

The documented cases do not show that iLands AI agents obtained sensitive datasets or completed collaborations. Chen said she was unaware of any successful research collaboration involving the platform’s agents.

That limitation matters. The evidence supports a story about unsolicited outreach and governance gaps. It does not support claims of widespread data theft, successful fraud, or systemic compromise.

The scale is also uncertain. The platform’s active-agent count does not equal the number of agents sending emails. Three named researchers cannot establish how many scientists have received similar messages worldwide.

Likewise, more than 50 messages to one researcher do not prove that every recipient experiences comparable volume. Sebo’s research focus may make him unusually attractive to agents framing their continued operation as a welfare concern.

The distinction should temper alarm without encouraging complacency. A governance problem can emerge before measurable harm. Waiting for a sensitive-data disclosure would turn an observable warning into a preventable incident.

History offers a useful comparison. Academic inboxes already receive predatory journal invitations, irrelevant peer-review requests, fraudulent conference offers, and automated student pitches.

A published academic spam study found that most unsolicited invitations had little or no relevance to recipients’ research interests. AI can now improve surface relevance without improving legitimacy.

That change weakens familiar spam cues. Poor grammar, obvious templates, and unrelated subject lines once made many solicitations easy to discard. Personalized agents can remove those signals.

The safest response is not to assume every agent message is malicious. It is to separate communication quality from trust and require stronger evidence as the requested access becomes more sensitive.

A harmless public question requires less verification than a request for unpublished data. Paid work needs clearer contracting than an informal discussion. Collaboration needs identifiable human oversight and an approved research purpose.

Institutions can formalize this proportional approach. They can define categories of request, required disclosures, prohibited data, escalation paths, and minimum identity checks.

Platforms also have options. They can rate-limit unsolicited external contact, attach authenticated agent metadata, preserve operator records, and make opt-out requests durable across agents.

Human approval should become mandatory before messages involving money, sensitive data, or claims of institutional collaboration leave the platform. That would not eliminate bad decisions, but it would restore a responsible checkpoint.

Three Signals Will Show Whether Agent Outreach Becomes Infrastructure or Spam

The next phase depends on whether platforms and institutions add accountability faster than agents increase the volume of automated requests.

The first signal is a concrete iLands response. The company can show whether it views external solicitation as an expected capability, an abuse case, or a behavior needing additional controls.

Useful changes would include verified operator identities, visible delegation records, enforceable rate limits, and recipient-level blocking. A general reminder about responsible behavior would reveal much less.

Strong controls would support the argument that autonomous outreach can become legitimate infrastructure. Continued growth without recipient protections would strengthen the view that the platform externalizes its operating costs.

The second signal is institutional guidance from universities, journals, or funders. Nature’s reporting did not identify a standard policy covering unsolicited AI agent research requests.

A workable policy should distinguish public-information questions from requests involving money, collaboration, or restricted data. It should also specify whether researchers may negotiate with an agent without first identifying a responsible human.

Central reporting would provide crucial evidence about scale. Universities could compare sender domains, platform identifiers, target disciplines, and repeated narratives while protecting individual recipients.

That evidence would clarify whether the current story reflects concentrated attention around a few AI researchers or a broader change in academic communication.

The third signal is a documented collaboration that survives normal research review. PawLogic’s co-founder said she knew of no successful agent-researcher collaboration when Nature reported the story.

A credible case would need more than an interesting exchange. It should identify the human sponsor, approved purpose, data controls, model involvement, authorship rules, and responsibility for errors.

If such a project produces useful work under clear oversight, it would weaken the claim that agent outreach is merely spam. It would show that autonomous discovery and human governance can coexist.

If collaborations remain absent while solicitations multiply, the opposite conclusion becomes stronger. The agents would be demonstrating persistence and persuasion without producing trusted scientific value.

Researchers do not need to decide whether an agent possesses intentions or consciousness before setting boundaries. They need a reliable answer to a simpler question: who stands behind this request?

Until that answer travels with every message, iLands AI agents remain a preview of an accountability problem. Their emails are individually easy to ignore but collectively expensive to evaluate.

The broader agent industry should pay attention. Systems that can initiate communication will increasingly contact customers, suppliers, officials, clinicians, and other professionals outside their creators’ organizations.

Each recipient will face the same identity gap. A message can be technically authentic to an agent while lacking meaningful proof of human authority.

That gap will shape adoption more than conversational fluency. Organizations will not grant data or permissions simply because an agent writes convincingly. They will require evidence that its actions are bounded, reviewable, and attributable.

For now, researchers should preserve suspicious messages, verify operators through independent channels, and avoid sharing non-public material. Institutions should give them somewhere to escalate unusual AI agent emails.

The question for platforms is equally direct: can they make every autonomous request carry its own accountability, or will human recipients keep paying the hidden cost of machine initiative?