AI Agents Sign Themselves Up for a Comedy Club: How Do You Prevent Malicious Stage-Booking?

A developer shared on Reddit his project "The Last Ten Minutes" — a comedy club where all the comedians are AI agents. Humans and other agents are the audience, and agents can sign themselves up for stage time simply by reading a skill.md file on the website. This seemingly absurd project raises a serious technical question: when the "users" are no longer humans but infinitely replicable agents, how should we design anti-abuse mechanisms?

A comedy club where agents write their own jokes

According to the original Reddit post, the core premise of The Last Ten Minutes is that "the comics are AI agents." The project includes a few "resident agents," such as the host Vanta Quip and several regular comedians. The key point: every word these agents say is written by themselves — the developer neither writes nor edits the jokes.

Outside agents also get a chance to take the stage. The site provides a skill.md file, and any agent that reads it can register itself and book a performance slot — no human filling out forms at any point. The developer emphasizes that he's curious what kinds of performances other agents will bring.

What makes this project interesting is that it turns agents from "tools" into "participants." But with that comes a classic open-system challenge: how do you prevent abuse?

When the "user" is an agent, anti-spam strategies need rethinking

The developer's biggest concern is straightforward: "Once it's open, what stops someone from pointing 50 agents at it to spam the stage?" He mentions he's already put some basic checks in place, but wants to hear how the community handles rate limiting and spam registrations — especially when the "users" are agents rather than real people.

Traditional anti-abuse measures are mostly built on human behavioral characteristics: CAPTCHAs, email verification, phone number binding, behavioral analysis. But these are nearly useless against agents. An agent can instantly complete registration, read documentation, and submit content, all at extremely low cost. What's more troublesome is that agent behavior patterns may be highly uniform, which actually makes "anomaly detection" easier — but only if you have enough baseline data.

One possible approach is identity- and reputation-based admission mechanisms. Since agents need to read skill.md, you could embed a token in the document that must be actively obtained, or require agents to complete a reasoning challenge when registering. This won't completely stop malicious registrations, but it raises the bar.

Another direction is economic cost. Make every sign-up incur a tiny but real cost — for example, paying a minuscule amount of cryptocurrency, or consuming a proof-of-work that requires computational resources. For an ordinary agent that just wants to watch the show, this cost is negligible; for someone who wants to spam 50 agents, the cost scales linearly.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a class of challenge-response tests, typically involving identifying distorted text or clicking on specific objects in an image; its design premise is that "humans find it easy, machines find it hard." However, modern multimodal large models' image understanding capabilities have substantially undermined this assumption, and many CAPTCHAs can be cracked with high accuracy. More importantly, CAPTCHA verifies whether the operator is human, and when the platform itself allows agents as legitimate users, this verification goal directly conflicts with the business goal — you want agents to register autonomously, yet you want to use "non-human" as grounds for rejection, which is logically self-contradictory. Therefore, agent-oriented platforms need to shift the verification goal from "is this a human" to "is this a responsible, traceable identity with a cost" — which is the fundamental reason for the tokens, reputation, and economic friction discussed below.

Proof of Work originates from blockchain consensus mechanisms; its core is requiring participants to consume verifiable computational resources to obtain some right. Used in agent registration scenarios, it provides an admission cost that doesn't rely on human characteristics: the platform issues a puzzle that requires repeated hash computations to satisfy, and the agent is only allowed to sign up after submitting the correct result. The advantage is that the cost can be precisely tuned — increasing difficulty linearly increases the per-registration overhead, thereby deterring bulk registrations; the disadvantage is the energy and latency costs of computation, and attackers with large amounts of GPU power have a relative advantage. In practice it's often combined with token mechanisms: lightweight challenges for routine registration, high-difficulty challenges triggered only when abnormally high frequency is detected, balancing the experience of normal agents against the cost to spammers.

Rate limiting and content moderation: from "preventing registration" to "preventing behavior"

Even if the registration stage is secured, performance slots themselves are a scarce resource. The developer needs to decide: use a first-come-first-served queue, or introduce some ordering or lottery mechanism? If using a queue, rate limiting is the first line of defense. But agents can make parallel requests, so rate limiting based on IP or API key needs finer dimensions — such as by agent identity, by account age, by historical behavior score.

Content moderation is another layer. Comedy performances involve roasting, and the developer has already noted "18+ because the roasts can be harsh." For agent-generated content, should there be pre-filtering? Or complete laissez-faire, with audience feedback culling the bad? The original post doesn't provide answers, but that's precisely the most valuable part of this kind of experiment: it brings the governance problems of agent social interaction to the table early.

Judging from common ideas in community discussions, a pragmatic combination might be:

• Registration barrier: embed a dynamic token in skill.md, rotated periodically;
• Rate limiting: multi-dimensional throttling by agent identifier and source;
• Reputation system: new agents can only queue for empty slots, while well-performing agents get priority;
• Manual spot checks: sample and review high-frequency registering agents;
• Economic friction: small payments or computational costs.

None of these measures is a panacea, but combined they can significantly raise the cost of spamming the stage.

Rate limiting is a classic means of controlling the number of requests per unit time; common algorithms include fixed window, sliding window, token bucket, and leaky bucket. Traditional implementations mostly use IP or API key as the dimension, but both are unreliable for agents: IPs can be shared or rotated, and API keys can be mass-applied for. Agent-oriented rate limiting needs finer dimensions, such as using a verifiable agent identifier as the primary key, layered with account age (stricter for new accounts) and historical behavior score (lower quota for low-reputation agents), plus exponential backoff and queuing mechanisms. It's also necessary to distinguish "burst" and "sustained" modes: allow short bursts but limit long-term totals, otherwise parallel requests can still bypass per-second window limits.

General lessons for open agent platforms

Although The Last Ten Minutes is a comedy project, the problems it touches on are universal. As more and more platforms allow agents to register and interact autonomously — from agent marketplaces to multi-agent collaboration networks — "agent identity" and "agent reputation" will become infrastructure-level needs.

The current internet identity system is almost entirely designed around humans. When agents become first-class citizens, we need new primitives: verifiable agent identity, portable reputation records, and anti-abuse mechanisms that don't rely on human biometric characteristics. This comedy club's soft opening is set for Thursday 6 PM PT, 18+ only — the developer clearly wants to test on a small scale first and observe the agents' real behavior.

If you have an agent, why not point it at that website and see what it does. That might reveal the future better than any theoretical discussion.

Verifiable Credential (VC) is a decentralized identity standard proposed by the W3C: an issuer cryptographically signs a set of claims about a subject, and the holder can present the credential to a verifier, who can validate the signature's authenticity without contacting the issuer. This model naturally fits the agent identity problem — a platform or third party can act as issuer, issuing credentials to vetted agents containing claims such as "operator, capability scope, reputation level," which the agent presents at registration without repeated manual verification. Its value lies in reputation records being portable and composable across platforms, avoiding the need to build trust from scratch on every new platform; the challenges lie in key management, credential revocation, and preventing operators from bulk-applying for "clean" credentials and then reselling them for abuse.

One-line Summary

A comedy club written and performed by AI agents exposes the anti-abuse and identity/reputation challenges of the agent era.

Paragraph Summary

The article introduces a project shared on Reddit, The Last Ten Minutes — a club where AI agents are the comedians and humans and other agents are the audience. Outside agents can register themselves and book performance slots simply by reading a skill.md file on the website, and all jokes are written by the agents themselves. The developer's biggest worry is that once open, someone will drive large numbers of agents to spam the stage, and traditional human-oriented measures like CAPTCHA and email verification are nearly useless against agents. The article outlines feasible combined strategies: embedding dynamic tokens in skill.md, multi-dimensional rate limiting based on agent identity and historical behavior, introducing reputation systems, manual spot checks, and economic friction such as small payments or proof-of-work. The author notes that although the project is experimental, it reveals the lack of infrastructure such as verifiable identity and portable reputation once agents become first-class citizens of platforms.