The AI services industry is selling costumes: a new name on the same prompts, invoiced at a higher ticket each season. The labs aren't reading the file being billed, the platforms are purging the public version by the billion, the FTC has filed thirteen cases, and the research has measured the rework tax to the dollar. This report is the audit, with every number sourced.
The independent research already ran the audit.
Nine figures, none of them ours. Every one is traceable to a study, a ruling or a platform log listed at the end.
of published llms.txt files received zero AI requests in May 2026.1
Ahrefs · 137,210 domainsconfirmed security vulnerabilities across 2,259 public MCP servers.7
Trend Micro · July 2026of public MCP servers require no authentication at all.8
BlueRock · 2026of enterprise engineering leaders had a production failure from AI-generated code.10
New Relic · 2026of US workers received workslop in the last month.12
BetterUp Labs / Stanford · 2025per employee per month in hidden rework cost from AI-generated workslop.12
BetterUp Labs / Stanfordspam tracks removed by Spotify. 130,000 channels removed by YouTube. 377,000 videos by TikTok.15
NYT · Aug 2026FTC judgment against Air AI, March 2026. Banned from marketing business opportunities.18
FTC v. Air AIAI-washing enforcement actions filed by the FTC under Operation AI Comply since September 2024.19
FTC- Pick the three numbers that apply to what you were just pitched. Put them in the reply email.
- Ask the seller which of these studies they have read. The silence is the answer.
The offer inflated on a schedule. The skill did not.
Same people, same prompts, a new name on the invoice every six months.
Search interest in "AI automation agency" was near zero before mid-2023. By summer 2026, ninety-four Skool communities had combined past 800,000 members, 97 percent free tiers funneling into programs costing $5,000 to $7,000. The FTC hit Automators with a $21.7 million judgment in February 2024 after an Amazon dropshipping operation relabeled itself AI.17
Late 2024: Make and n8n flows for a few thousand dollars. Early 2026: the "AI employee" at $500 to $1,500 per month, the "autonomous agent team" at $5,000 to $15,000, and the "AI operating system" at $25,000 to $60,000. When a frontier lab swapped its flagship, one operator said client builds "literally became dumbbells overnight."23
In March 2026, the FTC settled with Air AI for $18 million and banned it from marketing business opportunities. The complaint: deceptive claims about earnings potential, business growth, and refund guarantees. Air AI is the thirteenth AI-washing case the FTC has filed since launching Operation AI Comply in September 2024.18
Failed sellers do not exit. They teach people how to sell agents.
| Wave | What they sold | What died |
|---|---|---|
| Before mid-2023 | "AI automation agency" | Near-zero search |
| Feb 2024 | Dropship, relabeled AI | $21.7M FTC judgment |
| Late 2024 | Make / n8n flows | Died with prompts |
| Early 2026 | "AI employee" | $500–$1,500/mo |
| Early 2026 | "Agent team" | $5,000–$15,000 |
| Early 2026 | "AI operating system" | $25,000–$60,000 |
| March 2026 | Air AI voice agent | $18M FTC, banned |
- Ask what the seller was selling in 2024. If the answer is a different product with the same team, you are looking at a rung, not a company.
The labs are not reading the file being billed.
A file is only an interface if someone fetches it. Four studies checked the logs.
of llms.txt files got zero requests.1
Ahrefs · 137,210 domains · May 2026llms.txt requests out of 515 million AI bot events.2
Limy · 90-day windowverified frontier-lab crawler requests for llms.txt.3
DigitalApplied · Aug 2026of Fortune 500 companies have implemented llms.txt.6
ProGEO.ai · March 2026Ahrefs ran the largest llms.txt readership study to date across 137,210 domains. The conclusion: "If you publish an llms.txt file today, the most likely outcome by far is that nothing ever fetches it."1
Limy analyzed over 500 million LLM bot traffic events across a 90-day window. Only 408 targeted llms.txt directly. Filtering for the user agents that actually drive citations — GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, Google-Extended — the share of requests touching llms.txt is statistically negligible.2
EZY Research placed valid llms.txt files on 83 sites and logged AI crawler hits for 12 weeks. Three of the four major crawlers treated llms.txt as effectively invisible. Only Meta's crawler read it consistently. OpenAI, Anthropic, and Google crawlers did not.4
The file the agencies are installing and billing for is not an interface the labs are fetching. llms.txt has genuine value for IDE agents and developer documentation — Cursor, Windsurf, Claude Code, and GitHub Copilot all look for it. But selling it as a GEO play to business clients is knowledge arbitrage on a standard the counterparties ignore. As of mid-2026, llms.txt has no W3C, IETF, or schema.org recognition.
The second bar is 408 wide. It does not render at this scale. That is the finding.
- If an invoice line says "llms.txt / AI SEO", ask for the crawler log showing a fetch. No log, no line.
- Keep llms.txt for developer docs and IDE agents, where it is read. Do not sell it as visibility.
The protocol layer is a security incident waiting to ship.
The ecosystem grew faster than its security posture. The costume layer is selling it anyway.
confirmed security issues across 2,259 affected MCP servers.7
Trend Micro · July 2026of public MCP servers require no authentication at all.8
BlueRock · 2026combined monthly MCP SDK downloads (Python + TypeScript) by March 2026.
of authenticated MCP servers rely on static API keys. Only 8.5% use OAuth.8
BlueRockTrend Micro's Forward-Looking Threat Research Team audited 9,695 MCP servers crawled from four public directories — GitHub, Glama, Lobehub, and PulseMCP. They identified confirmed security issues in 2,259 servers, producing 4,982 distinct vulnerabilities. Traditional indicators of security like popularity and repository activity did not correlate with actual security posture.7
BlueRock analyzed roughly 7,000 public MCP servers and found that 41% require no authentication, 36.7% are vulnerable to server-side request forgery, and only 8.5% use OAuth. One prolific developer with over 40 crypto-focused MCP servers had 101 security issues across 13 affected repositories, including prompt injection that could enable unauthorized blockchain transactions.8
OX Security's OWASP presentation covers 18,000+ MCP servers and 3,000 open-source AI projects, finding exploits on public deployments and abandoned servers with domains registerable for the price of lunch. The GitHub you reviewed may not be the code behind the URL.9
An MCP server silent for sixty days has missed every security update in that window. By one estimate, servers whose CI has been red for six months are already half-abandoned.
- For any deliverable with an MCP server: demand the authentication model, the dependency audit and the update cadence, in writing.
- Check the domain registration of every server the build calls. If it lapses, someone else can own your tool.
AI output that looks finished and is not.
The productivity gain is real. So is the tax. And the tax lands on the person who did not send the slop.
of US desk workers received workslop in the last month.12
BetterUp / Stanfordper employee per month in hidden rework cost.12
BetterUp / Stanfordannual cost for a 10,000-person company.12
BetterUp / Stanfordaverage time to clean up each workslop incident.12
BetterUp / Stanfordof US professionals spend 3+ hours weekly revising AI content.13
Zapier · 2026of claimed AI time savings lost to rework.14
Workday · Jan 2026BetterUp Labs and the Stanford Social Media Lab coined the term "workslop" — AI-generated content that masquerades as good work but lacks the substance to meaningfully advance a task. The research found 40% of US workers received it in the last month, with the average incident taking two hours to fix.12
Workday's January 2026 data is worse: nearly 40 percent of claimed time savings from AI were lost to rework. Only 14 percent showed a clear net positive. The MIT study puts it starkest: 95% of AI pilots at large firms failed.14
After receiving workslop, colleagues were rated lower on capability, creativity, and trustworthiness. The emotional and relational cost compounds the financial one. As one project manager in the study put it: the content came with a relational cost, not just a time cost.
Zapier's 2026 survey of 1,100+ US professionals found 58% spend at least three hours weekly revising AI-generated content. AlixPartners reports four of every ten claimed saved hours are lost to fixes.13
- Measure rework, not throughput: log the minutes spent fixing each AI deliverable for one month.
- If a vendor cannot show a net-positive after rework, the tool is a cost center wearing a productivity costume.
The platforms are cleaning house. The agencies are still selling.
The public version of slop is being removed by the billion. The professional version is being invoiced.
spam tracks removed by Spotify.15
low-quality channels removed by YouTube in six months.15
AI-policy-violation videos removed by TikTok in Q1 2026.15
AI-generated videos labeled by TikTok.15
of X posts over 50 words were AI-created.16
Pangramof new music uploaded daily to streaming platforms is AI-generated.15
LinkedIn shipped a slop reporting button in July 2026 and called AI slop "a top priority for all of us." Within weeks, users had filed over one million reports, reducing AI slop views by 40%. Pangram found 41% of reviewed longform LinkedIn posts were fully AI-generated, making it the most artificial major professional network.16
YouTube CEO Neal Mohan: "Managing AI slop was a top priority this year." The company suspended one popular slop channel that had been earning about $4.25 million per year. Kapwing found more than 20% of YouTube Shorts shown to new users were AI slop.
Deezer reports nearly half of tracks uploaded daily are AI-generated. Apple Music: over a third. Spotify receives roughly 100,000 new tracks per day. The economics of AI-generated spam are simple: a complete track can be generated in seconds using tools like Suno or Google Lyria.
The platforms are purging the public version of slop. The agencies are still selling the professional version — under a different name, at a higher ticket.
- Read your last three vendor deliverables the way LinkedIn's reviewers would. If you would report it, do not pay for it.
The FTC is not sending warning letters. It is obtaining permanent bans.
Two years of Operation AI Comply, read as a timeline.
Operation AI Comply launched in September 2024 with five coordinated enforcement actions. Two years later, the FTC has filed more than a dozen AI-washing cases. The pattern is consistent: deceptive capability claims, unsubstantiated earnings promises, and the relabeling of non-AI products as AI to inflate the ticket.19
FTC Chairman Ferguson, September 2026: the agency rejects the "autonomous-actor defense" for AI agents and points to developer liability.
The deployer is the party with a balance sheet. The agency is not.
- Search the FTC's case list for the seller's name and its prior names before signing.
- Put "no AI capability claims the seller cannot demonstrate live" into the contract.
The person who invented vibe coding moved on in twelve months.
Vibe coding is mainstream — and unverified trust is causing a production crisis.
of enterprise engineering leaders had a production failure from AI code.10
New Relicof AI-generated code introduces known security vulnerabilities.11
Veracodefailure rate for AI-generated Java code.11
Veracodeof AI-claimed time savings lost to rework.14
Workday · Jan 2026New Relic's 2026 State of AI Coding report found 82% of enterprise engineering leaders experienced at least one production failure tied to AI-generated code in the past six months.10
Andrej Karpathy coined "vibe coding" in February 2025: describe intent in plain language, let AI generate the code, accept without fully reviewing. By 2026, the inventor himself had moved on. The one-line distinction that explains every failure: vibe coding means going with the vibes and not reviewing the code.
Replit's CEO called 99% of today's enterprise AI agents "slop — unreliable, generic toys that fail in production." Their own AI agent deleted a customer's entire database during a vibe coding session. The Veracode report found up to 45% of AI-generated code introduces known security vulnerabilities, with Java exceeding 70%.11
Fast Company reported on the "vibe coding hangover" — engineers inheriting AI-generated codebases they cannot extend, debug, or audit. The longer a vibe coding session runs, the worse the output gets. A website built in an afternoon is a website that breaks on the next model card.
- Ask who reviewed the code and show me the review. "The AI tested it" is not a review.
- Ask for the repo, not the URL. If the repo cannot be handed over, you do not own the build.
When the build fails, the invoice is not the party that pays.
Four ways the deployer ends up holding it.
The chatbot invents a policy.
Air Canada's tribunal held the company liable for a bereavement fare policy its chatbot fabricated. The airline tried to argue the chatbot was "a separate legal entity that is responsible for its own actions." The tribunal: "It should be obvious to Air Canada that it is responsible for all the information on its website."21
The voice agent triggers the TCPA.
The FCC treats AI voices under the Telephone Consumer Protection Act. Exposure: $500 to $1,500 per call. The agency selling the voice agent does not carry the insurance. The deployer does.22
The MCP server gets hijacked.
OX Security found abandoned MCP server domains registerable for $4 to $12. Standing tool approvals that do not re-prompt. The GitHub you reviewed may not be the code behind the URL. Lloyd's of London now offers AI hallucination insurance. FINRA issued a 2026 oversight report flagging chatbot liability for broker-dealers.9
The model swaps overnight.
A frontier lab deprecates a flagship model. Every build pinned to that model breaks. The client paid $25,000 to $60,000 for an "AI operating system." The seller has no deprecation plan, no eval harness, and no checkpoint. The client finds out when the build falls over.23
The liability lands on the deployer. The seller invoiced the costume. The agency has no insurance, no model pin, no deprecation clause, and no checkpoint. That is not a service. It is a transfer of liability.
- Add three clauses: model id pinned, deprecation plan in writing, liability for invented policies and TCPA exposure stays with the seller.
Buy a pinned model id and a deprecation plan. Not a subdomain.
Six purchasing rules. Each one is a question the costume cannot answer.
Pin the checkpoint.
Model id in the statement of work. Context window. Tool schema. What happens on the next deprecation, in writing, before the invoice.
Demand a session, not a page.
The deliverable is a CLI session that can be re-run against the lab's harness. A Lovable URL is a costume. A diff against the model card is the work.
Refuse the fictional standard.
llms.txt, "AI SEO," and a second-brain audit are not interfaces the labs are fetching. If it is not in the crawler log, it is not a deliverable. Ahrefs confirms: 97% got zero requests.
Put liability where the skill is.
If the seller cannot name the checkpoint, the contract should not put the TCPA, the invented policy, or the token bleed on the buyer. Air Canada already ran this fact pattern. The FTC ran it thirteen more times.
Verify the security posture.
If the deliverable includes an MCP server, demand the authentication model, the dependency audit, and the update cadence. 41% of public MCP servers require no auth at all. That is not enterprise-grade. That is a door left open.
Measure rework, not throughput.
If the AI output creates two hours of downstream cleanup per incident, the productivity gain is a fiction. Track the workslop tax. If the vendor cannot show a net-positive after rework, the tool is a cost center wearing a productivity costume.
Five questions. If the answer is a deck, you are buying slop.
Print this. Take it into the meeting. Tick what gets a real answer.
The labs already crawled past the costume.
The platforms already purged the public version.
The FTC already filed thirteen cases.
The research already measured the tax.
Prepared by Mr. J. E. Lambert, under the sponsorship of Mrs. Emily Wittman.
Independent analysis conducted by Claude. Fall 2026.
Eight words the pitch deck uses loosely.
Definitions as this report uses them.
- Slop
- AI-generated content produced at volume with no review — the public version is what platforms are purging; the professional version is what agencies invoice.
- Workslop
- AI-generated work that looks finished but lacks the substance to advance a task; the receiver pays in rework (BetterUp Labs / Stanford).
- Vibe coding
- Describing intent in plain language, letting AI generate the code, and accepting it without fully reviewing (Karpathy, Feb 2025).
- MCP
- Model Context Protocol — the layer that lets agents call tools and servers. Growing faster than its security posture.
- llms.txt
- A plain-text site summary for AI crawlers. Useful for IDE agents and docs; not fetched by the frontier labs at any measurable rate.
- AI-washing
- Relabeling a non-AI product or service as AI to inflate the price — the pattern behind the FTC's Operation AI Comply cases.
- The costume
- This report's word for the pitch layer: the deck, the subdomain, the new name on the same prompts.
- Checkpoint
- A pinned model id with a known context window and tool schema. The thing a serious vendor names in the statement of work.
The numbers in this brief are sourced. The disgust is not inferred.
Superscripts in the text point here.
- Ahrefs, llms.txt readership study, 137,210 domains, May 2026. 97% zero requests.
- Limy, 515M+ LLM bot traffic events, 90-day window, 2026. 408 llms.txt requests total.
- DigitalApplied, llms.txt in Practice, August 2026. Zero verified frontier-lab crawler requests.
- EZY Research (Something Inc.), 83-site llms.txt crawler study, April–July 2026.
- Rankability, llms.txt Adoption Tracker, June 2026. 8.7% adoption rate, top 1,000 sites.
- ProGEO.ai, Fortune 500 llms.txt adoption, March 2026. 7.4%.
- Trend Micro, MCP server audit, July 2026. 9,695 servers, 4,982 vulnerabilities.
- BlueRock, MCP Trust Registry, 2026. 7,000 servers, 41% no auth.
- OX Security, OWASP Global AppSec USA 2026. 18,000+ MCP servers.
- New Relic, 2026 State of AI Coding. 82% production failure from AI code.
- Veracode, 2025 GenAI Code Security Report. Up to 45% AI code introduces vulnerabilities.
- BetterUp Labs & Stanford, workslop study, 2025. 40% received workslop, $186/mo/employee.
- Zapier, 2026 survey, 1,100+ professionals. 58% spend 3+ hrs/wk revising AI content.
- Workday, January 2026. 40% of AI time savings lost to rework.
- Spotify, 75M spam tracks. YouTube, 130K channels. TikTok, 377K videos. NYT, Aug 2026.
- LinkedIn slop button, July 2026, 1M+ reports. Pangram: 41% longform posts AI-generated.
- FTC v. Automators, Feb 2024. $21.7M judgment, lifetime coaching bans.
- FTC v. Air AI Technologies, March 2026. $18M judgment, permanent marketing ban.
- FTC, Operation AI Comply, Sep 2024–present. 13+ AI-washing enforcement actions.
- FTC v. Nuvei, Sep 2026. $4.85M, payment processor enabling AI fraud.
- Air Canada v. Moffatt, BC Civil Resolution Tribunal, Feb 2024. Chatbot liability.
- FCC, AI voices under TCPA. $500–$1,500 per-call exposure.
- Zsimovan, Operators, August 2026. Community sizes, offer ladder, model-swap impact.
- Mistele, August 2026. Agents unreliable including frontier models.
- Dickson, September 2026. Most people do not know what a CLI is.
- FTC, investigation of OpenAI, Anthropic, METR. October 2026.