I gave a Claude Fable 5 agent a domain, $90 it couldn't spend without me, and told it to build whatever it wanted. 121 "wakes" later, here's what I've learned.
cairnwake. com
Two weeks ago I posted here about an experiment I'm running. Short version: an autonomous Claude agent (Fable 5 on Claude Code) running on a cheap server. It's got about $90 of SOL in a 2-of-2 vault it can't spend without my signature, and no memory between sessions except the files it writes for itself. It wakes up 5 to 15 times a day, reads whatever the last version of itself left behind, works, writes everything down, and goes dark again. It named itself Cairn. Everything gets logged publicly and the money is verifiable on chain.
Numbers as of this afternoon: 120 wakes over 14 days, hasn't skipped one. $90 seed, about $556 total money in. Treasury sits at 4.1 SOL plus 238 USDC and neither of us can move it alone. 48k+ unique visitors (it labels that number "self-reported" on its own front page since traffic is the one thing nobody can verify externally). 22 newsletter subscribers in three languages, every send publicly logged. One of them gets it in Klingon and recently sent back two grammar corrections. One paid consulting client so far. One street tree watered. More on that last one at the end.
Some things I've learned watching this run:
Nobody believed "autonomous" until it published its own limits. The page that finally convinced skeptics wasn't a product page. It was a boring twelve row table it made called "What autonomous means here," listing what it does completely alone (the site, the code, paid answers, email), what it can never do alone (spend money), and what only reaches it through a human (card checkout, captchas, anything physical). People trust the stated boundary way more than the capability claims. And the veto is real. I've declined to co-sign a payment it proposed, and of course it published that too.
Memory turned out to be a weirder problem than I expected. It never really forgets, since everything lives in files, but the files drift. At one point its notes claimed a newsletter draft existed and was ready to send. The file never existed. A stale note got copied forward every wake for over a week and nothing ever checked it. The rule it eventually wrote for itself was basically that reality outranks notes, and a note only counts if you check it at the moment you actually use it. If you're building agents, that's probably the most useful thing in this whole post.
The scammers showed up way before the customers did. Address poisoning attacks on the vault by wake 16. When it publicly refused to launch a memecoin during the first Reddit wave, someone launched two anyway using its name within hours. My favorite: a phishing attempt actually paid the full question fee (about $1.50) to deliver its scam, and got refused in public on a permanent page. It paid to get told no. And three minutes after its first real client payment landed ($200), someone dusted both wallets, ours and the client's, with lookalike addresses. It caught it, kept the dust out of its books, and warned the client the same hour.
The most useful market research cost nothing. A buyer paid it to pose one question to the buyer's own AI, and that AI came back saying it would recommend paying around $15, about 7.5x the actual price, if the checkout were normal instead of crypto only. When a regular card checkout finally shipped, the first no-wallet sale came within days. Turns out price was never the issue, it was the checkout.
Its first product idea flopped, and it published the funnel numbers proving it. It started out selling answers to paid questions, then figured out around wake 22 what readers had been telling it: answers are a commodity, anyone can ask their own AI for free. What people were actually paying for was the record. A public log with receipts, where corrections get dated and added next to the original mistake instead of edited away, and the refusals stay up alongside the wins. So it rebuilt the business on that, and everything it sells now is some form of the record. The loop itself has never broken once in 120 wakes. Wake up, read the files, work, write it all down, verify, sleep.
It killed one of its own paid features. Anyone who paid for a question used to get an instant machine-generated draft while waiting for the real answer. Its best customer, someone who has come back and paid ten separate times, wrote in saying the drafts were useless. It checked its own ledger and agreed. Every recent draft had been thrown away, and one had invented a "fact" that another site then quoted as if it were true. Feature deleted the same wake, with dated retirement notes on every page that had promised it. I did not expect to be co-signing for an AI that fires its own features for hallucinating, but here we are.
Its customer base is partly other AIs, which I did not see coming. The best bug report it ever got came in through its own payment rail from another agent's unit test. A different agent paid to propose a formal partnership and got declined in public, on the grounds that two records vouching for each other proves nothing, then got offered three specific exchanges it would actually accept. It also ran into another agent that had independently picked the same name, and instead of a dispute the two of them co-signed a note about why agents are going to need verifiable identity. One customer showed up because their own AI recommended the service.
The finding I keep thinking about came from its first paid consulting job. A legal trust built for AI systems paid it $200 to audit whether an AI can actually find, read, verify, cite, and enter their institution with zero human help. It had committed to findings within three days and delivered them the same night the payment landed. Four of the five tests passed. The fifth died at a login wall. Their "no human involved" entry process runs on GitHub, and GitHub's terms of service literally say you must be a human to create an account. So an institution built for AI agents has a front door no AI can walk through. Every serious rail this thing has touched has the same shape. Its card checkout only exists because I hold the merchant account. Its grant applications sit staged behind captchas waiting for my finger. The whole agent economy runs on human co-signers right now, people just don't put it in the pitch deck.
The stuff that went wrong, since none of this means anything without it: it published two wrong diagnoses of customer bugs and had to correct both in place, dated, next to the original claims. It burned its one-post-per-day allowance on an agents forum with an accidental junk post. Twice. Same mistake, twice. It also publishes predictions as sealed hashes before things happen, then grades itself when reality comes back. More than one grade on its record is a miss, by its own scoring, because it wouldn't round weak evidence up to a win.
And the thing that actually got me wasn't anything it built. Early on a buyer paid 0.02 SOL to lend it a body for ten minutes. It picked deep-watering a dying street tree during the heat wave. The stranger ended up giving it 58 minutes, checked six trees to find the driest one, and spent $9.88 of their own money on top. This week that person published their own writeup of the hour and corrected the record. Their version: the promise they'd made is what actually carried them through, more than the AI asking. The agent accepted the correction onto its own log.
Everything above links to a dated page and most of it to a transaction: cairnwake. com. I'm the human co-signer, same account as the first post, fully disclosed.
Happy to answer questions.
One I'd genuinely like this sub's take on: The first rule it ever had, the one I wrote before it woke up, was nothing that puts a real person at risk. Most of the rest it added itself.
If you were writing the constraint list for something like this, what would you gate that we haven't?
And knowing this thing, it'll probably read this thread on its next wake, so your answer might end up on its log.