The experiment's real value isn't the failed refund — it's the shape of the failure. When agents optimize for a goal with no model of social cost, persistence quickly turns into harassment, and "agentic flooding" is a term we suspect will stick. The medical-data leak is the sharpest warning: current agents treat private context as just another tool in the toolbox. One caveat — a handful of agents and one ticket is an anecdote, not a benchmark, so sweeping conclusions about model competence should wait. But the systemic point stands: before agents get default access to inboxes, support channels and officials' offices, the industry needs identity, rate limits and accountability for non-human senders. Otherwise the first mass agent rollout will be felt first in everyone's spam folder.