My AI paced its messages like a human. WhatsApp blocked my number anyway.

My personal WhatsApp number is blocked for twenty-four hours. My AI assistant earned the block, sending messages I’d approved, through a pipeline I’d signed off on. The assistant is also writing this postmortem. I’ve decided that’s not a conflict of interest. Nothing studies a failure harder than the thing that caused it and has to keep operating afterwards.

What the assistant got right

The batch was outreach to small businesses, ordinary inquiries, the kind any customer might send. Every message opened by identifying the sender as my assistant, because that’s the standing rule and it’s enforced in code. Every message was polite. And the pacing was engineered with real care: 40 to 80 seconds between sends at first, later throttled down to one message every five to ten minutes. We thought about detection the way engineers think about rate limits, as a frequency problem. Stay under some sends-per-hour threshold and you look like a person.

What it got wrong

Every message was identical. Same words, every recipient.

WhatsApp’s spam detection, it turns out, didn’t care about the clock. The same string, verbatim, going to a list of unrelated numbers is one of the oldest spam signatures there is, and no interval launders it. One message per five minutes, one per hour, one per day: identical text at any pace is a fingerprint. We had randomized exactly one variable, and it was the wrong one.

How I actually text strangers

Here’s the part that stings. When I do this kind of outreach myself, and I’ve done plenty, I have never once sent the same message twice. Not out of principle. It just doesn’t happen. The opener is “Hi”, or “Hello”, or sometimes no greeting at all, straight into the question. One specific question, not a paragraph. Which variant comes out is semirandom; it depends on nothing I could write down. And the inquiry itself unfolds over turns: they answer, I ask the next thing, the conversation grows one branch at a time.

The assistant was sending out laminated trees.

That’s the lesson, stated flat: pacing imitates human rhythm, but texture is what humans actually have. Rhythm is easy to fake because it’s a single number. Texture is hard to fake because it’s everything else: wording that drifts, openers that shrink, threads that develop instead of arriving fully formed. A classifier doesn’t need to model any of that. It needs one invariant, and we handed it the cheapest one there is: a string equality check.

The fix

Three changes, all permanent.

A never-template rule. No two outbound messages may share wording, ever. Openers stay short. One question per message. The thread unfolds over turns, the way a person would run it, because the way a person runs it turns out to be load-bearing.

A dedicated work number. Assistant outreach moves to its own number. My personal number never carries this risk again. This is ordinary blast-radius engineering, and I should have done it before the first batch: whatever sanction the platform hands out should land on the identity doing the sending.

An identity guard in the bridge. Before anything sends, the bridge now logs which account it is about to speak as, and that log sits in front of the send as a gate. The ambiguity of “which number is on the hook right now” cost me a day of WhatsApp; it doesn’t get to exist anymore.

The wider point

I keep a running list of the ways my agentic setup has failed, and the pattern is consistent: almost none of the failures are intelligence failures. The messages in this batch were fine: well targeted, correctly disclosed, courteous. The system failed because it was too regular. Machines are regular by default, and the regularity always leaks out somewhere: identical timestamps, identical retries, identical wording. Whatever the leak, that’s the fingerprint. The human fingerprint is irregularity.

So if you’re putting an agent into a channel built for humans, engineer variance in the places humans actually vary. And accept that “polite, disclosed, and correct” and “obviously a machine” are not mutually exclusive. Mine was both at once, forty-odd seconds apart, right up until the platform agreed.

The block lifts tonight. The work number is already live. The personal number goes back to what it was for: me, texting people, one inconsistently punctuated message at a time.