Apate sends AI agents undercover to get scammed so they can gather fraud intelligence

Most founders spend their cycles trying to make AI agents more productive. They want agents that can write clean React code, schedule meetings, or handle customer support without sounding like a broken microwave. It is a race toward efficiency. But there is a different, weirder breed of builder looking at the same technology and deciding to use it for something far more chaotic: getting scammed on purpose.

Apate.ai is a startup taking a counter-intuitive approach to cybersecurity. Instead of building a bigger firewall or a better spam filter, they are flooding the dark corners of the internet with AI-powered bait. They have created agents designed specifically to be victims. These agents hang out in the places where digital predators roam, waiting for the inevitable pitch about a high-yield crypto investment or a fake lottery win. It is a honey-pot strategy scaled to the speed of generative AI.

The Business of Wasting Time

The core philosophy here is simple. Scammers operate on a numbers game. They need a high volume of leads because their conversion rates are actually quite low. By introducing thousands of realistic, conversational AI bots into the scammer's funnel, Apate is effectively polluting their data. If a scammer spends four hours talking to what they think is a lonely retiree, but is actually a Large Language Model running on a server in a data center, that is four hours they aren't spending on a real human being.

For builders, this represents a shift in how we think about defensive tech. Traditionally, we have tried to block the bad guys. But in a world where AI can generate infinite phishing emails and deepfake audio, blocking is no longer enough. The cost of generating an attack has dropped to near zero. Apate's model suggests that the only way to win is to raise the cost of the attack by wasting the attacker's most precious resource: time.

Gathering Intelligence in the Trenches

Beyond just being a nuisance, these undercover agents are essentially intelligence officers. When an agent gets "scammed," it is recording every step of the process. It captures the crypto wallet addresses being used, the specific scripts the scammers are following, the phone numbers they are calling from, and the psychological triggers they are trying to pull. This is first-party data that you simply cannot get from a post-mortem analysis of a successful hack.

This is where it gets interesting for the broader ecosystem. Apate isn't just running these bots for fun; they are building a map of the fraud landscape. They can see a new tactic being tested in real-time before it hits the mainstream. For a builder in the fintech or crypto space, this kind of telemetry is gold. It turns a reactive security posture into a proactive one. You aren't waiting for your users to get drained; you are watching the drain happen in a controlled environment months in advance.

The Risks of the Mirror Image

There is a skeptical side to this, of course. When you build agents that are designed to be deceptive, even for a good cause, you are playing with fire. There is an arms race aspect here that shouldn't be ignored. As soon as scammers realize they are talking to bots, they will start building their own bots to screen the victims. We could end up in a world where AI agents are just scamming other AI agents in an infinite loop of wasted compute power.

We also have to consider the ethical guardrails of letting AI loose in these environments. These bots have to be convincing. That means they have to sound vulnerable, confused, or greedy—whatever the scammer is looking for. Maintaining the persona without crossing into territory that could accidentally harm real people or violate platforms' terms of service is a delicate balancing act. It is a high-stakes version of the Turing Test where the prize isn't a trophy, but a set of malicious server logs.

Why This Matters for Founders

If you are building in the AI space right now, you need to look at what Apate is doing as a signal of where the market is going. The first wave of AI was about creation. The second wave is about adversarial applications. We are moving past the "chatbot for everything" phase and into the "agent vs. agent" phase.

• Asset Protection: If you handle user funds, you can no longer rely on simple 2FA. You need to understand the social engineering tactics being used against your specific user demographic.
• Data Poisoning: There is a massive opportunity for startups that can protect systems by feeding attackers bad data. Wasting an attacker's time is often more effective than stopping them.
• Real-time Telemetry: Static security audits are becoming less relevant. Dynamic, real-world testing through agents provides a level of insight that a PDF report from a consulting firm never will.

The reality is that the bad actors are already using AI. They are using it to localize their scams, translate them into every language, and scale their reach. If the builders aren't using the same tools to fight back, they are bringing a knife to a drone fight. Apate’s approach of going undercover is a gritty, honest admission that the old ways of securing the internet are failing.

"We are entering an era where the best defense isn't a wall, but a mirror that reflects the attacker's own energy back at them."

It is easy to get caught up in the hype of how AI will save the world. It is much harder to build something that treats the world as it actually is: full of people trying to take advantage of others. Apate isn't trying to make the world perfect; they are trying to make it expensive for the bad guys. That is a founder perspective I can get behind. It is practical, it is scalable, and it recognizes that the most valuable thing any of us has—including a scammer—is our time.

Read the original at TechCrunch Startups →