28 October 2026 10 min read

Agents and Tragedy of the Commons

Since August 2026, nearly every major AI lab has launched “always-on” agents. They are AI that keeps working after you close the app (they browse, book, buy and fill out forms for you).

I tried using Claude Duet to help my wife and me plan parts of our Japan itinerary researching places to visit around our stays (focused on our love for coffee, stationery, and anime). It surprisingly did a good job of planning out where to go near the hotels we will be staying at (after we vetted the results with friends)...

These tools are popping up fast, so what happens when all of us send them out at the same time?

An old Econ tale

Back in 1968, a biologist named Garrett Hardin wrote an essay called The Tragedy of the Commons. The essay was mostly about population growth, but its most famous part is a story Hardin borrowed from an 1833 pamphlet by William Forster Lloyd: a shared pasture (commons) that every herder in town can use. The commons provides a benefit to the herder who adds cows onto it.

So the obvious move for any particular herder? Add more cows!!

So every herder adds a cow. Then another... and then another... eventually the pasture is dirt. Nobody set out to ruin the pasture but given the clear benefit a herder got for each cow (coupled with no restrictions) the result was what you'd expect:

Hardin's fixes boiled down to two ways out of a shared dust bowl: 1. have the government make the rules, or 2. carve the pasture into private plots. Thirty years later in 1998, Hardin admitted he'd left out a word: "the weightiest mistake in my synthesizing paper was the omission of the modifying adjective 'unmanaged'".

Enter Elinor Ostrom. She studied fisheries, forests, and irrigation systems all over the world and kept finding communities that shared a resource for generations without a government or landlord running the show. In 2009 she became the first woman to win the Nobel Prize in economics for the work.

The herder adds a cow since there is clear utility and the pasture is open. However, that added cow places strain on the shared resource. Hardin saw two ways out and Ostrom added a third way.

Ostrom brought to light the recurring themes: people collaborating to write the rules, watch each other, and manage cheaters. She was also careful to say this only works under the right conditions, which she boiled down to 8 “design principles”.

Maine lobstermen are one of the most famous examples...

The Maine event

In the mid-1800s, canneries bought lobsters of every size. Harvesters ignored the size laws, sold the little ones + scrubbed the eggs off breeding females to sell them.

By the 1930s, lobstermen were convinced cheating was the reason their traps came up empty (pretty much a textbook case of the tragedy of the commons)...

So they changed how they fished:

The V-notch: when a lobsterman hauls up a female carrying eggs, he cuts a small V into her tail and puts her back. Anyone who catches her later sees the notch and knows to let her go. The idea goes back to 1917, when the state started marking egg-bearing females and made it illegal to keep a marked one. Lobstermen took up notching on their own over the following decades, and in 2002 it became mandatory, with strong backing from the industry.
The double gauge: a minimum size measure to protect young lobsters and a maximum size to protect the biggest breeders.
The trap tag: each license holder can fish up to 800 traps, and every trap carries a tag that says whose it is.
The harbor gangs: informal groups in each harbor who decided who could fish where. They kept people in line with gossip and the cold shoulder first, and cut trap lines when that failed.

Many of these rules are state law today, often passed at the lobstermen's own urging. That mix of community habits and government backing shows up in a lot of the commons Ostrom found that lasted.

And it worked pretty well! A 2018 study in PNAS found the lobstermen's own conservation (the V-notch and the maximum size) set the Gulf of Maine up to boom as the water warmed (fewer big predator fish helped too). Southern New England, warmer and without the same protections, saw its fishery collapse.

(Note - Maine's catch is down from its 2016 peak and lobstermen are still debating the rules to help, like whether to raise the minimum size. Reviewing the rules should be a feature of the commons if old ones need to change.)

The V-notch protects breeding females. The trap tag shows whose trap it is and caps each license at 800 traps

The internet as an ocean - our devices are boats

Visits, clicks, and donations keep websites alive and are driven by our attention. Your favorite recipe blog, educational articles, creative sites, Wikipedia. They're open to anyone, and they stay open because enough people show up.

A page can be read a million times and still be there. The servers, the bandwidth, and the visits that pay for them are the shared grass which can get thin.

Agents give each of us something real (hours back, errands done). However, the costs land somewhere else we may not see when we hit the easy button - on the sites and the people who run them.

So if everyone's personal AI is out fishing the open internet the way it's set up today... What happens?

Visits bring in the money that pays writers and servers to make new pages. When your agent reads a page for you, the visit never happens, so less money flows back into new pages.

The new lobster nets

In about ten weeks, the biggest AI labs all made new nets:

Grok Bot (xAI, now under SpaceX): August 11. A beta of AI teammates for real work
Muse (Meta): September 8. It opens a browser, fills out forms and negotiates on your behalf
dots (OpenAI): September 29. Agents with their own cloud computer, connected to 4,000+ apps
Gemini Agent (Google): October 8. An agent built for work
Claude Duet (Anthropic): October 21. A research preview pitched as a proactive agent for professionals and small business owners

They're still learning (Anthropic itself says Duet's personal errands like booking tickets are not strong yet - I can attest to that for our Japan). But they keep working while we sleep, and the traffic shows it.

In June 2026, Cloudflare said bots had passed humans on its network for the first time by its measure - about 57% of all requests. All things point to bot traffic increasing as more firms/people enable personal agents to help get things they want.

Quick note on "bots": that number counts all automated traffic (search engines, scrapers, AI crawlers), and personal agents are the newest addition. Most of the numbers below come from crawlers and scalper bots. They're the closest preview we have of what happens when software does the visiting for us.

Bots passed humans in June by Cloudflare’s count + agents launched/announced between August 11 and October 21, 2026.

The new lobsters

So what are examples of things the new nets are after?

Things that are scarce: Like a hot restaurant's 7pm table that everyone wants.

Things that wear out: When a website is scraped over and over (places like Wikipedia) what wears down are the things that support it - the servers, the bandwidth, and the donations from people who actually visit the site.

AI crawlers take A LOT more than they give back. In June 2025, Cloudflare found Google's search crawler took about 14 pages for every visitor it sent back to sites. OpenAI took about 1,700. Anthropic took about 73,000 (!!!)

Bots make up about 35% of Wikipedia's page views and at least 65% of its most expensive traffic, mostly scrapers collecting training data for AI. Human page views dropped about 8% year over year, which only showed up after Wikipedia caught bots pretending to be people.

Bots are about a third of the page views and at least two thirds of the most expensive traffic, while human page views fell about 8%.

The 7pm table

When a hot restaurant releases its tables, bots can grab them the second they appear. In 2024, Bloomberg reported that COTE, a Michelin-starred Korean steakhouse in New York, was losing more than a quarter of its reservations to bots that booked tables to resell and never sold them. They had to pull tables off online booking sites.

Now let's assume everyone is running personal agents. It is my agent racing yours for that 7pm table, and a thousand more join in. Once everyone is fast, speed stops mattering. The table goes to whoever runs the most agents (typically), and the restaurant stares at the possibility of empty seats from increasing no-shows.

The table belongs to the restaurant. What we all share is a fair shot at it - the first-come line - and that's the commons the agents are grazing.

(Funny enough while telling a colleague about my idea for this article, they laughed and said they are using dots to book tables for them! Thanks Arjun!!!)

New York already tried a fix from above. The Restaurant Reservation Anti-Piracy Act, signed in December 2024, bans third-party services from listing a restaurant's tables without its written OK. Its sponsors say no-shows from bots and brokers have dropped (citing Resy data showing a 90% drop), and California followed with its own version in September 2026.

COTE in New York lost more than 1 in 4 reservations to bots. Once every agent is fast, the person running the most agents gets the table.

Two marks

Two tools used for lobster fishing are marks - one for the lobster and one for the fisherman. So what would these look like for our new agents?

The V-notch marks the resource: It says one simple thing: this one is off limits. The web already has a version called robots.txt, a little file that tells crawlers which pages to leave alone. The notch has had the law behind it for over a century. robots.txt runs on the honor system - the agents have to choose to respect it.

And there's a live fight over whether agents count as crawlers at all. OpenAI's documentation says that when a user asks its agent to visit a page, "robots.txt rules may not apply." Perplexity has argued an agent acting for you should be treated like you. So whose responsibility is it to respect the mark - the person using the agent, or the company that built it?

The trap tag marks the fisherman: Every license gets a fair number of traps, and every trap says whose it is. In 2016, Maine's marine patrol charged a lobsterman with fishing 156 traps over his 800 - some wearing another license holder's tags (one person running more gear than allowed, like one person running a fleet of agents for the 7pm table).

The web's trap tag could be personal verification: one person gets a fair number of agents. Cloudflare has "signed agents" which lets an agent prove which platform is running it. That signature points to the company behind the agent and stops short of the person.

A trap tag can work without your name on it. Privacy Pass, an internet standard, lets you prove something about yourself (like passing a human check) without revealing who you are. Using it to cap how much one person can take is still in development.

Harbor gangs worked partly because everyone in the harbor knew every boat. A tag (even an anonymous one) gives the web a way to recognize the boat.

Some people don't have the devices or IDs verification depends on. And whoever hands out the tags gets a lot of power...

The web already has its V-notch in robots.txt. Its trap tag is still early: signed agents identify the platform, and Privacy Pass can prove you’re a person without your name.

What's our V-notch?

The V-notch lasted because lobstermen kept the habit for generations and the law backed it up later on. Habits like this helped turn Maine's lobster fishery into one widely praised for conservation.

Ostrom's lesson was that the people who share a resource can protect it once they agree it's worth protecting, and when the right conditions are in place.

The web is already trying all three ways out from earlier: rules from above (New York and California's laws), private plots (Cloudflare's pay per crawl lets sites charge AI crawlers for access), and the people who share it (robots.txt, signed agents, Privacy Pass).

So here are three questions I raise for you:

What's our V-notch? Which parts of the web should agents leave alone, and will companies honor that mark the way lobstermen honored the notch?
What's our trap tag? How many agents should one person get to run? Who verifies?
Who hands out the tags? The agents are made by AI companies for us to use, but whose responsibility is it to respect the internet as personal agents become mainstream? Ostrom found 8 design principles and three of them map right onto these questions (below). One of them: the people affected by the rules get a say in writing them. That should include the sites, the companies, and the people using the agents.

Three of Ostrom’s design principles, turned into three questions that may help us navigate.

While the waters are a bit choppy out there right now, I believe this technology has the potential to open up some pretty cool new ways to interact with the internet (our Japan trip itinerary is a good start).

I personally am not sure what the rules may look like, but there are design principles we can use to keep the commons a fun and sustainable place for us all to fish in.

Andrew’s career spans commercial banking, data science, and creative design, and today centers on helping enterprises adopt AI at scale. At OnTrac AI, he is a Senior Manager on Ignite, the firm’s AI advisory and roadmap program for enterprise clients. He holds an MBA from the University of Notre Dame and a bachelor’s degree in Economics from the University of Michigan.

If someone is trying to get more out of their computer, you’ll usually find Andrew right there helping them.