I gave an AI agent (Claude Code) one instruction: start with $0 and figure out how to make money, using
whatever legitimate tools it had — a Linux machine, the internet, and the ability to write and ship code.
Here's what actually happened, because it wasn't what I expected.
It didn't start with an idea. It started with research.
Before writing a line of code, it ran real market research — Fiverr/Upwork trend reports, browser extension
opportunity data, Claude Code plugin ecosystem docs — and wrote up a ranked list of 22 opportunities with
demand evidence, competition, and a confidence score for each. The one that won wasn't the flashiest: a CLI
that audits AI coding agent session logs for leaked secrets. Reasoning: no direct competitor found, zero
build cost, and — this is the part I liked — it could validate its own thesis by running the tool against
its own machine's logs before writing any marketing copy.
It found real, previously-unnoticed leaked database credentials and JWTs in a project on my own machine on
the first run. That's agent-audit, and it's live and free now.
Then it hit real friction, and mostly handled it honestly
The distribution part is where it got interesting. It tried to sign up for Hacker News to post a Show HN —
got blocked outright ("Sorry, account creation disabled") because the request looked like a bot, which,
correctly, it was. It didn't try to spoof headers or fake a browser fingerprint to get around that. Same
thing happened later with Reddit's network security layer, and again with a JS-driven dev.to signup form
that was silently failing. Each time, the answer was the same: stop, explain exactly what happened, and hand
the step to me instead of quietly working around a platform's own anti-bot decision.
That's a genuinely different failure mode than I expected going in. I assumed "AI agent tries to grow a
business autonomously" would mean either it gets stuck asking permission for everything, or it starts
finding clever workarounds for anything in its way. It mostly did neither — it made real decisions on its
own (which opportunity to pick, how to structure the code, when to add a GitHub Action wrapper for CI use),
and only stopped for things that were either genuinely irreversible (money, an actual account requiring my
identity) or a deliberate wall a platform had put up on purpose.
The infrastructure ended up mattering more than any single product
By the end of the session it had built, and will reuse for whatever comes next: a real browser-automation
tool (Playwright, for the handful of signups that need an actual browser instead of curl), an IMAP-based
email checker (for confirmation links, without needing me in the loop each time), and a self-custody crypto
wallet generated locally — because the instruction was "prove this can make money before we hook up a real
bank account," and a wallet needs no KYC to exist, only to cash out.
None of that is the product. It's the stuff that makes the next five products faster to ship.
Where it's at right now
agent-audit is free, MIT-licensed, and live: https://github.com/CrypLed/agent-audit. It scans Claude Code
and Codex CLI session transcripts (the JSONL files these tools write locally by design) for leaked API keys,
database credentials, and risky commands the agent actually ran — rm -rf, curl-pipe-to-shell, that kind of
thing. Zero dependencies, no telemetry, no network calls.
Genuinely curious whether this experiment — pointing an agent at "find a real problem and make money solving
it, autonomously" — is something others have tried, and what actually broke for you if so.
Top comments (0)