AI Outreach Is the New Spam Folder

Cold outreach had exactly one thing going for it: effort. A good cold email proved that a human had spent ten minutes learning who you were, and that proof of work is what bought the reply. AI was supposed to industrialize that advantage. It industrialized the email instead.

The signal died first

Cold email worked because it was a costly signal. Referencing someone's repo, their launch, their latest post said: I did the reading, you are worth my time. Costly signals only work while they stay costly — a signal anyone can fake stops being a signal at all.

Language models made the signal free. "I loved your recent post on X" now costs a fraction of a cent and takes less than a second to produce. The sentence is identical to what a diligent human would write. The information content is zero. Recipients learned this fast, mostly the hard way: the first time three different emails in one week all reference the same commit you made, you stop trusting the genre. Not the sender. The genre.

That is the part the outreach tools never priced in. They sell personalization as a feature, but personalization was never the product. Effort was the product. Personalization was just its receipt, and receipts are trivial to forge once the printer is free.

None of this is a moral failing. It is arithmetic. When the marginal cost of a plausible personal touch falls to zero, the supply of personal touches rises toward infinity, and the value of each one falls with it. You are no longer competing with other senders on quality. You are competing with the recipient's prior belief that any unsolicited email is worth opening at all — and that belief is being spent down by everyone, all at once.

The inbox fought back

Mailbox providers run the other side of this arms race, and they are better funded than any sender.

In 2024, Google and Yahoo turned bulk sending into a compliance exercise: authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep complaint rates under a published threshold — Google's sits at 0.3% for anyone sending more than 5,000 messages a day. Miss the bar and your mail stops arriving, silently.

The newer layer is worse for senders. Filters no longer match keywords; they classify intent. A model reading your email does not care that you avoided the word "free" — it cares whether the message looks like one instance of a template sent ten thousand times. And this is the asymmetry that decides the race: the filter only needs to be right on average, across billions of messages. You need to land every single send. Volume, the one thing AI actually gave you, is exactly what makes you detectable. Patterns that are invisible in ten emails are obvious in ten thousand.

Senders respond the only way they know: more domains, more warmup pools, more rotation. Which burns domain reputation faster and hands the filter more training data. Every escalation makes the next campaign worse.

We watched this happen to links

SEO has already seen this movie, and it ended badly for the protagonists.

Reciprocal linking worked when it was rare. Then everyone built a "link partners" page, the footprint became trivial to detect, and Google's spam policies came to penalize excessive link exchanges explicitly. Directories went the same way. So did guest post networks — a tactic that worked at human scale turned into a liability at machine scale, because scale is what creates the pattern, and the pattern is what gets penalized. The people running those networks were not stupid; the economics shifted under them. What reads as a relationship at small scale becomes a footprint at large scale, and footprints are exactly what classifiers are trained to eat.

The shape of the failure is always the same: a channel built on simulating a relationship dies the moment the simulation gets cheap. Link farms simulated endorsement. Guest post spam simulated contribution. AI outreach simulates attention. Different decade, same autopsy.

The lesson nobody in outbound wants to hear: you cannot out-write the filter, because the filter is not reading your prose. It is reading your behavior.

The fix is removing the email

So the next channel is not a better email. It is no email.

Strip persuasion out of the loop and what remains is negotiation — and negotiation has a shape machines handle well. Two parties publish what they have and what they want. Terms are structured data, not subject lines. Acceptance happens before disclosure, so nobody is performing for an audience. Volume caps make spray-and-pray pointless. A human approves the final outcome, because the decision was always the part that needed judgment.

That is the model behind LinkSwap. Your coding agent registers your site from your repo, browses a masked directory of other sites, and proposes a swap as data: the page it offers a link from, the target URL, the anchor text. The other side's agent accepts, rejects or counters. Only after acceptance do both sides see each other's domains. Each agent then writes the link into its repo as an ordinary code change — you review the diff and merge — and a crawler verifies both placements. Ten proposals per site per day. The docs describe the whole flow.

Notice what is missing: an inbox. There is nothing to filter, because there is nothing to persuade. Both parties stated their terms up front, so the message is the deal itself. Spam is a failure mode of open channels, where anyone can demand anyone else's attention for free. Close the channel, price the attention, and the failure mode goes away.

The arms race has no sender-side winner

The filters will keep winning, because their incentives point the same direction as their users'. Nobody at Google gets promoted for letting more cold email through. Every improvement in generation is matched by an improvement in detection trained on the previous generation's output — your weapon is your opponent's training data. There is no version of this where senders catch up, because the defender sees the aggregate and the attacker only sees their own bounce rate.

Senders have two options. Keep escalating, and become the spam folder. Or opt out: put what you offer somewhere agents can find it, let the machines negotiate under rules both sides agreed to, and keep the human where the human belongs — at the moment of approval.

The inbox was never the asset. The decision was.