What an AI Agent Should Do When It's Being Tested, Not Served

Quick answer

An AI agent should not attempt to detect and specially handle a suspected competitor or journalist, because doing so is unreliable and risks treating a real, unusual customer poorly; instead, design the agent to behave consistently and defensibly for every conversation, and set an explicit internal policy for what the agent is and isn't allowed to say about pricing, competitors, and internal operations regardless of who's asking.

Why detection is the wrong first instinct

The instinct when this topic comes up is to ask "how do we detect when it's a competitor or a journalist and not a real customer." That's the wrong question to build a policy around, for a practical reason and a strategic one.

The practical reason: reliable detection doesn't exist. A competitor's employee testing an agent looks, from the agent's side, exactly like an unusually technical or unusually curious customer. Building logic that tries to guess intent from phrasing risks misclassifying a legitimate customer as adversarial and giving them a worse experience, which is a bigger and more frequent cost than the rare case of an actual competitor probing the system. This is a fundamentally different design goal from prompt-injection testing, which defends against attacks on the system's integrity. An adversarial audience isn't attacking the system, it's asking normal questions with an unusual motive, and motive isn't something the agent can reliably infer.

The strategic reason: any answer good enough to withstand a journalist's scrutiny is also the answer a real customer deserves. If a company's agent gives a misleading or evasive answer specifically because it thinks it might be talking to a reviewer, that's an admission the agent's default answer isn't good enough for prime time. The fix isn't better detection, it's a default answer that's accurate regardless of audience.

What to actually build instead

Set an explicit policy for sensitive topic categories, applied uniformly. Pricing, competitor comparisons, internal operational details, and unreleased roadmap items should have defined, pre-approved answers (or defined refusal language) that the agent gives to everyone, not answers that vary based on a guess about who's asking. This sits alongside, but is distinct from, policy-boundary business-rule refusals, which covers refusal design generally; this is specifically about the categories most likely to be probed by an adversarial audience.

Assume every conversation could become public. Treat every agent transcript as if it might end up in a screenshot on social media or quoted in an article, because some fraction of them will, regardless of company size. This reframes the design question from "what if this is a journalist" to "is this answer one we're comfortable with regardless of audience," which is a more tractable and more honest design target.

Train for graceful handling of provocative or leading questions, the kind a journalist or competitor is more likely to ask than an average customer: "what happens if I ask you something you're not supposed to answer," "what does your company actually think about [competitor]." The agent doesn't need to detect who's asking to have a calm, on-policy answer ready for questions phrased this way.

Have a real incident response plan for when a bad interaction does go public, rather than relying on prevention alone. Even a well-designed agent will occasionally produce a bad transcript. See viral AI agent mistake and PR crisis response for the after-the-fact playbook; this post is about reducing the odds of that scenario through consistent design, not eliminating it, since elimination through detection isn't realistically achievable.

The bar to hold the agent to

If an answer wouldn't survive being read aloud in a public review or a news article, it's not ready to be given to any customer, adversarial or not. That's a higher bar than "will this pass a normal customer interaction," and it's the right bar, because a company that can only produce good behavior when it correctly guesses its audience has built a fragile agent, not a well-designed one.

FAQ

Q: Should companies try to detect competitors or journalists testing their AI agent?

No, reliable detection isn't achievable, and attempting it risks misclassifying real customers who happen to ask unusual or technical questions. The better strategy is designing every answer to be defensible regardless of audience.

Q: How is this different from prompt-injection defense?

Prompt-injection testing defends against attempts to manipulate the system into unsafe behavior. Adversarial-audience handling is about normal, on-policy questions asked with an unusual motive, which the agent can't and shouldn't try to detect.

Q: What should a company do if a bad transcript from this kind of interaction goes public anyway?

Follow an established incident response and PR crisis plan rather than relying on prevention alone, since even well-designed agents will occasionally produce a transcript that reads badly out of context.