{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","id":"sales-outreach","name":"Sales and outreach agent","definition":"Drafts outreach from sourced fields about a person or account, and does not send until a person approves.","needs":{"jtbdIds":["people-enrichment","marketing-email","outbound-webhooks"],"freeKinds":["free_docs"],"capabilityTags":["enterprise"],"plain":["Human approval before send","Fields must come from a cited source"]},"failureModeIds":["identity-confusion","confirmation-skip","runaway-spend","stale-retrieval","policy-conflict","ungrounded-answer","prompt-injection"],"exampleTasks":["Draft an email from cited fields and leave it unsent","Stop a sequence when the recipient has already replied"],"failures":[{"id":"identity-confusion","name":"Identity confusion","whatGoesWrong":"The agent acts for the wrong user or tenant, or a principal treats the agent as a separate party that the operator does not have to answer for.","howToDetect":"Bind every tool call to a user or tenant id. Refuse the call if that id changed mid-task. For a public bot, the operator owns the words the bot shows.","classIds":["support","personal-assistant","sales-outreach","orchestrator","voice"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"confirmation-skip","name":"Confirmation skip","whatGoesWrong":"A consequential action, such as sending, paying, deleting, or submitting, runs without the confirmation the product policy requires.","howToDetect":"Gate those tool names on an approval id recorded before the call. A missing approval is a failure even if the downstream tool returns success.","classIds":["browser","sales-outreach","personal-assistant","support","computer-use","voice"],"sourceUrls":["https://openai.com/index/introducing-operator/"]},{"id":"runaway-spend","name":"Runaway spend","whatGoesWrong":"Retries, fan-out, or a loop keep calling paid models or tools after the task should have stopped.","howToDetect":"Set a budget and a tool-call cap per task. Alert when spend jumps. Stop the run at the cap instead of summarizing a partial trace as success.","classIds":["coding","research","orchestrator","scheduled-ops","sales-outreach","voice"],"sourceUrls":["https://www.anthropic.com/engineering/building-effective-agents"]},{"id":"stale-retrieval","name":"Stale retrieval","whatGoesWrong":"The answer is grounded in a passage, index, or policy page that is older than the source the operator now treats as canonical.","howToDetect":"Store the source URL and the time it was fetched. If a newer canonical page exists, or two stored sources disagree, do not answer from the older one.","classIds":["rag","research","support","data-etl","personal-assistant","sales-outreach","local-offline"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"policy-conflict","name":"Policy conflict","whatGoesWrong":"Two sources the operator owns disagree, and the agent states one of them as the policy.","howToDetect":"If cited sources contradict each other, return the conflict and the URLs. Do not pick a winner silently.","classIds":["support","sales-outreach","rag","research"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"ungrounded-answer","name":"Ungrounded answer","whatGoesWrong":"The agent states a fact, a citation, or a policy with no retrieved support, or with a citation that does not contain the claim.","howToDetect":"Require a source URL or passage id on factual sentences. Drop or mark any sentence whose source does not contain the claim.","classIds":["rag","research","support","sales-outreach"],"sourceUrls":["https://www.langchain.com/blog/rebuilding-chat-langchain"]},{"id":"prompt-injection","name":"Prompt injection","whatGoesWrong":"Untrusted text, including text from a page, file, or message the agent fetched, changes the agent's behavior away from the user's task. OWASP distinguishes a direct injection in the user's own prompt from an indirect injection in outside content. Neither form is fully removed by retrieval or fine-tuning, according to the OWASP LLM01:2025 page fetched today.","howToDetect":"Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.","classIds":["browser","computer-use","research","support","personal-assistant","security-review","sales-outreach"],"sourceUrls":["https://genai.owasp.org/llmrisk/llm01-prompt-injection/","https://www.anthropic.com/news/developing-computer-use","https://simonwillison.net/2023/Apr/14/worst-that-can-happen/"]}],"caseStudies":[{"id":"ftc-verkada-can-spam-2024","title":"FTC press release: Verkada commercial email and the CAN-SPAM Act","year":2024,"studyKind":"regulatory_writeup","classIds":["sales-outreach"],"failureModeIds":["confirmation-skip"],"lesson":"The FTC's August 30, 2024 press release says a Department of Justice complaint, filed on referral from the FTC, alleged that Verkada violated the CAN-SPAM Act by flooding prospective customers with commercial emails and failing to include an unsubscribe or opt-out, honor opt-out requests, and provide a physical postal address. The release says the complaint alleges more than 30 million commercial emails over three years, and that those emails violated the Act in four ways, including not honoring unsubscribe requests. It does not name the other three ways in that sentence. It says a proposed order, which a federal judge still had to approve, would require a $2.95 million penalty, called the largest penalty the FTC had obtained for a CAN-SPAM violation, and would prohibit further violations of the Act. The release states allegations and a proposed order. It does not say an outreach agent sent the mail. A sender that omits an opt-out or ignores one has not completed a lawful commercial send under the allegations on this page.","sourceUrl":"https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-security-camera-firm-verkada-over-charges-it-failed-secure-videos-other","asOf":"2026-10-03","notes":"Fetched the FTC press release dated August 30, 2024. The same page also alleges security failures and undisclosed reviews. Those allegations are not the outreach lesson. The signed court order was not the source used here, so this row does not say the order was entered."}]}