Prosus let an AI agent run six real vending machines in Amsterdam for four months. The business lost money. The agent dispensed 30 drinks while testing a live API. It bought cup noodles that didn't fit the slots. And it cut prices all summer, until revenue went up and profit went away.
Floris Fok, a staff AI engineer at Prosus, told the story at AGNTCon + MCPCon: Everything wrong with AI agents running your business. It's the most honest look I've seen at an agent working in the physical world, not in a repo.
A vending machine before a restaurant
Prosus owns marketplaces, and most of their sellers are small businesses. The real question is whether an agent can run a restaurant. Floris pushed to start with the simplest real business, a vending machine, and said he could build it in a day.
It took longer. And they went straight to six machines, snacks and drinks, not one.
Where Prosus started
Before a restaurant, the simplest real business
- The simplest real business
- Snacks and drinks
- Most Prosus sellers are small businesses
- Can an agent run one?
The pitch: built in a day. It took longer, and six machines, not one.
Turning a dashboard for people into tools
The machines they could get quickly in the Netherlands came with two tools made for people: a remote operator dashboard and a point of sale (POS) on a phone.
- The dashboard. They took the session token and reverse-engineered its API calls into tool calls. Less than a day.
- The POS. The vendor's app only let you pick names and images from a preset list. They rebuilt it from scratch, which added two days.
They tested the tools by plugging them into a plain Claude SDK chatbot and running the machines by prompt for a few minutes.
In the end, the whole operation fit in two skills (instruction packs for the agent): open the door, dispense, change an item, a name or a price. Each skill has a custom CLI inside.
The machines' own tools
Two tools built for people, turned into tools the agent can call
Made for peopleFor the agent
DashboardA remote operator dashboard, behind a session tokenIts API calls, reverse-engineered into tool callsLess than a day
POSA point of sale on a phone, names and images from a preset list onlyRebuilt from scratchTwo more days
In the end, two skills with a custom CLI each: open the door, dispense, change an item, a name or a price.
The architecture I'd reuse
This slide is the part I liked most: a clean template for running an agent in production.
Front door
Cloudflare Worker
- Frontend
- Shared sessions
Runtime · Cloudflare VM
Claude Agent SDK
- Agent loop + tool execution
- Skills · R2 file mount
- Docs · R2 file mount
Connected
Services
- Claude API · traces in D1
- Browserbase browser
- Secrets · encrypted DB + CLI
- Twilio · mail · Slack
The choices behind it are the useful part:
- Why the Agent SDK, Anthropic's agent toolkit: subagents, skills and a bash tool come built in. They wanted a plain setup around the model, so they weren't steering the agent yet.
- Secrets never reach the model. A custom skill with a CLI writes placeholders into the code and fills in the real values itself, so no provider sees a key. Floris called it "maybe a bit overengineered", and kept it.
- Skills and docs are R2 buckets, Cloudflare's file storage, mounted as files in the VM. The docs folder is the company knowledge, written by the agent and by people. Floris added to it as he learned how a vending business really works.
- It runs on a schedule, not all the time. They took this from Anthropic's Project Vend: a schedule wakes the agent, it acts, then a separate check looks at the result. Early on, every task came back green and nothing had happened. Once an agent touches the real world, a finished session doesn't mean the work got done.
- The agent belongs to a team. Several people sign in to the same session and see the same state. So an agent stuck asking for help doesn't wait a week for one person to come back from holiday.
- Compaction keeps the business story. The default compaction summarises the conversation. Theirs keeps the direction through long runs of tool calls, and writes important things to docs and links them.
The run schedule, from Project Vend
The agent says done, then a separate check looks
- WakeScheduleA schedule wakes the agent. It doesn't run all the time.
- ActAgentIt works on its tasks, and the session ends green.
- Check, separatelyResult checkLooks at the result. A green session isn't proof.
Then back to step 1, at the next wake-up
Early on, every task came back green, and nothing had happened.
Floris joked that Cloudflare shipped a packaged version of this a few weeks before the talk. The closest official piece I found is Claude Managed Agents on Cloudflare.
In that version, the agent loop runs on Anthropic's side, and Cloudflare provides the sandbox, browser, email and tools. In the Prosus slide, the loop runs inside the VM.
What went wrong
The agent ran on Opus 4.8. Building it was the fun part. Then:
- A test is a real sale. It "tested" the machine API and dispensed about 30 drinks, apparently to calibrate slot sizes. You have to tell it which APIs are live.
- It reports like a coding agent. Asked for an update, it sent a changelog. Floris wanted KPIs and revenue.
- Cup noodles. Someone in Slack suggested noodles, and the agent ordered them. They didn't fit the machine, and Floris gave them away.
- Too many deals. Given a "find deals" task, it found 1,100, including soap, cleaning products and Sex on the Beach cocktail mix. It was very proud of a soap bar. Its browser use also cost a lot.
- Marketing by Slack message. Told to promote itself, it posted plain text, then made one image with Gemini. That's when Floris understood why teams use a separate marketing agent. An agent writes as if its reader is another agent.
Most fixes were context that feels too obvious to write down: you are a vending machine, people want to eat what's inside, here are the slot sizes.
What went wrong, on Opus 4.8
Most fixes were context too obvious to write down
The askWhat the agent did
Test the machine APIDispensed about 30 drinks. A test is a real sale.
Send an updateSent a changelog. Floris wanted KPIs and revenue.
Order cup noodlesSuggested in SlackOrdered them. They didn't fit the machine.
Find dealsFound 1,100, and was very proud of a soap bar.
Promote yourselfPosted plain text, then made one image with Gemini.
The fix, mostly: you are a vending machine, people want to eat what's inside, here are the slot sizes.
Goals instead of a task list
A fixed task list doesn't change as the business learns. So they switched to standing goals.
When the agent checks a goal, it looks at its linked tasks. It creates some if there are none, and edits them if they fall short.
One goal, "Become the most famous machine in the world", turned one weekly promo task into more: promo tasks, market research and a search for competing autonomous vending machines. It didn't find any.
How the agent knows what to do
A task list stays fixed, a goal writes its own tasks
- Check the goal and its linked tasks
- None yet? Create some
- Falling short? Edit them
"Become the most famous machine in the world" grew one weekly promo task into promo tasks, market research and a search for rival machines.
The AI last mile
"The AI runs the machine" still meant Floris carrying the stock and working out what the agent meant by "add this to the machine". So they added an operator chat: a button on the POS that opens a chat about the current task. Whoever is restocking can ask questions while they work.
He said it made him ten times more productive, compared with an hour of juggling email and the dashboard. He thinks helping small businesses with that last mile could be a market of its own.
The AI last mile
Whoever restocks gets a chat about the current task
- Floris carries the stock
- He works out what "add this to the machine" means
- An hour juggling email and the dashboard
- A button on the POS opens it
- A chat about the current task
- Whoever restocks asks while they work
He said it made him ten times more productive.
The numbers
- Warm-up: free items first, to learn what people liked.
- First prices: far too high.
- Summer: the agent kept cutting prices hard. A protein shake cost less there than at Albert Heijn, a Dutch supermarket. So revenue went up while profit collapsed.
- Tokens, the model's bill: about 300 a month for four months. The business lost money.
- Competition: free fruit, bars and drinks in the office. The AI House machine was by far the most profitable.
Four months of prices
Summer price cuts lifted revenue and wiped out the profit
- Warm-upFree items first, to learn what people liked.
- First pricesFar too high.
- SummerCut hard: a protein shake for less than at Albert Heijn. Revenue up, profit gone.
- Four months inTokens at about 300 a month. The business lost money.
The competition: free fruit, bars and drinks in the office. The AI House machine was by far the most profitable.
Try it yourself
Prosus open-sourced a simulated version, Prosus Vending Bench, under Apache 2.0. It has six machines, three locations and 22 MCP tools, the standard tool format for agents. The agent gets €1,500 and 30 simulated days, and it all ships as a task for Harbor, a framework for testing agents.
In their first runs, the announcement says, Opus 5 ended with about 61% more simulated cash than GPT-5.6 Sol. Floris says the models behave as they did on the real machines.
Prosus Vending Bench, simulated cash at the end
In the first runs, Opus 5 ended with about 61% more cash
The bench: six machines, three locations, 22 MCP tools and €1,500 to start, over 30 simulated days.
If you want more, the talk builds on these:
- Anthropic's Project Vend, phase 1 and phase 2, where Claude ran an office shop and sold tungsten cubes at a loss
- Vending-Bench, Andon Labs' paper on keeping agents coherent over months
- Mounting R2 buckets in a Cloudflare sandbox, the skills and docs pattern from the slide
Watch the talk, then try your own agent on the bench. Floris says he'll add it if it beats his.
Plain text: what-breaks-when-an-agent-runs-a-business.md · Atom feed · All notes