A Diner Told CNN His AI Assistant Pinged Resy Hundreds of Times an Hour.

“Resy figured it was a bot which is a totally fair response,” one diner told CNN. Resy told Restaurant Business it has long banned automated activity. CNN says Instinct, the diner’s AI assistant, recently raised $350 million, and Meta’s Muse has been downloaded more than 2 million times already.

Two agents, one restaurant. In September 2026, J.C. Bahr-de Stefano, a venture capitalist in New York, wanted a table at 4 Charles Prime Rib, CNN reports, and he turned to Instinct, a personal AI assistant. He “didn’t lay out explicit actions to take,” he said. CNN reports: “The bot went and tried. When it couldn’t come up with a table, he encouraged it to keep going.” Given the job, he told CNN, the assistant had been pinging Resy “hundreds of times every hour of the day.”

CNN reports that Brian Distelburger, a tech entrepreneur, got banned from Resy, and that he had used an agent to look for a table at 4 Charles Prime Rib. In a Business Insider essay of August 22, 2026, he says he gave an agent his Resy account credentials, wanted it to check for 4 Charles when reservations got released, and put no guardrails on it. He says the agent never booked a single reservation and that within about 48 hours he got a notice that his account was deactivated.

The old side

Restaurant Business reports that, in a statement, Resy confirmed that it “does not currently permit unapproved third-party bots or agents to independently access or interact with the Resy platform.” Resy told Restaurant Business it has long banned automated activity on its site but declined to say how many accounts have been deactivated for it, the magazine reports in an article of September 10, 2026.

CNN quotes Ben Leventhal in an article on diners’ AI agents: “For as long as we’ve had hard-to-get-into restaurants, we’ve had people trying to hack the system. These bots are nothing new.” CNN styles him as the founder of the loyalty platform Blackbird and a co-founder of Resy; his words are not Resy’s statement. On September 7, 2026, he wrote on X that “10,000 vibe coders have written Resy sniper bots” and that Instinct “obv” has “shipped their version, too.”

Resy’s own pages

Resy’s Terms of Service, in versions effective November 24, 2020 and June 9, 2025, say users shall not use “manual or automated software, devices, or other processes” to “crawl” or “spider” any page. Read on October 5, 2026, those two versions and a third, effective March 14, 2023, never use the word “bot,” and never use “agent” to mean a software or AI agent. The versions in between went unread, and no clause is named here as applied to either diner.

Resy’s Security Center page, undated and as fetched on October 5, 2026, says Resy has a zero-tolerance policy for bot use, and that accounts with identified bot activity “will be automatically terminated with all future reservations canceled immediately and no opportunity for reinstatement.” If an account was flagged, the page says, “an action or several actions were performed outside of Resy’s tolerance threshold for normal use.” The page describes detection only in general terms: “detection models that analyze reservation patterns and behaviors to differentiate between genuine guests and reservation bots and brokers.” And it says “some third-party platforms that require access to your Resy credentials will deploy bots to secure a reservation on behalf of a legitimate user.” The statement is general policy, and the page, as fetched, does not mention either diner’s account.

Two accounts, one document

Restaurant Business reports that Bahr-de Stefano posted a screenshot of an email from Resy saying his account had been deactivated for violating the platform’s terms of service; we did not view it. “Of course I got banned,” he told CNN, and “Resy figured it was a bot which is a totally fair response.”

Distelburger says he emailed Resy right away, apologizing, and probably sent four or five emails that got no response or a quick one-sentence reply. He says he tried to wait a month, that his agent Hannah then drafted an email a few paragraphs long, and that he sent it, heard from Resy within two days, and got his account reinstated. His account gives a sequence, not a cause.

CNN reports that Bahr-de Stefano has since had his account reinstated; through October 5, 2026, neither CNN nor Restaurant Business says how or why. The email Business Insider pictures with Distelburger’s essay (captioned as his reinstatement email), headed “New Response from Resy” and signed “The Resy Team,” says: “We have exercised our discretion to issue a one-time courtesy reinstatement of your account.” The email shows no date, no recipient name and no reason. Its guidelines, introduced as a reminder, include “Do not use bots (or similar software) to secure reservations.” And it warns that “any future instances of misuse may result in a permanent termination of your Resy account(s) and cancelation of all associated American Express Card products.” Restaurant Business notes that Resy is owned by American Express, and reports that both men said Resy eventually reinstated their accounts. Put the Security Center’s “no opportunity for reinstatement” beside that reinstatement email and you have two documents. No finding follows from the pair.

The new side

CNN places Instinct in an “emerging category” of personal AI agents: Instinct recently raised $350 million, it says, and Meta’s Muse has been downloaded more than 2 million times already. Users of such apps, CNN says, provide “credentials like email logins and credit card information” and ask the apps to do things for them. That describes the category, not any one setup. Through October 5, 2026, neither CNN nor Restaurant Business, both read in full, says whether or how the Instinct assistant used Bahr-de Stefano’s own Resy login or credentials.

On our reading, the bot category is old, and what the 2026 coverage adds is scale and a new kind of sender: personal AI agents sent by the account holders themselves, while Resy’s Terms, in the three versions read on October 5, 2026, never use the word “bot.” Distelburger says he gave an agent he set up his Resy credentials; for Bahr-de Stefano, the record shows he turned to Instinct and that his own account was the one deactivated, not how Instinct reached Resy. “New” here means CNN’s category and its scale. It does not mean new to Resy’s rules: the undated Security Center page names bots that third-party platforms deploy on behalf of a legitimate user.

The Agentics read

Agentics reads this record through Digital Derangement Syndrome™ (DDS™): AI-mediated systems failing to recognize legitimate authority. The closest fit is Authority Misclassification in a mirrored sense: each diner describes the deactivation as falling on his own Resy account, the account of the man who sent the agent. No misread is alleged here. The stakes are restaurant reservations, not livelihoods. Edition No. 035’s scope notes record a court saying its outcome “does not impair” Amazon’s ability to regulate access to Amazon.com via “private terms of service”; this edition looks at the same ground from the platform’s side, where a terms-of-service rule meets the person who sent the agent.

Where the argument stops

This compares what three news reports, Resy’s documents and one X post say. The two deactivation notices are described, not viewed; the reinstatement email Business Insider pictures was viewed, and it is undated and shows no recipient. As of October 5, 2026, none of the three articles, each read in full, says how Resy identified either diner’s activity as bot or automated activity, or says that Resy’s detection uses AI; the Security Center page, as fetched October 5, 2026, describes detection only in general terms and does not mention agents. The American Express Card language in the reinstatement email Business Insider pictures is a conditional warning about future misuse; the email does not say that any card was closed.

One diner calls his ban “a totally fair response”; the other says he emailed Resy “apologizing for it.” The DDS™ mapping is an editorial judgment, not any source’s finding.