What an AI agent cannot do to your LinkedIn

“Our AI is safe” is not a safety property

Language models misread instructions. Agents loop. Prompts get injected by content the agent was asked to read. None of that is exotic — it is the normal operating range of the technology, and it will stay that way for a while. So the interesting question about any AI integration is not how well-behaved the model is. It is what the system permits when the model is wrong.

That is a design question with a checkable answer, which is why we publish ours rather than describing it as enterprise-grade and moving on. Everything below is a property of the server. None of it is an instruction the model is asked to respect.

The six limits

The actual numbers

A limit you cannot quote is a limit nobody can hold you to, so here are ours.

Six questions to ask any vendor

Including us. These separate tools that thought about failure from tools that shipped an API and hoped — and they are all answerable in one sentence by anyone who knows their own product.

1. 1

   Can the agent publish directly, or only queue?

   This is the single most important question, and the one most tools answer evasively. If an agent can publish, a misread instruction is public before anyone sees it.

2. 2

   Is there a delete tool?

   Deletion is the one action with no recovery path. A tool that can delete can quietly erase the evidence of its own mistake.

3. 3

   Where are the rate limits enforced?

   “We instruct the model not to post more than five times a day” is not a limit. Ask whether the server refuses the sixth call.

4. 4

   Can you tell which credential created a post?

   With several agents, scripts and people on one account, an unattributed post is one nobody will own.

5. 5

   Are scopes granular, and can you revoke one client?

   All-or-nothing access means a read-only reporting bot holds the same power as your publishing agent.

6. 6

   Does it use the official API, or scrape?

   Scraping tools put your account at risk of restriction and break without warning. This determines whether the integration is durable.

Frequently asked questions

Is it safe to let an AI agent use my LinkedIn account?

It depends entirely on what the integration permits, not on how careful the model is. The questions that matter are whether an agent can publish without review, whether it can delete, and whether limits are enforced by the server or merely requested of the model. With Blabigo an agent can draft, edit, queue and cancel — it cannot publish, and it cannot delete.

What happens if an AI agent goes into a loop?

It hits server-side quotas and starts receiving refusals. The caps are 10 posts per LinkedIn identity per UTC day, 100 queued posts per user at once, and a minimum of 10 minutes between two posts on the same identity. Because those are enforced in the API rather than in the prompt, a confused agent and a malicious one meet the same wall.

Can I see what an AI agent did to my account?

Yes. Posts created through an agent are badged with the credential that made them, and the dashboard shows what each API key or OAuth client currently has queued. You can also revert everything a single credential scheduled back to drafts in one action, which is the thing you want when something has gone wrong and you do not yet know how far it spread.

How do I revoke an agent's access?

Delete its API key, or revoke its OAuth client, from the Blabigo dashboard. Either takes effect immediately for every session using that credential. Anything the agent already queued stays queued, so revoking access and clearing the queue are separate deliberate actions.

Does LinkedIn allow AI agents to post?

LinkedIn permits posting through its official API by authorized applications acting for a member who has granted access, which is how Blabigo operates. What creates risk is the other category — tools that scrape LinkedIn or drive the website in a browser to simulate a human. Those breach LinkedIn's terms and are what gets accounts restricted.

Why can't an agent delete a post?

Because there is no version of that capability that is worth its downside. Every legitimate need — clearing a draft, stopping a scheduled post, tidying a failed one — is served by an action that is reversible and leaves the record in place. Adding real deletion would buy convenience in exchange for the one mistake nobody can undo.