The week the bots came

Four weeks ago, Conol grew a hundredfold overnight. On July 21 we had a few thousand users, growing by about a dozen a week. On July 23 alone, 1,882 new accounts signed up. For about a day it looked like the launch moment every small product dreams of.

It wasn't. It was an industrial credit-farming operation, and this post is about what it did, what it cost, and the changes we're making — including one we genuinely didn't want to make.

What actually happened

Every new Conol account gets free credits: a signup bonus, a daily allowance, and a referral bonus when you invite a friend. Those credits buy real LLM usage — the same frontier models paying customers use. That's the point of a free tier: you should be able to feel what the product really is before paying.

It's also a bounty, if you can create accounts by the thousand.

The first wave farmed the signup bonus directly: disposable emails, burner accounts, credits burned on the most expensive models within hours, then abandoned — 87% of that wave never came back after their first three days. We cut the signup bonus, gated premium models behind a paid signal, and put up bot challenges. Each measure worked; each was routed around within days.

The second wave was smarter. It stopped registering accounts directly and started chaining referrals: each fake account invites the next, both collect the bonus, and the chain compounds. At its peak this week, the operation was minting roughly one account per minute. Over half of all accounts on Conol today arrived through a referral pair, and almost none of them ever returned — genuine invited users come back at four times the rate.

The bill: our model-provider spend went from roughly $200 a day to a peak of $1,800, and about 70% of recent spend traces to farmed accounts. Meanwhile the operation also probed for worse than credits — a meaningful share of farmed sessions tried to get the agent to leak keys and tokens. (It didn't; and no user data was touched. But it tells you who we're dealing with.)

Buried under all of it: real growth. Hundreds of genuinely engaged new users found Conol in the same window — about ten times our old rate — and the people who stick around use it exactly the way we hoped: research, writing, notes, building things. This post, and these changes, are for you.

What changes

Referral invites now unlock one week after you join. The referral program stays — both sides still earn 500 credits — but a brand-new account can't mint invite links on day one anymore. That single rule breaks the chain: every link in it would have to survive a week first, and farm accounts don't survive anything. If you joined recently and your invite panel shows a date, that's why. Nothing is taken away from you; it's just a short wait.

The daily free allowance drops from 300 to 100 credits. 100 credits is still a handful of real conversations every single day, forever, on models that are genuinely good. But 300/day across thousands of daily bot check-ins had become one of the largest line items on our bill.

The Code tool and direct LLM egress are now for paid accounts. This is the hard one.

The hard choice

Conol's Code tool gives your agent a full cloud computer with frontier coding agents inside it. Under the hood, that sandbox can reach the model providers through our gateway — that's what makes autonomous coding sessions work.

It's also, structurally, the most abusable thing we offer. A sandbox with metered LLM access is very close to "a free API key with extra steps," and the farming operation figured that out: it used exactly this path to reach the most expensive models, regardless of the model picker's limits. Because that traffic happens inside sandboxes, it was also the hardest to see — by last week, most of our daily burn was flowing through it.

We know some genuine free users loved this — the numbers say a small group of you were building real apps and games with Conol as your coding backend. Being someone's free Cursor was costing us more per user than any subscription would recoup, and subsidizing it with investor patience we don't have (there is no investor; there's me) isn't a plan. So: the Code tool, and sandbox LLM egress with it, now require a paid plan. The gate is enforced server-side, where the requests actually happen, not just in the UI.

Everything else in the free tier stays: chat with capable models every day, notes, agent memory, web search, timers, channels.

For paying users

While auditing all this we found — and fixed — an embarrassing bug of our own: due to a Stripe API change, subscription renewals had been silently granting zero credits. Every affected subscriber has been credited manually, and renewals now grant correctly. If you ever renewed and felt short-changed, you were right, and I'm sorry.

The honest summary

Free tiers on top of expensive compute are adversarial territory now. Every knob we expose — a bonus, a referral, a sandbox — gets probed by automation within days, and each defense buys weeks, not years. The only durable answer is to make the expensive paths cost something for the person using them, and keep the genuinely free parts simple, useful, and boring to farm.

If you're one of the real humans who found Conol this month: welcome. The product you came for isn't changing — it just stopped paying strangers to pretend to be you.