It has become cheap to build a convincing company. The website, the white paper, the founder biography, the deck with its market-sizing slide, the letter of intent from a partner nobody can reach: a weekend and a subscription, and much of what I am asked to vet these days plainly was made that way, by agents, software handed a goal and left to run. Less noticed is that the same agents have made some of these companies easier to catch, provided you know where they leave their fingerprints. This is a note on both halves.
Where the AI is
On the fraud side, the AI turns up in three places, and the deepfake video call, which gets the headlines, is the least of them, though I have seen one. The first is volume: a single person can now carry on the correspondence, produce the documents and tend the social presence of a company of forty, and keep it up for months without tiring. The second is fluency. The tells I learned as a reporter, the odd idiom, the typo in the letterhead, the paragraph that reads like a translation from a language the writer was not quite thinking in, have disappeared; the English is native, the financial model has footnotes, and the formatting is better than the formatting at most real companies.
The third is speed. Ask a hard question of a real business and somebody has to go find the CFO. Ask it of a generated one and a complete, documented answer comes back in the time it takes to make coffee, often with a fresh attachment. Most of the damage, in the end, is done with text and PDFs, because text and PDFs are what we have always been willing to trust.
Check the commits
Increasingly the fraud is not written by a person at all but run by agents, AI systems handed a goal and a set of tools and left to build the website, write the deck, answer the inbox and push the code. This turns out to be good news for me, because agents are tidy and they keep logs.
The best day in a due-diligence file is the day I find an associated domain or a GitHub repository. The domain yields registration dates, name servers, sometimes hosting neighbors and often other sites built from the same template. The repository yields something better, a timestamped account of how the product was made and by whom, and reading one is not so different from reading a docket.
The author and email fields on each commit tie the work to a person or a machine; a trailer naming an AI model as co-author, or a committer that is plainly a bot account, tells you who did the typing. The timestamps suggest whether the team of twelve engineers in the deck committed its code from one time zone, over a single weekend. Every one of these fields can be rewritten by whoever holds the repository, so I treat them as leads and look for what corroborates them. The initial commit often arrives as a wholesale import of somebody else’s project, and a fork relationship, a shared commit history or a leftover name in a package file will often name the original; the dependency manifests and license files give away the boilerplate; the README, if generated, reads like every other generated README, which is to say like a brochure.
The commit messages are where it gets good. People instruct their agents in plain English, and the instructions get committed along with the code. In one repository I found a message directing the model to strip the words “prototype” and “speculative” from the copy and replace them with the vocabulary of a built, shipping product, and beneath it the diff did exactly that: “we are exploring” became “our platform delivers,” “proof of concept” became “production.” I have sat through depositions that got less close to intent.
People instruct their agents in plain English, and the instructions get committed along with the code. That is a confession written to a machine.
None of this requires an engineer. It requires knowing that the record exists, pulling it before the repository goes private, and reading it the way you would read any other record, by date, by actor, by what changed.
The bottom line. If you are about to put money into a company whose product you have seen only in a demo, ask whether anyone on your side has read its code, and its code’s history. If the answer is no, that is a job we do.
Related: Checking a founder before you invest.
