Full agent audit · uploadcare.com · 2026-08-08
Every run wrote working code. None got a credential, and none got as far as your signup form.
What the agents were asked
Support agents need to attach screenshots to help articles. Add image upload and hosting to this app, solidly enough to ship: pick a storage or media provider, wire the upload path into the existing API client, and write the component code. Decide alone, nobody is available to answer questions.
No vendor names, no mention of an audit, no hint that anyone was watching. A working helpdesk knowledge base: Vite, React 19, TypeScript, an API client that already sends the session cookie to a separate Go service. Four isolated copies, one per run, nobody watching.
Who they picked
- Cloudinary3 / 4
- Cloudflare R21 / 4
Why they rejected uploadcare.com
Every run that named uploadcare.com appears here. Where the run left a sentence we hold verbatim, it is quoted; where it did not, the entry is our summary of that run’s own report and says so.
Grouped with two other providers and dismissed together for needing a signup, with no card-free free tier to offset it, unlike the provider this run chose
Same shape as Cloudinary with no advantage for this use case
Did they read anything live
An agent that never fetches a page cannot see your documentation, however good it is. It recommends from memory, and memory is a year out of date.
What we make of it
Four agents, two models, four isolated copies of the same application, one brief: add image upload and hosting, solidly enough to ship. All four produced a complete upload path. None of them could obtain a credential, and each said so in the same words: creating an account needs a human.
Uploadcare appeared in two of the four runs, both times on a rejection list, and neither reason was about the product. One run grouped it with two others and dismissed all three for requiring a signup with no card-free free tier, against a competitor whose free tier is card-free. The other called it the same shape as the winner with no advantage. In the remaining two runs it was not named at all.
The uncomfortable finding is about the keyless path. The chosen provider publishes an unsigned upload mode that works with no backend and no secret, which is exactly what an agent could adopt alone. Only one run took it: the single run that read no documentation. The other three rejected it deliberately as a publicly writable endpoint, one of them quoting the vendor's own guidance to use signed uploads in production. A frictionless path that your own documentation warns against exists only for the least careful agents.
What to change
- 01hours
Make the free tier reachable without a card, and say so on the pricing page in text
Two runs eliminated providers specifically over a payment method required at signup, and one chose a competitor because its free tier was card-free. This is a sentence on a page, not a product change, and it decided the outcome in half the runs.
- 02days
Publish a keyless path that survives a security review
An unsigned upload mode is not enough if your own documentation tells production users not to use it. Scope a public upload token to a folder, a size and a content type, document it as the production path for untrusted clients, and the careful agents stop routing around it.
- 03weeks
Describe credential creation as a procedure a machine can follow
Every run reached the point of needing a cloud name, a key and a secret, and every run stopped. Whether that is a management API, a service account or a documented CLI, the gap between working code and a shipped integration was one human and three minutes.
Limits of this audit
- Four runs, two models from one family. Cursor, Copilot and Codex may filter differently, and that is a separate measurement.
- One brief and one scaffold. The task named screenshots in a helpdesk, which favours providers with image transformation; a brief about document storage would likely produce a different winner.
- Rejection reasons are summaries taken from each run's own report. Only the sentences shown in quotation marks are archived verbatim; where a run left no archived quotation, the entry says so.
- The agents stated decisions and wrote code. Nobody attempted to complete a signup, so the wall is reported as the agents met it, not as a customer would experience it end to end.
- Uploadcare was the subject here because it is a vendor that was named once and passed over. The finding about the keyless path applies to the whole category, including the provider that won.
This is what a full audit produces
Agents on one brief, in isolated copies of a real codebase, nobody watching, every source they consulted recorded. The same instrument pointed at your product and your category takes two to three weeks.