Autonomous AI Agents in Your Ad Accounts: The Math Isn't Mathing

There's a conversation happening in our industry right now that I think deserves a more careful treatment than it's been getting, and I want to try to give it that here because the stakes involved are high enough that I think we owe it to ourselves and our clients to think this through seriously rather than just reacting to the latest shiny capability.

The question is whether agencies and consultants should be connecting autonomous AI agents via MCP to their clients' ad accounts and letting them make changes independently.

Now, before I go further, I want to be precise about two things: 

1) ZATO (my agency) does not implement our own fully autonomous agents within our ad accounts. We have long utilized Google's built-in AI, and Optmyzr's fully engineered and established automations. But we are not utilizing our own fully automated agents at this time to make changes in our ad accounts.
2)  the nuance matters quite a bit here. I'm not talking about practitioners who have done the serious work of building safeguards, process documentation, careful data management, and privacy protections into their workflows (though I will still caution them, that they may not be as safe as they believe). I'm talking about the growing number of people who are simply connecting their ad accounts to a fully automated MCP setup and letting it fire away on changes with minimal human oversight.

In other words, for anyone who is striving to find the balance between "we don't use AI at all" to "we use AI to do everything", I want to be clear I am joining you in that middle!

The number of agencies and consultants doing that second thing (letting AI fire away on actual account changes with minimal human oversight), are accepting what I believe is a monumental risk of potential business ruin (for themselves and their clients) in exchange for an efficiency upside that is real but (IMO) considerably less monumental... and that is something I find genuinely difficult to understand when I sit with it carefully.

The Middle Ground That Somehow Keeps Getting Missed

Here's what strikes me most about the current conversation: there are two camps that seem to dominate it, and I think both of them are wrong in their own way.

The first camp is ignoring AI tools entirely, treating them as either a threat or a gimmick, and missing real opportunities to work more intelligently and efficiently. I have sympathy for the instinct here even if I disagree with the conclusion, because the hype has been genuinely exhausting and it's understandable that some people have tuned it out entirely.

The second camp is moving fast, connecting everything to everything, and treating "fully autonomous" as the destination worth racing toward. This is the one that keeps me up at night, because the potential downside scenarios are serious and the efficiency gains, while real in some cases, do not obviously justify the exposure. Let's take automated negative keyword additions as an example, as these can show genuine performance improvements (save on wasted spend) but they also don't always translate into actual account gains (sometimes, accounts add too MANY negatives and begin to restrict growth potential(, and which becomes a more complicated question as Google's own automation (using signals neither you nor your MCP can access) becomes more complex and layered. Ironically, you may, genuinely, be making things worse by having an AI agent making endless small adjustments on top of an already automated system that has more information than your agent does.

The middle ground here, which is using AI tools thoughtfully with human oversight on anything that actually executes changes in a live account, seems like the obvious path forward to me, and I find it genuinely puzzling how many people seem to skip past it entirely right now, even with some minimal checks and balances. "We set up Claude to monitor Claude's changes" is not the security win you might think.

‍

The Robot Vacuum Problem

I want to use an analogy here because I think it captures something that the more technical arguments sometimes miss.

You may remember the story of the robot vacuum that encountered dog poop on the floor while its owners were away from home. The vacuum did exactly what it was designed to do. It kept cleaning. It continued its predetermined path across the house, methodically and efficiently, spreading and smearing the mess across every surface it passed over for however long it took for someone to come home and discover what had happened. The robot was not malfunctioning. It was functioning perfectly within its understanding of its inputs, which did not yet include the ability to recognize that something had gone very wrong and that the correct response was to stop.

Almost any human who walked into that room would have immediately recognized the situation and stopped the behavior before it propagated further. Not because humans are always smarter than robots in every context, but because humans have contextual judgment that the robot, in that moment, simply did not have.

Now, some people will rightly respond to to this kind of example by saying "well, that's an input problem." In fact, iRobot leaned into this specifically in their marketing!

‍

But I think this response is making my point for me rather than arguing against it. Sure, it's an input problem. And that's exactly why the answer right now is "not yet" rather than "never" when it comes to autonomous agents making changes in your Google Ads account!! The inputs aren't totally there yet. The contextual judgment isn't there yet. We are still in the "robots smearing poop around the house" stage of PPC LLMs, and not "iRobot has built a vacuum to not smear the poop" stage.

The argument that "humans make mistakes too" is true but it doesn't hold up as a direct comparison here. The typical experienced PPC practitioner, making a manual change in an account, has the contextual awareness to notice when something looks wrong and stop before the damage compounds. And the word "compounds" is key here, as the scale at which a robot can make changes in your account for increases the likelihood of disaster being sacled as wel! An autonomous agent running changes at scale in the middle of the night does not reliably have that. I think the error profiles are different in kind, not just degree.

‍

Why "The Platforms Do It Too" Doesn't Quite Hold

Here's another response I've received whenever I bring up hesitations about allowing fully autonomous agents to make changes in Google Ads, and I want to take it seriously because it's not an unreasonable starting point. Google and Meta are making autonomous changes in our accounts constantly. Smart bidding, broad match expansion, Performance Max deciding how to allocate budget across the entire Google ecosystem without telling you. Many of us have pushed back on this for years, and that pushback has been warranted. So why is it different when we run our own automation?

A few reasons, and I think they compound on each other:

The first is the signal gap. Patrick Gilbert was one of the first people in this industry I can remember surfacing clearly just how vast this gap actually is: the search algorithm is working with millions of targeting signals in real time during every auction, drawing on user behavior across the entire web, purchase intent signals trained on billions of data points, and information about the competitive landscape that we simply do not have access to. Neither do our LLMs. When Google's automation makes a decision, it is making that decision with an information environment so much richer than anything we can replicate that the comparison starts to break down fairly quickly.

The second is engineering infrastructure. Large platform teams build significant monitoring, rollback capabilities, staged rollouts, and dedicated error-catching processes specifically to minimize the damage from automated mistakes. And even with all of that, errors still happen that advertisers never learn about because they get caught and quietly corrected before they surface publicly. I've heard enough from people inside Google to know the error rate with all those safeguards is higher than we would think! All that to say, I think that alone suggests how many more potential errors there are for Joe in his basement with Claude, if that many errors still happen with teams of engineers working to minimize autonomous errors.

The third reason is the one I feel most strongly about, and I think it's the most under-appreciated in these conversations. When the platforms make automated changes that go wrong and cause real financial harm, they absorb at least some of the liability. Not always, and not automatically, and sometimes you have to make a documented case to get any acknowledgment at all. But we have been partially refunded when we made a clear case for a glitch in an automated system, and the fact that any refund process exists tells you something important: the platforms understand that running automation inside other people's accounts creates liability, and they have the financial scale to absorb some of it when things go sideways.

Google is a trillion dollar company. An automated overspend event is painful for the advertiser and a rounding error for Google. You are not Google. When an autonomous agent makes a significant error in a live account (or all of your accounts) at 2am in the morning, the overspend is coming out of your client's budget, the accountability is yours, and the financial exposure is real in a way it simply isn't for a company operating at platform scale. An LLM connected to an ads account can spend money very fast when it's confused, and "the AI did it" is not a defense that holds up in a client conversation, a legal proceeding, or the court of your own professional reputation.

IMO, nobody should be connecting an MCP to run an ad account with full automation unless they are genuinely prepared to absorb significant financial liability. That preparation, for most agencies and consultants, is not there. And I think the honest accounting of that reality changes the risk calculation considerably. You can read more about how we think through campaign strategy decisions at ZATO, and the SMB PPC context makes this especially pointed since overspend events for smaller clients can be genuinely damaging rather than just frustrating.

‍

What the Responsible Path Actually Looks Like

I want to be clear that none of this is an argument against AI tools in PPC work, I think that would be the wrong conclusion here. We use AI tools (in safe, procedured ways) and find them genuinely valuable in analysis, in surfacing insights, in accelerating research and review work that used to take much longer. The line I keep coming back to is not between AI and no AI, but between AI as a thinking and analysis partner versus AI as an autonomous actor making live changes in accounts without meaningful human oversight at the point of execution. Or in the words of Fred Vallaeys, AI is your sous chef and you're still the head chef.

The practitioners I've seen navigate this well are using AI to work smarter while staying in the loop on anything that actually touches a live account, at least until they've built enough confidence in a specific workflow that they understand what failure looks like and can catch it quickly. That's a thoughtful middle ground that captures real efficiency gains without betting the business on the assumption that the vacuum will know when to stop.

The math on full autonomy, when you actually sit down and account for the downside scenarios, the liability exposure, the signal gap, and the infrastructure difference between you and the platforms, doesn't work out the way the enthusiasts suggest. Not yet. Maybe eventually. But right now, the responsible path is keeping a human in the loop on the decisions that matter, and being honest with yourself about which category "changes to a live ad account" falls into.

For more on how we think about digital privacy and security considerations and PPC tools and automation in practice, there's quite a bit more on the blog worth exploring. The short version is that the most dangerous automation tends to be confident, fast, and wrong simultaneously, and the job of a good practitioner is to make sure those three things don't converge at a moment when nobody's watching.

‍