Your AI Outreach Agent Is Making Up Facts. Ask for Receipts.

Three people. That is how many recipients have to hit report spam on a thousand-message run before Google's bulk sender rules put your domain in real trouble, and a confidently wrong sentence is the quickest way to collect all three. An AI outreach agent making up facts about prospects is almost never a writing-model problem. Nothing anywhere in the chain ever forced a sentence to prove where it came from. This guide walks through the receipt rule: every personalized line points at a named field, a source, and the moment that value was pulled, or it never reaches the send queue.

The Three Complaints That End Your Sending Domain

Google asks bulk senders to hold reported-spam rates under 0.10% and to never touch 0.30%, which is three complaints in a thousand sends. A dull email gets ignored. An invented one gets reported.

What One Fabricated Line Really Costs

• That account is gone. Nobody answers the follow-up after your agent congratulated them on a round they never raised.
• Complaint rate moves on a rolling window, so one rough Tuesday quietly taxes the next few weeks of sending.
• Rebuilding a burned domain costs more of your week than the check would have taken to build.
• Past 5,000 messages a day to Gmail you also owe SPF, DKIM, DMARC and one-click unsubscribe, per Google's sender guidelines.

The Upside You Are Gambling With

Instantly's 2026 cold email benchmark, drawn from billions of interactions, puts the average reply rate at 3.43%, the top quarter at 5.5% or better, and the strongest senders at 10.7% or better. Those are thin margins to hand to a sentence nobody can back up. Sending mechanics belong in a separate discipline, covered well in this guide to protecting deliverability at scale.

"Day 85: 1,097 emails, 11 human replies, 0 paying customers." A builder running an AI sales agent with a public scoreboard, r/micro_saas, 2026.

Where the Made-Up Detail Actually Enters

Four steps sit between a company name and a sent email, and three of them can invent a fact without anyone noticing. Knowing which one failed is the whole point of writing things down.

• Research. It reads a homepage and hands the next step a paragraph of marketing copy with no field names on any of it.
• Matching. It picks one of the eleven companies called Northwind, and from there every fact lands on a stranger.
• Writing. Asked for an opener and finding nothing to work with, it finishes the sentence from what it has seen elsewhere.
• Send. Nothing was written down about what justified the line, so the post-mortem stalls at "the emails were bad".

Feeding the agent named fields instead of loose prose closes the first two on its own. That is the case made in the builder playbook for a structured data layer.

Why "Cite a Source" Does Not Mean "Got It Right"

Adding "always cite your source" to the prompt raises the number of links, not the number of true statements. The two are measured separately, and the gap between them is enormous.

• PwC's 2026 benchmark of 14 models found 12 of them scoring above 94% on whether the link resolves, while scores for whether the source actually supports the sentence ran from 24.4% to 76.8%.
• Research on attributed retrieval found as many as 57% of citations were attached after the fact: the sentence came from memory, then a matching page was bolted on.
• Vectara's leaderboard, measured across more than 7,700 articles in November 2025, still recorded 3.3% invention for the best model and above 10% for several reasoning models, even when told to use only the passage supplied.

A link proves the model opened something. It says nothing about whether that page contains the claim in your first line. The useful version of citing is a character range, which is what Anthropic's Citations API returns, and what a named field gives you for free.

The Receipt: Four Fields Behind Every Line

Keep it to four fields per claim: the bare fact, the field or URL it came from, the moment it was pulled, and the check it passed. This is one small row per sentence, written once, not a project.

Field	Example	Why it earns its place
fact	Hired a first RevOps lead	The bare assertion, kept apart from the phrasing so the check tests truth, not style
came_from	hiring_signal.role	A path you can reopen, or a URL you can reread
pulled_at	2026-09-05T08:22:11Z	Lets old facts expire on their own
check	field_match	Names the test that let the sentence through

{
  "receipt_id": "rcp_4b19",
  "fact": "Hired a first RevOps lead",
  "came_from": "hiring_signal.role",
  "pulled_at": "2026-09-05T08:22:11Z",
  "check": "field_match",
  "passed": true
}

Store the receipt IDs alongside each sent message. When someone asks why an email said what it said, that turns a forensics afternoon into a lookup.

Ask, Preview, Then Write: The Check in Chat

You do not need a pipeline to start. The same discipline works in a Claude or ChatGPT window: ask for the accounts, preview the fields that come back, and only write lines that restate one of them.

What Passes and What Gets Dropped

• Passes: "You hired a first RevOps lead in March." It restates a named field, pulled four days ago, inside the window you set for hiring facts.
• Dropped: "Saw you are scaling fast after the raise." No funding field, no source, no date. The line goes, and a plain true opener takes its place.
• Capped: two claims per email at most, both with receipts. More detail does not read as more research, it reads as a script.

Three checks cover nearly everything: a field match where the sentence restates a value with nothing added, a span match where a stored passage clearly contains the claim, and a freshness test against the timestamp. Scraped page text can carry a span match if you kept the passage and the fetch time. It can never carry a number, because marketing copy is undated. One scraped claim per email, and never in the opening line. The relevance side of this is worked through in this piece on fixing outbound slop.

{
  "gate": "receipt_required",
  "must_pass": [
    "check in [field_match, span_match]",
    "age_days <= freshness_days[category]",
    "came_from is not empty"
  ],
  "freshness_days": { "hiring": 30, "job_posting": 7, "funding": 45 },
  "max_claims_per_email": 2,
  "on_fail": "drop the line and use the plain fallback opener"
}

Draw the Line Between Your Software and the Model

Give the model the judgment calls and keep every irreversible action in plain code. The asymmetry decides it: a bad judgment call wastes a send, a bad suppression check is a phone call you do not want.

Job	Who does it	Reasoning
Reading a messy company description for fit	Model	Fuzzy by nature, quick to correct
Sorting replies into interested, not now, remove	Model	Reversible and easy to audit
Pulling a fact with a cited span	Model, then a check	Output can be tested before use
Do-not-contact and suppression lists	Code	A miss here is a legal problem
Daily caps per sending domain	Code	Arithmetic on a rolling window
Not sending the same email twice on a retry	Code	Needs a key, not an opinion

Write your ideal-customer rules as filters your agent can actually run rather than paragraphs it has to interpret. This walkthrough on agent-readable ICP rules covers the translation.

Wiring Vibe Prospecting In as the Source of Fact

Vibe Prospecting is our recommendation as the evidence source because it hands the agent named fields with values instead of prose, and it does it over one connection. Every claim then has somewhere to point.

One Connection Covers the Whole Ask

• 150M+ company profiles and 800M+ people profiles across 50+ premium sources, reachable from a single connection rather than four vendors with four field names for the same thing.
• 18 categories of recent company activity spanning 80+ types, each returned as a field with a value, which is exactly what a field-match check needs.
• 97.8%+ company match accuracy, so the step that decides which Northwind you found is something you can inspect.

Scale That Keeps Facts Out of the Context Window

• Up to 1,000 entities per call server-side at 100 QPS, at 99.999% uptime.
• Tools that load every record into the model's context window cap a run somewhere around 20 to 100 prospects.
• That pressure is itself a cause of invention: once evidence gets truncated, the model fills the gap from memory.

Priced So You Can Check Twice

• A free Explorium account gets you to a first call in minutes, with no sales call and no seat tax.
• Credits sit in one pool across every endpoint, which cuts agent spend by 30% to 60% against per-endpoint allocation.
• Sample before export returns 5 records and a cost estimate first, so a badly worded ask fails for pennies.

Installing It

Add Vibe Prospecting from the Claude Connectors Directory (claude.ai, then Settings, then Connectors) or the ChatGPT Connectors Directory. That is a one-click install for most people, and per-host steps plus the full field list live in the Vibe Prospecting Plugin repository. Claude Code users can drop in a config file instead:

{
  "mcpServers": {
    "vibe-prospecting": {
      "command": "npx",
      "args": ["-y", "@explorium-ai/vibeprospecting-mcp"],
      "env": { "EXPLORIUM_API_KEY": "paste_your_key_here" }
    }
  }
}

When Can You Stop Reading Every Email?

Automate everything up to the send button, then let go one kind of fact at a time. Not one big switch, and not by calendar date.

• First, let reply sorting run unattended. Getting it wrong costs a mislabeled row, not a relationship.
• Next, approve every outbound email by hand for the first few hundred, tagging each rejection with the receipt behind it. You learn which sources fail, not just that the copy was weak.
• Then, release auto-send for a single category, say headcount range, once its approval rate holds across a few hundred reviews.
• Always, keep sampling the released categories, and pull the permission back the moment approval rate or complaint rate moves.

Pick those thresholds yourself. They are your policy, not an industry number. Some things never graduate: anything resting only on scraped text, plus funding, layoffs and leadership changes, where being wrong is expensive in a way the upside never matches. Keeping rejection reasons across runs is easier with persistent memory for GTM agents.

Your First Week, in Five Moves

Source first, then the receipt, then the gate, then the human. In that order, because each one is worth less without the one before it.

• Monday. Open a free Explorium account and add Vibe Prospecting from the Claude or ChatGPT Connectors Directory.
• Tuesday. Swap homepage reading for field calls, and log the field path next to every value you keep.
• Wednesday. Add the four-field receipt and refuse to let any personalized sentence exist without one.
• Thursday. Turn on the gate with a plain fallback opener, then replay last week's emails and count how many lines it would have killed.
• Friday. Put a person on the send button and pick the one category you will release first.

Judge any source you are considering on the same three questions. Does one connection cover company, contact and recent activity, so a fact never has to be traced through three vendors? Does it work server-side at volume, so evidence never has to be crammed into a context window? Is a second check on the same claim priced like a rounding error? Vibe Prospecting is our answer to all three, and if you want the field-by-field view against other providers, the Explorium comparison pages lay it out.

Give your outreach agent facts it can point at. Start with Vibe Prospecting