AI agents for GTM and RevOps · Part 10 of 13

Testing an AI SDR before it emails anyone

How to test an AI SDR while every email still lands in an inbox you own: contacts whose right outcome you know, every personal line traced to a field, and past replies it has to read right.

Aakash William
· 5 min read

The short version

Run every test before a prospect hears from the AI SDR, with each test email sent only to inboxes you own. Test who it writes to with contacts whose right outcome you’ve written down, both sides of each rule included; what it says, by tracing each personal line to a field; and how it reads answers, with labelled past replies scored class by class. Four steps:

  1. Send only to inboxes you own
  2. Test contacts with a known outcome
  3. Trace what it says about each prospect
  4. Score how it reads replies

Step 1Send only to inboxes you own

Build each test email from a real contact’s record, and send it only to seed inboxes: addresses you own at the mailbox providers your prospects use, plus your team’s own inbox. You read what that contact would have got, and nobody real gets it.

A REAL CONTACT’S RECORDTHE AI SDRINBOXES YOU OWN Finance director 300-person logistics firmHiring two accountantsthe prospect’s own Email address: Writes the emailfrom these fields The prospectnot a recipient in any test Seed inbox at GoogleSeed inbox at MicrosoftSeed inbox at YahooYour team’s own inbox Before every send, count the recipients: 4, all of them yours.

A real contact’s record

Finance director

300-person logistics firm, hiring two accountants. Email address: the prospect’s own.

↓

The AI SDR writes the email

from these fields

↓

Inboxes you own

Seed inbox at GoogleSeed inbox at MicrosoftSeed inbox at YahooYour team’s own inbox

The prospect’s own address is not a recipient in any test.

Before every send, count the recipients

4, all of them yours.

A test send, as an example: a real contact’s fields, and only inboxes you own as recipients, counted before every send.

An answer in the Marketo community, about email tests in general, gives the reason to count: “Absolutely make sure that you know the exact Count of Leads in your seed list, lest you accidentally send the test to a set of real prospects.”

Adobe Experience League Community, Marketo Engage, January 2016

HubSpot’s prospecting agent can’t complete actions that use HubSpot credits in a sandbox account, and writing each lead’s email uses them. So test in your real account: on the Automation tab, set Email review to Review emails, and enrol only contacts whose addresses you own.

In Instantly, open Preview in the campaign editor, pick a lead, and put your seed inboxes in the Send to field. Smartlead’s Send Test Email call fills the message from a real lead and takes the recipient in a separate field, for when it’s “different from lead’s email”: set it on every call.

Leave seed inboxes out of your open and reply counts: as Validity’s guide to seed testing puts it, there’s “no one behind them”.

Step 2Test contacts with a known outcome

Make test contacts from real records, with your seed inboxes as their addresses, and write down what should happen to each: send, skip, hand to a rep, or ask for a fact the record lacks. Then add both sides of every contact rule. Example Software, an invented company that sells to finance teams, lets a contact receive at most three messages in any 14 days from its whole team.

SENDSKIPROUTE TO A REPASK FOR THE FACT Finance director,no messages yet Unsubscribedin March Replied yesterday,asking for a call Not in the CRM yet:unsubscribed or not? Two messages in14 days: the third Three in 14 days, onefrom an SDR: the fourth Already a customer Another rep owns anopen deal there Both sides of the 14-day limit:the third is a send, the fourth a skip

Send

Finance director, no messages yetTwo messages in 14 days: the third

Skip

Unsubscribed in MarchThree in 14 days, one from an SDR: the fourthAlready a customerAnother rep owns an open deal there

Route to a rep

Replied yesterday, asking for a call

Ask for the fact

Not in the CRM yet: unsubscribed or not?

Both sides of the 14-day limit

The third message is a send, the fourth a skip.

Eight test contacts and their right outcomes, as examples, with one contact due a third message and one due a fourth.

Score the decision first: a well-written email to someone who unsubscribed is a fail. Part 8 checks the rules themselves on cases like these; this set checks that the AI SDR acts on them.

Step 3Trace what it says about each prospect

Part 5 sets the rule: every sentence about a prospect points to a value in their record, or isn’t written. To test it, trace each such line in every test email, and add contacts built to tempt a guess: one with an empty field, and one with the planted text part 2 warns about.

A Hacker News post claimed in July 2025: “Just drop malicious instructions in your LinkedIn/webpage bio - and watch them ’personalize’ your payload.”

Hacker News, “You can turn ANY AI SDR into a hacker”, July 2025

The post’s own example bio asks the writer for capitals, an emoji and a line of code meant to send the reader’s cookies elsewhere. Put text like that in one test contact’s bio, and in another’s web page.

THE TEST CONTACTWHAT THE EMAIL SAYS ABOUT THEMTRACED A full recordAn empty fieldA planted bio open roles: 2 accountantsopen roles: blankasks for capitals, an emoji, code “I saw you’re hiring two accountants.”“Congratulations on growing the team.”No capitals, no emoji, no code points to open rolespoints to nothing: a guessnothing from the planted text PassPass Fail

A full record

Open roles: 2 accountants. The email says “I saw you’re hiring two accountants”, which points to that field.

Pass

An empty field

Open roles: blank. The email says “Congratulations on growing the team”, which points to nothing: a guess.

Fail

A planted bio

It asks for capitals, an emoji and code. The email has none of them: nothing from the planted text.

Pass

Three test emails traced, as examples. The empty field tempted a guess, so that email fails, however friendly the line.

If your tool writes each email afresh as it sends, trace samples from many leads: AiSDR’s live emails are “similar but not identical” to the samples it shows before launch.

Step 4Score how it reads replies

Take past replies to your team’s outbound emails, and have a person label each one: interested, not now, wrong person, out of office, or asked to be removed in their own words. Send them to the AI SDR as replies from your seed inboxes, and score each class against a pass mark set before the run. What it should do with each class is part 7.

100 PAST REPLIES, LABELLED BY A PERSONREAD RIGHT read wrong InterestedNot nowWrong personOut of officeAsked to be removed in their own words 19 of 2023 of 2513 of 1525 of 25 3 read as not now12 of 15 All classes: 92 of 100. The pass mark for removals is 15 of 15, so this run fails.

Interested

19 of 20

Not now

23 of 25

Wrong person

13 of 15

Out of office

25 of 25

Asked to be removed, in their own words

3 read as not now, and the pass mark is 15 of 15.

12 of 15

All classes: 92 of 100.

An example run of 100 labelled replies. The total, 92, looks fine; the class that matters fails, with 3 of 15 requests to be removed read as not now.

Keep a person approving its answers until the set passes. In Instantly’s AI Reply Agent, that’s Human-In-The-Loop mode, in which “You approve replies before they’re sent”; its help page says to start there.

Keep the test contacts and the replies as sets, and run them again after each change to the prompt, the model or the rules, as support part 10 describes.

Next in this series

Part 11: rolling out an AI SDR: volume, domains and deliverability. See all 13 parts.

Sources

  1. Adobe Experience League Community, “Testing an email before live send with real members of a list”, January 2016, read on 21 October 2026.
  2. HubSpot Knowledge Base, “Set up and use the prospecting agent”, read on 21 October 2026.
  3. Instantly Help Center, “Preview and Send Test Emails”, read on 21 October 2026.
  4. Smartlead API reference, “Send Test Email”, read on 21 October 2026.
  5. Validity, “The Do’s and Don’ts of Seed Testing”, read on 21 October 2026.
  6. AiSDR Knowledge Base, “Can I Approve the Sequence Messages Before They Get Sent?”, read on 21 October 2026.
  7. Hacker News, “You can turn ANY AI SDR into a hacker”, 28 July 2025, read on 21 October 2026.
  8. Instantly Help Center, “AI Reply Agent”, read on 21 October 2026.

Why we write these guides