X reply bots: auto-comments, AI replies, and what gets caught

Most of what is sold as a comment bot for X is the one kind of automation the rules name as not permitted, and what the rules do permit is narrower than the people selling it say. This page separates the two, quotes the rule for each, and describes what a reply engine that keeps its accounts looks like.

X, still Twitter to most search engines, says more about replies on its automation page than about any other action, and the tools in the search results do not quote it, so the rule comes first.

What X's automation rules say about replies

The automation rules page (marked "Updated April 2026", checked 19 September 2026) has a section on replies and mentions. The lines that matter, quoted:

• Unsolicited volume is out. "Automating these actions to reach many users on an unsolicited basis is an abuse of the feature, and is not permitted. For example, sending automated replies to posts based on keyword searches alone is not permitted." That second sentence is the standard comment bot: pick a keyword, reply to everything that matches.
• Opted in means they came to you. Automated replies are permitted when the recipient has opted in, "for example by replying to a post from your account, or by sending you a Direct Message", and there is a way to opt out.
• One per interaction. "you only send one automated reply or mention per user interaction".
• A follow is not consent. "a user following your account is not on its own a sufficient indication of user intent to receive an automated response."
• AI reply bots need permission. "the deployment or operation of any AI reply bot requires prior written and explicit approval from X."

The two kinds of reply automation

Replying to people who engaged with you

Someone mentions your account, or replies to one of your posts, and a tool answers them. This is the kind the rules describe as opted in: the person came to you. The constraints still apply: one automated reply per interaction, a way to opt out, and text that answers what they said. A generic thanks under every mention is opted in on paper and still reads as a bot.

This is what flottra's engage_notifications task does: it replies to mentions and to replies on the account's own posts, and to nothing else. It is the duller half of reply automation and the half that produces conversations.

Replying to other people's posts

The tool finds posts by strangers and replies to them. This is what "comment bot" means in practice, and it is the kind the rules describe as unsolicited when it reaches many users. Whether a slower version that picks a few posts a day from a feed is the same thing is a judgement the rules leave to X, and X does not publish where the line sits.

flottra's feed_reply task does this second kind, at a low rate. The account browses its own feed, and explore or search, the way a reader does; scores the posts it sees (a default minimum of five likes, keyword exclusions you set, an optional language filter, at most eight scroll passes); and replies to one. The cap is five replies an hour per account, a ceiling rather than a target. It runs in a real Chrome window on your own computer through your own proxy, so the ground rule above applies to it as much as to anything else on this page. Whether that makes a difference to X is your judgement, not a claim this page makes.

Why templated replies get caught

The oldest comment bot design is ten pleasant sentences and a random pick. "Great post, thanks for sharing" from thirty accounts is the same text posted in bulk, and X's authenticity policy (dated April 2025) has a name for it: "Content Spam: You may not share or post content in a bulk, duplicative, irrelevant or unsolicited manner that disrupts people's experience." It also ties the thirty accounts together, the same problem the suspensions guide describes for posts.

What follows is usually reply deboosting rather than a suspension. X's enforcement options page lists "Downranking the post in replies" among the ways it limits the visibility of posts that break its policies. The reply is still there, behind "Show more replies", and your own session still shows it in place, so check from a logged-out browser: the shadowban guide has the test.

A reply that is meant to survive is all of the following:

• Specific to the post. It refers to something the post said. That alone rules out templates.
• Short. One or two sentences. A long reply from a young account reads as content marketing.
• Different per account. Not a synonym swap. Two personas say different things about the same post, or reply to different posts.
• Without a link. A link is the clearest tell that the reply exists to send traffic somewhere.
• Without a call to action. "Follow for more" is the reply that gets reported, and reports are the one signal you cannot pace away.
• Rarer than you want. The number of replies you would like to send is the number that gets the account actioned.

AI replies: what the model does well, and badly

A language model removes the template problem. Given the post and a persona, it writes something on-topic and different every time, and thirty personas do not produce the same sentence. In flottra the text for a feed reply comes from smart_reply: a model prompted with a per-account persona and a length bias toward short replies. The text is generated per account, not broadcast from several.

What the model does badly is the list every operator learns the hard way:

• Confident nonsense. It answers a question in the post with a fact it made up, under your account's name.
• Sarcasm taken literally. A post that says the airline did a great job gets a sincere reply about the airline's great job.
• Sensitive posts. A cheerful on-topic reply under a post about a death or a layoff is the one that gets screenshotted and reported. The automation rules recommend filtering sensitive language in handles and text; do it before the model sees the post.
• The wrong language. A persona that writes English under a post in another language is obviously a bot to everyone in that thread.

None of this is fixed by a better prompt. It is reduced by the choosing rather than the writing: a minimum of engagement on the post, a stop list, a topic filter, a language filter, and a bot that is allowed to skip when unsure. The bot that skips most of what it is shown is the better bot.

How many replies a day

The limits page (checked 19 September 2026) publishes one reply figure: "Posts: 50 original posts and 200 replies per day for unverified accounts. The daily update limit is further broken down into smaller limits for semi-hourly intervals." It gives no per-hour reply figure and does not state a different number for Premium accounts. The rate limits guide has the full table.

Two hundred is the technical ceiling and says nothing about the safe one. An account that sends two hundred replies a day is a reply bot by shape whatever the text says. A cautious operator runs a handful of replies an hour at most, fewer on a new account, and none in its first days: the warming ramp in the suspensions guide sends no replies for the first three days and stays in single digits a day for the whole three weeks.

Shape matters as much as the total. Evenly spaced replies describe a scheduler; replies at 03:00 on the account's own clock describe a scheduler in another timezone; forty replies and no original posts describe an account that exists to reply. Waking hours, uneven gaps and a plausible ratio of replies to posts cost nothing and remove tells that good text cannot.

What a reply engine that survives looks like

Put together, in the order that matters:

1. Reply to your mentions and to replies on your own posts first. It is the opted-in kind, and it is where conversations come from.
2. If you reply to strangers' posts, choose them: a minimum of engagement, a topic filter, a language filter, a stop list, and a feed rather than a keyword search.
3. Write, or generate, text that is specific to the post, short, unlinked, and different for every account.
4. Cap replies at a handful an hour, ramp new accounts from zero, keep to waking hours on the account's own clock, and vary the gaps.
5. Give each account its own proxy and a persistent browser profile before you give it a reply schedule. Content is only one of the four signals in the suspensions guide. See choosing proxies for X accounts.

An automated like puts you in someone's notifications once; a reply that says something puts you in a conversation. Automate the choosing and the pacing, keep a person close to the text, and accept that the rules on replies are the most detailed of any action you can automate.