How Agentic AI Redefines Job Searching, From OSINT to Personalized Outreach at Scale

The problem with traditional job searching

Job boards show you the same listings as everyone else. LinkedIn puts you in a queue of 300 applicants. Generic applications get ignored. The signal-to-noise ratio is terrible, and the process is designed to filter you out before a human even reads your name.

There's a better way. Skip the middlemen, go directly to the recruiter's inbox.

The strategy

Instead of applying to job postings, the goal is to:

1. Identify target companies matching your profile and interests
2. Find the recruiter or hiring manager using OSINT techniques
3. Guess and verify their email using known corporate patterns
4. Send a hyper-personalized application generated by an AI agent that researched the company
5. Do this at scale, without losing quality

This is what I automated with OpenClaw and a set of custom scripts.

Step 1 — Building the company list

Start with a list of target companies. You can source this from:

• LinkedIn company search (no account needed for basic scraping)
• Crunchbase / Pappers.fr for French companies
• GitHub org pages (for dev-heavy companies, check their org members)
• Job boards, but only to extract company names, not to apply

For each company, you need: company name, domain, industry, tech stack if possible.

companies = [
    {"name": "Verana", "domain": "verana.io", "industry": "SSI / Identity"},
    {"name": "2060.io", "domain": "2060.io", "industry": "DIDComm / Messaging"},
    # ...
]

Step 2 — OSINT: finding the right person

You don't want HR. You want the CTO, engineering manager, or team lead who actually makes hiring decisions. Here's how to find them:

LinkedIn public profiles (no login required for basic queries):

site:linkedin.com/in "engineering manager" "company name"

GitHub org members — for tech companies, their engineers are often public:

https://github.com/orgs/{org}/people

Company website — /team, /about, /careers pages often list names with roles.

Hunter.io — paste a domain, get a list of known email patterns and confirmed addresses (free tier: 25 searches/month).

Once you have a name, you move to email guessing.

Step 3 — Email guessing and verification

Most companies use one of these patterns:

The trick is not to guess blindly, but to verify before sending. Sending to a dead address hurts your domain reputation.

Email verification: how it works

The fastest verification method without paying for a service is SMTP probing:

import smtplib
import dns.resolver

def verify_email(email):
    domain = email.split('@')[1]

    # Step 1: get MX records
    mx_records = dns.resolver.resolve(domain, 'MX')
    mx_host = str(sorted(mx_records, key=lambda r: r.preference)[0].exchange)

    # Step 2: SMTP handshake (no email actually sent)
    try:
        server = smtplib.SMTP(timeout=10)
        server.connect(mx_host)
        server.helo('verify.local')
        server.mail('verify@verify.local')
        code, message = server.rcpt(email)
        server.quit()
        return code == 250  # 250 = address exists
    except Exception:
        return None  # inconclusive

Limitations: some servers (Gmail, Microsoft 365) always return 250 regardless (catch-all domains). In that case, use a dedicated service:

• Hunter.io — GET /v2/email-verifier?email=...&api_key=...
• Zerobounce — more accurate, has disposable/catch-all detection
• Reoon — cheaper for bulk verification

import requests

def verify_with_hunter(email, api_key):
    r = requests.get(
        "https://api.hunter.io/v2/email-verifier",
        params={"email": email, "api_key": api_key}
    )
    data = r.json()["data"]
    return data["status"]  # "valid", "risky", "invalid"

For a catch-all domain, send to the most statistically likely pattern based on Hunter's domain search results.

Step 4 — Personalized outreach with OpenClaw agents

This is where agentic AI changes the game. For each company, an OpenClaw agent:

1. Researches the company — scrapes their website, GitHub, recent news, tech stack
2. Reads the recruiter's LinkedIn — picks up their background, interests, recent posts
3. Generates a personalized email — references specific projects, tech choices, challenges

The agent pipeline looks like this:

Company domain
    → scrape website + GitHub org
    → extract: tech stack, recent projects, team size, open positions
    → find recruiter name + LinkedIn
    → generate email with context
    → verify email address
    → send (or queue for review)

OpenClaw handles the orchestration. Each step is a tool call, and the agent decides what context is worth including in the email.

Example output for a SSI/identity company:

"I noticed you recently open-sourced your DIDComm relay implementation, and that you're working toward eIDAS 2.0 compliance. I've spent the last year working on exactly this stack at Verana and 2060.io..."

That's not a template. The agent wrote that from scratch after reading their GitHub.

Step 5 — Sending at scale without burning your domain

Don't blast 100 emails from your personal Gmail in one day. You'll land in spam and potentially get flagged.

Use a warm sending domain: create a subdomain (outreach.yourdomain.com) or use a service like Resend or Postmark with a clean IP reputation.

Throttle: 10-20 emails/day max when starting, ramp up over 2-3 weeks.

Plain text > HTML: recruiter inboxes are not marketing targets. Plain text emails have higher deliverability and feel more human.

Track opens sparingly: one invisible pixel is fine. Don't add UTM parameters, don't use heavy tracking SDKs.

Results

Out of 130 personalized emails sent across French and European tech companies:

• Open rate: ~65%
• Reply rate: ~24%
• Interview requests: 4 companies asked for a call or technical interview

The bottleneck was no longer "getting seen", it was choosing between opportunities.

Tech stack summary

OpenClaw (agent orchestration)
├── Web scraper (Playwright + Cheerio)
├── GitHub API (org members, repos, tech stack detection)
├── Hunter.io API (email patterns + verification)
├── Zerobounce (catch-all domain fallback)
├── Google Search (company research)
└── SMTP (Resend API for sending)

The full pipeline runs autonomously. You review and approve emails before they go out, but the research and drafting is entirely automated.

What this changes

Recruiters get hundreds of generic applications. A cold email that demonstrates you already understand their codebase, their challenges and their stack, lands differently.

Agentic AI doesn't replace the job search. It removes the part that's pure friction, finding the right person, researching the context, writing something worth reading, and lets you focus on the conversations that actually matter.

The code for the scraper and email pipeline is on my GitHub. Questions or feedback, reach out on Mastodon.