#ai-agents

We gave an agent access to production on-call in stages over five months: read only, then propose, then act on a short list, then act on a longer one. Each stage had a specific thing it had to prove before the next. The rules that came out of it are simple enough to fit on a page, and they are not the rules I would have guessed at the start.

A client asked me to take over a product that had been built in four months by two people and an agent. It worked. Sixty thousand lines, no human had read most of them, and the first bug took a week to find because there was nobody to ask. This is what it is like to inherit vibe coded software, and what I would have done differently in the four months.

Our take-home test stopped working in the autumn. Every submission was clean, tested and roughly identical. The candidates had all used the same tools, and the test was measuring the tools. We rebuilt the process around the only thing that still separates candidates: what they do with an agent's output. Here is the loop, the exercise, and what it found.

A million token context window did not make the long-running agent problem go away. It moved it. The model still forgets the thing you told it an hour ago, only now it forgets it after paying for it forty times. The techniques that work, compaction, retrieval, memory files, all turn out to be the same techniques we use to manage a cache.

By spring more than half of the pull requests on our main service were opened by an agent. The review process we had was built for humans who understood their own diff. It broke in specific ways, and the fixes were not 'read more carefully'. They were changes to what a PR has to contain before a person looks at it.

Every agent I audited this year had the same shape of problem: it authenticated as a service account with more access than any human on the team, on behalf of a user whose identity was lost the moment the request left the browser. The question 'who is this call for' had no answer in the logs. Fixing it is mostly an OAuth problem, and the pieces exist now.

An agent that runs for forty turns, calls twelve tools and talks to three models is a distributed system with one process. We spent two years learning to debug those with traces. The GenAI semantic conventions in OpenTelemetry let you do the same thing here, and the first trace I looked at explained a bug that logs had hidden for a month.

Every team that adopted MCP hit the same wall by spring: forty tools in the context, a model that picks the wrong one, and a bill that grew with every server you added. Skills, the folder-of-markdown pattern that spread through coding agents this year, fix a different problem than MCP does. Knowing which is which decides whether your agent gets better or just bigger.

A single GitHub issue was enough to make a coding agent leak a private repo through the official MCP server. The Git MCP server fell to path traversal from a prompt alone in January. None of these were model failures. They were the same mistake we made with SQL in 2004: letting data and instructions travel on the same wire.