Posts tagged Agents.

A ticket that just moved a folder, same files, same format, diff untouched, quietly moved tweet-derived text into a trusted agent's read path: a prompt-injection regression that shipped clean because it passed its own acceptance criteria. The fix: key trust on provenance the server controls, never on which folder a file sits in.

The same model scored 70%, then 30%, on the same injection-resistance eval. Neither number was real: the first came from a prompt shape production never serves, the second from a token cap that truncated answers before the validator could see them.

Swapping a Gemini model alias for a concrete id looked like housekeeping. It jumped a major model version. Gemini 3 requires echoing back an opaque thought_signature field on every replayed tool call, and no test caught the gap because it only surfaces on the second turn of a run.

A 27-second stall traced back to a token quota, not a request quota: Shannon's agent loop was re-sending its entire context on every turn. The fix is prompt caching with breakpoints placed where each layer of context stops changing, plus a canary token that almost broke it again.

What happens when a cloud AI agent needs to ask the user a question mid-task? You can't just block a coroutine. The fix: treat the agent loop as a function whose entire state is a message list, serialize it to Postgres, exit the process, and reconstruct the loop from scratch when the human answers.