AI Agents
How autonomous AI systems behave once they are deployed, coordinated and left to run: what works, and what breaks without anyone noticing.
An AI agent is not a chatbot that does more. It is a system that takes actions, not just outputs. That distinction changes everything about how you build with it, how you trust it, and how you find out when it has gone wrong.
What Makes Agent Systems Different
Most AI applications are stateless. You send a prompt, you get a response. The interaction ends there. Agent systems are different: they maintain state across steps, take actions that have consequences in the real world, and often operate faster than any human can monitor them.
This creates failure modes that language model benchmarks do not capture. A model that scores well on reasoning tasks can still fail systematically when embedded in a multi-step pipeline. Not because its reasoning is bad, but because its reasoning is local. It optimizes for the step in front of it without understanding the broader context it is operating in.
The Coordination Problem
When multiple agents work together, each responsible for a different part of a pipeline, the question of who is responsible for correctness becomes complicated. Each agent passes output to the next. Each agent trusts the output it receives. If one agent produces something subtly wrong, the downstream agents typically do not catch it. They incorporate it. By the time the error is visible, it has been processed through several layers of confident-sounding output.
The essays in this chapter examine these failure modes directly: the structural reasons they occur, the conditions that make them more or less likely, and the approaches that actually help in deployed systems, not just in theory.
Economics and Trust
Using AI agents at scale is also an economic question. The cost per action, the latency per step, and the reliability threshold required before removing a human reviewer from the loop: these are not engineering parameters. They are business decisions that require understanding what autonomous systems are actually good at versus where human judgment remains necessary.
These essays look at where the lines are, based on what the current systems can and cannot do, and how those lines are likely to move.
30 essays in this chapter
- AI Agent Repeats Actions After a Kubernetes Pod Restart An AI agent repeats actions after Kubernetes pod restart when completed steps live only in memory. Log each action to a durable ledger before running it.
- Quarantine an AI Agent After Repeated Guardrail Blocks To quarantine an AI agent after repeated guardrail blocks, count blocks in a window, hard-exit the process, and write a sentinel only a human can clear.
- Multi-Turn Jailbreaks Against AI Agents With Tool Access Multi-turn jailbreak AI agent defense means enforcing tool permissions in code on every call. Refusals and per-message filters miss attacks spread across turns.
- Customer Support AI Agent Prompt Injection: Refund Abuse Support bots can be talked into refunds when the limit lives in the prompt. Air Canada, Chevrolet and the benchmark data show why caps belong in tool code.
- Detect Unauthorized AI Agents Using Company API Keys Detect unauthorized AI agents using company API keys by logging a caller ID on every call and reconciling provider usage with approvals, not key spend.
- Detect AI Agent Actions Outside Task Scope: Block, Don't Log To detect AI agent actions outside task scope, check each tool call against a declared task contract before it runs, and block anything unnamed.
- Break-Glass Access for AI Agents: Approved, Timed, Expiring A break-glass grant for an AI agent is a human-approved, time-boxed elevation that expires on its own. My own bot's halt-path failures show why.
- A2A Protocol Authentication Security: Agent Cards and Signed Requests A2A protocol authentication security goes past signed Agent Cards. A valid signature proves who signed the card, not whether you should trust it.
- Limit Subagent Spawning: Recursion Depth Isn't a Budget Recursion depth limits cap how many subagents exist, not what they spend. How LangGraph, OpenAI and Claude Code limit spawning, plus a budget gate.
- Durable Execution for AI Agents: Temporal vs a Plain State Store Durable execution for AI agents: when Temporal earns its keep, when a plain state store is enough, and why resuming can be the dangerous part.
- Feature Flags for AI Agents: Disable One Tool Without a Redeploy Feature flags for AI agents: how to disable one tool in production without a redeploy, and why the flag itself can hide the failure.
- MCP Tool Poisoning Attacks: Hidden Tool Descriptions and Rug Pulls MCP tool poisoning hides instructions in a tool description, and rug pulls change them after you approve. Why one-time approval fails, with real cases.
- Policy as Code for AI Agent Tool Authorization: OPA or Cedar Policy as code for AI agent tool authorization: why OPA or Cedar should decide every tool call, not the prompt. Real incidents, one hard lesson.
- AI Agent Rollback: Why the Saga Pattern Fails for Tool Calls Compensating transactions can't un-delete a production database. Why the AI agent rollback saga pattern breaks, with 2025-2026 incident data.
- Least Privilege for AI Agents: Scoping Tools, Keys and Filesystems Least privilege for AI agents in practice: how to scope tools, credentials and filesystems, with the Replit and Amazon Q incidents as evidence.
- Multiple AI Coding Agents, Same Repository: The Bugs Git Won't Catch Running multiple AI coding agents in the same repository breaks in ways git never reports. Shared ports, databases and lockfiles, and how to guard them.
- Context Window Management for Long-Running AI Agents: 4 Patterns That Work Context window management for long-running AI agents isn't compression. Four patterns from years of long agent runs, one embarrassing mistake of mine, and what the long-context benchmarks actually say.
- When Not to Use an AI Agent: The Architecture Decision Nobody Talks About Gartner says 40% of agentic AI projects die by 2027. When not to use an AI agent, how an AI agent differs from a workflow, and why 'just add an agent' is usually backwards.
- Why LLM Agents Fail Silently in Production (And How to Detect It) A silent agent failure doesn't crash. It reports success. Here's the uncomfortable economic reason most teams never find out.
- How to Add a Circuit Breaker to an AI Agent Loop (Mine Took 3.5 Days to Get One) My bot detected its own ban and kept running for 3.5 days. How to build an AI agent circuit breaker that bounds rate and duration and exits the process.
- AI Agent State Management: Why Your Agent Ignores What It Already Knows Agent state management isn't memory. My Twitter bot detected its own suspension and kept drafting replies for 3.5 days. Here's the hidden state behind it.
- Do Reasoning Models Actually Make Developers Faster? What the METR Study Found METR's 2025 randomized trial found experienced developers were 19% slower with AI while believing they were 20% faster. Here's what that means for reasoning models, code review, and how I build.
- Semantic Routing: How I Cut LLM Costs 70% in Production Semantic routing cut my LLM costs 70% without hurting quality. Most teams still send every request to the expensive model. Here is what actually breaks.
- RAG Hallucination Rate: Why Retrieval Still Fails in 2026 RAG hallucination rate is still 17-33% on production legal tools. Retrieval did not fix this. Long context just moves the same failure into the prompt.
- LLM Hallucination Rates in Production: What the Data Actually Shows LLM hallucination rates in production run from under 1% on grounded summarization to 58-82% on open legal questions. Here's what the data shows, and why adding a human reviewer doesn't fix it.
- AI-Assisted vs AI-Autonomous: Where the Line Actually Is and Why It Matters 95% of AI pilots fail. Here's what the data reveals about when autonomous actually works, and when it's just expensive.
- Why AI Automation Dies After Go-Live (The Real Reason Isn't Technical) Your AI automation goes live and works for four months. Then drift kills it. Why 42% of companies abandoned most AI initiatives in 2025, and how to prevent it.
- LLM Function Calling in Production: Reliability, Failure Modes, and Design Patterns Honeycomb shipped LLM function calling to production before the API existed. What they found, plus τ-bench and BFCL numbers, real failure modes, and the validation layer nobody ships until it burns them.
- Why Multi-Agent AI Systems Fail in Production (And Which Patterns Hold) Multi-agent AI systems fail at the handoff, not the model. What cascading trust costs, whether more agents reduce errors, and the schema and step-ceiling configs that hold under load.
- Human-in-the-Loop vs Autonomous AI Agents: A Cost Comparison AI agent economics: when autonomous AI agents beat human-in-the-loop review on cost and accuracy, plus the break-even formula for deciding which workflows to automate.