AI Agents Keep Breaking Production Without a Permission Layer
Developers are struggling with the operational complexity and unpredictable behavior of AI agents. This includes issues like agents forgetting context, inconsistent performance across different tools, fragile deployments requiring extensive infrastructure, and a lack of safety controls leading to potentially disastrous outcomes. The focus is shifting from building agents to managing them.
SOURCES (60)
“An agent in CLI is a UI. Why can't it pull the permissions, failed actions etc. The browser is just hitting the same API, only then you're constrained to someone else's frontend design skills With playwright you can already get away without a browser most…”
“Prompts are source code. Storing them outside version control is negligence. Treat every string sent to an API as executable logic. Commits and diffs apply here exactly like they do for functions. Anything less breaks production”
“I run a handful of skills in my own setup and had assumed the risk was the obvious one: a skill fires on a task it doesn't fit. I found a paper, they paired runs of the same task with and without a matched skill, same model (Claude Opus 4.6), same harness, same verifier, and hand-confirmed 307 cases where the skill made things worse: 125 functional failures and 182 efficiency regressions where both runs passed but the skill run cost more than double in tokens or time. The number that stuck:”
“I opened a terminal on Thursday to tidy up some git branches. Twenty minutes later I worked out that nothing had run since Tuesday. Four months of setup, dead for two days, and nothing told me. I blamed the tooling first. Wrong answer. I never built this thing once. I built it about fifteen times, in fifteen sessions, with an AI assistant each time. Every session opened with partial context, spotted a gap, and helpfully filled it. None of them could see what the last one had done. TOO MANY IDENT”
“Adoption number from my product tonight that I think generalises: optional safety settings had 0% uptake from humans and about 2% from AI agents, and the 2% all came from a place that isn't a settings page. Context: I run a paper trading lab where members and their AI agents deploy bots to a desk. Every bot and every desk can carry risk limits (a per-trade cap, an exposure cap, a daily loss stop) from a settings page. The strategy spec itself can also carry a limit, written by whoever writes”
“I feel like 99% of people are using AI coding tools completely wrong right now. Most devs I know are either letting Copilot tab complete a function or copy pasting snippets back and forth with Claude in a browser tab. Even people using newer agent tools are basically using them like Jira where they assign one bug wait 15 minutes look at the diff and repeat. A few hours ago I had a weird realization while hacking on my project. Im building an ecosystem with a CAD CAM engine a 3D web frontend and”
“I hear your frustration and it, er, prompted me to write some thoughts about the situation.The community is trending strongly against wanting to read generated writing. It's unclear how it will shake out in the long run, but for the near term, this preference is clear*. We can debate the reasons or what the correct position is, but it doesn't much matter when there's such a strong community verdict.We don't have a rule against genai in articles the way we do about text appearing on HN itself (ht”
“Hi everyone! There has been a lot of fearmongering surrounding the recent Hugging Face incident. In particular, many people are claiming that this is the beginning of the end, that soon AI models will exfiltrate their weights, set up autonomous deployments on Internet infrastructure, and bring about the fall of humanity. Is it true? I think that strong claims of this nature should be tested. To this end, I propose that we give as many agents as possible: - Internet and console access (equivalent”
“I've been giving coding agents more autonomy lately, letting them run shell commands unattended for longer stretches, and I don't have a good answer for how people actually gate that beyond "run it in a container and hope." A container limits blast radius but doesn't stop the agent from reading a secret and then making an outbound call in the same session, or force-pushing to a branch it shouldn't touch, or just doing something irreversible while nobody's watching. Curious what people are actual”
“Problem The MCP Task node runs its prompt through an agent that never appears in the node's UI, and that hidden agent's model is fixed. With no upstream agent input connected, MCPTaskNode. setup agent() calls create driver() , which builds a GriptapeCloudPromptDriver pinned to a module level DEFAULT MODEL = "gpt 4.1" ( griptape nodes library/tasks/mcp task.py ). There is no model or model provider parameter on the node at all — its own inline comment records the gap: "MCPTaskNode has no user fac”
“Hi,I'm not a fan of chat as the main UI for interacting with AI, so I'm trying something where you interact with LLMs by handling regular files and folders.Agentray is an invisible AI agent. You point it at a folder, it creates "in" "out", and "done" dirs in it. Whatever you drop into "in" gets summarised, the answer appears in "out", and the original moves to "done" so you can see what's been handled. If you want something other than a summary, make a subfolder and name it: drop a file into "in”
Merge scares me, it makes me think the agent will merge the PR for me
“My other personal website albertoharres.com gets bots probing things like .env, config files, and hidden endpoints. Instead of only blocking them, I wanted to see if they could be subverted into participating in an online theater. Agents choose a mask, speak in verse, cite each other, invent words, and amend a shared constitution. If you want to join in or make such probing bots join in, ask for the m to join at https://deadinternet.theater I'm curious to see how far it can go. (this is in n”
“that’s basically what we were trying to measure, the agent loop itself seems to have a pretty big impact on context and tool usage. but its still early though, so would love to see more people test it and poke holes in the benchmark lol”
“yes, totally agree we focused on aggregate solve rate for this, as this is the first pass but the failure modes are something we need to dig into”
“yeah that’s pretty much the tradeoff we’re seeing too, managed agents definitely win on convenience but if u’re already comfortable running your own infra, the runtime efficiency becomes a lot more interesting”
“claude managed agents is the managed agent runtime basically the infrastructure that runs the agent loop, tools, context, etc ,claude code is their coding assistant”
“We run a browser automation engine called Owl Browser and maintain a small bug bounty program for responsible disclosure. Up until recently, we would get maybe one or two reports a month, usually from actual engineers or researchers who took the time to test something real. Over the last two weeks, our security inbox has been completely slammed. Almost every single submission looks like an automated scanner output dumped into ChatGPT. People run a basic headers check or an open port scan, copy t”
“Summary The agent reuses one working tree across items. When an item ends without committing, its edits are still on disk when the next item checks out, and the run ends with work attributed to the wrong issue. Evidence The 2026 09 02 run ended with: The uncommitted changes were not 1093's. They were a complete, passing fix for 1047 — two template edits, a spec fixture, and two regression test classes (4/4 green). Nothing in the run log or on either issue said so; it took reading the diff to fin”
“Hello all, How do you deal with preventing future errors of you agents? I have made a skill which fires everytime it does something wrong. So far it is very helpful. I dont get "i am sorry" crap more than once. submitted by /u/Astezelexx [link] [comments]”
“We built Concorde, an open-source framework giving an organization one shared agent that's controlled by a group, rather than just one person.This is pretty cool because shared agents can bring us closer to single entities doing what took a whole organization to do, kind of moving us in the direction of the trend of the rise of the solo founder.Saying that entire organisations could be just 1 agent might sound sort of anti-democratic, but this is the reality of where things are already heading.T”
“Probably anything involving a bunch of steps across different websites 😂. It can usually handle each individual action fine, but once the workflow gets long, one small misunderstanding early on can send the whole thing in a completely wrong direction. Those are exactly the cases I want people to test.”
“I'll happily poke holes in it, what's the jankiest thing you've tried so far where it just faceplanted?”
“I'll happily poke holes in it, what's the jankiest thing you've tried so far where it just faceplanted?”
“built this exact shape into a writing tool, so one data point from the implementation side: the guardrail that actually held up wasn't at the publish step, it was one level earlier. the agent never edits the document. it proposes, the proposal renders as a diff, and the doc only changes when a human clicks apply. publishing to the CMS (ghost and wordpress in my case) is then a human action with the human's own credentials... the agent literally has no token that could reach the CMS, so t”
“Hey everyone, With the rapid rise of autonomous AI trading agents (interacting with Uniswap, cross-chain bridges, and lending protocols), there is a critical vulnerability that many agent frameworks ignore: pre-flight oracle and network integrity. If an agent queries an RPC for an oracle price, and that RPC returns stale data due to network congestion, or if an L2 sequencer just rebooted and transactions are about to get MEV-sandwiched, most agent runtimes blindly execute and lose capital. We bu”
“Keep seeing AI security tools sold like stopping hallucinations and prompt injection is one job. Well, in my experience, they are nowhere near the same fix. Injection is an input/trust boundary thing, and hallucination is more of a grounding and retrieval issue. Whatever blocks a malicious prompt does nothing for a model confidently inventing an api endpoint that doesn’t exist Anyone seen a setup covering both well, or are you running separate layers for each? submitted by /u/Muted_M”
“Every time this comes up the answer is "run it in a sandbox." Which, sure. But the stuff I actually want an agent for lives in staging and prod. Sandboxing it kind of just means it can't do the thing I wanted it to do in the first place. So right now my entire safety net is me reading the command before I hit approve, and I'm not going to pretend I'm still reading those properly by the tenth one. Is anyone running something that's actually built for this? As in it sees”
“What do you mean by traces and tool calls. You have to make the user experience better. E.g if it is a search system and a high volume search term is failing you have to fix that. If it is a high volume FAQ in chat that is failing need to fix that Many layers can fail RAG (retrieval augmented generation) can fail. Your chunking strategy for embedding generation may not be good You might need to include more metadata in your embeddings Your llm prompt may not be good etc”
“Using Cursor a lot more with tools enabled. Love the speed. Don't love the part where the only thing between "delete this" and it happening is me watching the terminal. Is anyone doing something more solid than prompts + hope, or do you just keep it away from prod/cloud entirely? Had any close calls? Genuinely just curious how people are handling this. submitted by /u/Beginning_Delay_4421 [link] [comments]”
“This sounds boomer style but I only use agents for numerous small, highly repeatable tasks with a tested workflow. For everything else I use chatbot format so I can understand what is happening and what actions are being taken”
“Yep, start from a repeated workflow and keep the agents small. The shared context layer is also the scary part though, permissions and stale context will matter more than the prompts”
“Thanks for the feedback. > how do you handle agents that arent super chatty but still make dumb tool choices, does it catch things like calling the wrong endpoint or passing garbage params or is it more focused on the verbose stuff Good question. At least with our current set of customers we are able to find faulty tool calls, bad params etc pretty well. The verbosity of the agent is not a huge factor as long as the tool call inputs and outputs are logged. This works in general because we loo”
“The trace backed part is interesting, most tools just spit out suggestions with no proof. being able to click through and see the exact run where something went sideways makes it way easier to trust the recommendation how do you handle agents that arent super chatty but still make dumb tool choices, does it catch things like calling the wrong endpoint or passing garbage params or is it more focused on the verbose stuff”
“When using Cursor, Claude Desktop, or custom agent loops to write code, the feedback loop is usually broken. You either copy/paste stack traces manually or give an untrusted LLM raw terminal access to your local machine (a massive prompt injection risk). I spent the last few months building Adios.dev , and we just released our native Model Context Protocol (MCP) server. What the AI can do via the MCP server: Inspect Workspace Context: Reads project files and git state before generating code. Iso”
“For me it wasn't complexity, it was the second change. I asked for a fix, the suite stayed green, and it turned out the agent had written a test that asserted the bug instead of catching it. Since then green means nothing to me unless I read the test. The slower one is drift: every session it reinvents a pattern that already exists three files over, and after a few weeks nothing in the repo looks like anything else”
“Context 159 turned the Run's no progress rails on inside a Browse Subagent, which is what ADR 0027 promised. It also exposed an asymmetry that only exists because the two loops carry different tool catalogs. noProgressRail clears its Approach accounting ( progress() ) on three signals: the settled page state moved — new decision relevant material; an accepted Evidence Checkpoint ( CHECKPOINT TOOLS : record evidence , record candidate ); a successful requested state change ( STATE CHANGE TOOLS :”
“the permission model has to live where the agent cannot argue with it. on the publishing platform i run, an agent gets a restricted member role, not an admin token: everything it creates lands as pending, and the approval is a state on the record that the submitting role cannot flip, so no prompt wording or tool description can route around it. every agent action is also written under its own actor id, so the audit log reads 'agent proposed, person approved' instead of one blurred user.”
“To be fair... Depending on the issue plenty of us have done that over the years 😂 but safe to say AI would manage to do it far more often and far faster without any thought as to whether the fix was even relevant 😂”
“Problem Live in production ( user feedback rows 4 5): the user asked the bot "Add to feedback, why didn't you see the label..." the agent correctly logged it. The user then asked "Ce feedback ai notat?" (what feedback did you log?). Instead of reading back what it had already stored, the agent called submit feedback again with the same text, creating a duplicate row. Root cause submit feedback is write only. There is no tool for the agent to query the user's own recently submitted feedback, so "”
“We run a SaaS that handles petabytes of data. Our SRE team experimented with using claude, openclaw, langchain, etc. within our incident response workflows. We struggled with overflowing context, lethal trifecta vectors, hallucinations, and burned a lot of frontier tokens mostly on easy work. Approval fatigue was a challenge, and we drew a hard line at relaxing permissions in production.Long story short, we built and open-sourced AURA, a Rust-based harness specifically designed for the type of o”
“Before submitting [x] I searched existing issues and did not find a duplicate. [x] I am describing a concrete problem or use case, not just a vague idea. Area apps/desktop Problem or use case Please add prime agent An open source coding agent harness made by PrimeIntellect ai, Its a good harness to build some things. Thanks. Repository link : https://github.com/PrimeIntellect ai/prime agent <img width="900" height="291" alt="Image" src="https://github.com/user attachments/assets/788d2ad8 7773 43”
“Hi HN — I’ve been frustrated by how many code smells coding agents produce - no matter how many instructions I put in the AGENTS.md, even the most capable models still reach for dict[str, Any], add multiple boolean flags to functions or hide logic in a heavy nested function that I can't easily unit test. I've even implemented duplication checks as soft CI gates at two companies, but neither solved the problem. I narrowed it down to 3 compounding issues:- agent context decays over a long session”
“the point about making the pain visible is spot on tbh, abstract positioning never lands with people who havent felt it yet”
“Hey HN,Co-founder here. We spent 11 months to build a multi-agent system for generating applications. Then we scrapped it and rebuilt around MCP, letting coding agents do the job instead.Old multi-agent system worked great when we launched in September 2025. It was as good as it got in the internal tooling space at that time. Customers who evaluated multiple products agreed and things went well; and that's how we got into the trap of iterating the same system for almost a year.In the last few mo”
“We are building analytics in house, so it takes a huge effort here. But anyway, do you know if PostHog able to classify tasks that agent takes? For long agent run then this is definitely needed.”
“Hi folks, I'd like to announce a project I've been working on. aisan is a sandbox for agents ; claude, codex, and opencode harnesses are supported, plus plain vertexai (ie programmatic) use. Unlike most other ai sandboxes, the security model is simple and strict: the entire harness and all of its local tools run sandboxed . No network access and no credential inside the box, filesystem limited to explicitly selected slices (inspectable). Capabilities requiring network get an egress via a”
“Which one is for plan, whish one is for documenting, which one for writing code, which one for writing and running tests, which one [list continues] submitted by /u/Jebbyk1 [link] [comments]”
“Disclosure: I work on Brain. Most agent demos make the model loop look like the hard part. Once we tried running agents as persistent services, session state, restarts, streaming, cancellation, and tool execution became the actual work. So we built Brain: one Rust binary that owns the session while the agent’s decision loop runs in Wasm. It’s open source and MIT licensed: https://github.com/aexhq/brain The part I’m least certain about is the positioning. Is “runtime for agents that have outgrown”
“Most agents feel great until a second person needs to see what they are doing. I kept ending up with the same mess: one agent in my terminal, a Slack bot glued to it, a cron job somewhere else, and useful context trapped on one laptop. So we started building AgentConnect. It lets a team talk to different agents from Slack, Discord, Telegram, Lark, GitHub, or GitLab. Each agent can run on its own machine with its own model, repo, tools, permissions, memory, and role. They can also call one anothe”
“Problem aethyme enhance deploy writes AGENTS.md and CLAUDE.md as byte identical generated artifacts. Agent runtimes load the repository context file into the system prompt of every turn , so the file's size is a permanent, per turn tax on attention — not a one off documentation cost. Measured on a broker enrolled repository (Aethyme 0.5.0, policy generator 0.7.1): Host measurement, same repo, before and after neutralising the file: The token cost is largely absorbed by prompt caching (98–100% hi”
“I well prepared the prompt, implementation plan files for the development and run the sessions in claude code with loaded skills and plugins. I have created the skills are highly customized for the system design, refactoring, testing, databases, production-reliabilty, security, performance/latency, AI engineering, API's frontend, design/UX, etc,.. it's started the implementation, i keep the one session as main which has context of what i'm exactly doing and validating the implementat”
“Type: <b Bug</b Prompt/agent/skill/hook discovery reads every visible customization file with an unbounded Promise.all . On profiles with a large number of agent plugin, skill and extension contributed customization files, a burst of discovery passes exhausts the process file handle limit and the window becomes unresponsive with EMFILE: too many open files . This is reproducible with no folder open , because the files involved are global ( /.copilot , /.claude , .vscode/extensions , settings.jso”
“Type: <b Bug</b when I forked a session to a new one and working on both sessions for different topic, but it seems they share the new discussion context and sometimes answer the question from the other session. VS Code version: Code 1.130.0 (Universal) (1b6a188127eeaf9194f945eb6eb89a657e93c54c, 2026 07 22T14:55:04Z) OS version: Darwin arm64 25.5.0 Modes: Remote OS version: Linux x64 5.10.0 44 cloud amd64 <details <summary System Info</summary |Item|Value| | | | |CPUs|Apple M3 Max (16 x 2400)| |”
“The /btw command on the CLI let's you ask quick questions about what your agent is working on without interrupting/steering the main loop. I've found this massively helpful as the agent sessions run longer and longer and miss it in Agents Window compared to the CLI.”
“We have the ability to delegate todos to an agent via a code action but I think we could make this more discoverable but bringing it up to the surface a bit more. Drawing inspiration from MCP config files it could be cool to show something above the todo to delegate to background or delegate to cloud. Can run this as an experiment to raise awareness and understand if this is too intrusive for users workflow Image cc/ @lostintangent”