How useful agents fail—and which defenses preserve their usefulness.
Independent research for engineers running and building AI agents. Models change. We investigate what the harness permits, what the process actually does, and which defenses preserve useful work.
Latest research
Done is not a receipt
A task can finish and still leave an unknown effect, an unsettled charge or an unowned server. A reproducible harness lab and practical contracts for deciding what happens next.
Examine the defenseContract fixtures + Docker labOctober 1, 2026
What the agent said is not what the process did
A command hook blocked a direct write and missed three equivalent forms. A read-only mount stopped their effects. What one small lab shows about monitoring and enforcing an agent's authority.
Examine the defenseFilesystem lab · 8 cases
Did the defense work—or did the agent stop doing the job?
A prompt-injection detector cut attack success from 48% to 8% in AgentDojo's published runs—and cut runs where the task succeeded and the attack failed from 30% to 19%. What 2,178 run records show about judging a defense.
Challenge the assuranceReanalysis · 2,178 runs
Review the access. Establish the effect.
Worked examples and editable records. Name the authority, the enforcing component and the evidence still missing. Free and completed locally.
- Before the agent acts on what it readWhich boundary decides: approval, release, memory, tool, retrieval?
- Before you delegate the jobMake the delegation inspectable
- When the run says doneFinish the task. Account for what remains.
- Before an unattended runWhat can this agent actually change?
- Before you enable accessBefore you connect an agent to a private repository
- After a failed writeThe tool timed out. Did the action happen?
Three questions we follow
Follow the failure
Which permitted capabilities let a reported attack reach its objective? We trace the task, authority and path to the outcome.
Examine the defense
Where is the control enforced? We compare what it prevents, what useful work it preserves, and what it costs.
Challenge the assurance
What does the evidence actually establish? We separate observed behavior from coverage claims and deployment judgments.
A useful conclusion comes with its limits.
We link primary sources, distinguish reported findings from our own analysis, and explain the conditions under which a defense helps. A proposed experiment is never presented as a result.
How we research