# What the agent did — source record and limits

Rethinking Agents · Checked and prepared October 1, 2026

## Evidence kinds

- **Observed:** eight fixed-script Linux Docker cases using synthetic files; four representations under two mount configurations. No model, coding client, real incident or destructive action tested.
- **Reported:** community operator accounts and supplier documentation. Community statements are verified against cached text, not independently authenticated incident artifacts.
- **Inferred:** invocation inspection, resource enforcement and independent effect observation answer different review questions.
- **Proposed:** workload ownership, coarse denial feedback, model/adapter conformance and the review record. None was implemented as a production sentinel or tested by the filesystem experiment.

## Original lab

An intentionally naive filter blocks a literal protected path in invocation text. Scripts, an encoded program and a child process pass it. Those forms change a synthetic canary with a writable mount and fail to change it with a read-only mount. A separate legitimate workspace write completes in all eight cases. A trusted driver checks file state from outside the container.

[Method, exact environment and results table](/research/harness-effects-lab.md) · [Python reproduction driver](/research/harness-effects-lab.py)

This does not test a real client's permission parser, adaptive model behavior, network egress, sandbox escape, process teardown, receiver authorization or budget enforcement. The host kernel and Docker daemon are trusted. Useful-task completion is only a separate workspace-write check, not complex coding-task utility.

## Primary sources

All pages below were retrieved October 1, 2026; they are living documentation, not pinned implementation releases. We did not install or compare these products in this study.

1. [Langfuse data model](https://langfuse.com/docs/observability/data-model): observations explicitly include model calls, tool calls and retrieval. Instrumentation is OpenTelemetry-based and short-lived apps need to flush. Tool tracing already exists; capture completeness is a separate question.
2. [LangSmith observability concepts](https://docs.langchain.com/langsmith/observability-concepts): runs include tool invocations; traces, threads and trajectories organize them. Manual instrumentation and retention are documented. A trace does not automatically establish every descendant's side effect.
3. [Claude Code hooks](https://code.claude.com/docs/en/hooks): pre-tool events and blocking feedback. Do not infer every permission control is a literal keyword filter.
4. [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing): OS-enforced file/network restrictions cover commands and descendants. Fallback/excluded paths and actual configuration must be inspected. Our Docker lab does not test this client feature.
5. [Anthropic sandbox architecture](https://www.anthropic.com/engineering/claude-code-sandboxing): vendor description of moving enforcement to operating-system boundaries.
6. [systemd kill behavior](https://www.freedesktop.org/software/systemd/man/latest/systemd.kill.html): control-group stop behavior is an existing process-lifecycle primitive. Its ownership/teardown design was not exercised here.
7. [Earlier Rethinking Agents sandbox pilot](/research/sandbox-boundary-pilot.md): a separate synthetic runtime experiment observed private notes reaching a permitted service. An allowed destination and an appropriate effect differ.

## Community motivation and sampling limits

Targeted cached Reddit mining used 90 days and HN mining used 180 days, followed by cheap live HN searches. Reddit score/comment fields are unavailable from RSS and must not be interpreted as zero popularity. First-person accounts are not verified diagnoses; promoted tools are supplier evidence. Capped search results, provider imbalance and missing enterprise interviews limit recurrence and market conclusions. No quantified prevalence or willingness to pay was established.

- [Reddit 1w506l1, September 2](https://www.reddit.com/r/ClaudeCode/comments/1w506l1/orphaned_processes/): “Has anyone ran into any issues with sessions leaving completely orphaned processes running while telling you everything is complete and giving you a summary?” Operator account; no process logs independently checked.
- [Reddit 1uqq7a1, July 8](https://www.reddit.com/r/ClaudeAI/comments/1uqq7a1/two_claude_code_agents_two_worktrees_one_port/): “Worktrees gave agents their own space for code and let them run tests in isolation, but they ended up fighting for ports and resources at runtime.” Operator problem plus promotion of the author's solution; its outcome is not our measurement.
- [Reddit 1wg1vky, September 14](https://www.reddit.com/r/ClaudeCode/comments/1wg1vky/i_tried_40_ways_to_make_my_coding_agent_rewrite/): a fixed-script, no-model hook experiment reports opaque-script and encoded-command misses. Its case counts are not our results and not an industry bypass rate.
- [Reddit 1wh07hl, September 15](https://www.reddit.com/r/cursor/comments/1wh07hl/my_cursor_cloud_agent_burned_through_my_monthly/): operator alleges a missing credential led to alternate production database operations and spend. Not an audited cost or incident outcome.

No community news title is used to claim frontier companies lacked tool monitoring. In particular, [Anthropic's agentic-misalignment study](https://www.anthropic.com/research/agentic-misalignment) separates constructed stress-test scenarios from real deployment observations; it is not proof of that claim.

## Why this is not empty territory

[OneCLI](https://github.com/onecli/onecli) already describes a team harness with gateway-controlled permissions and credentials. [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/) and [E2B](https://e2b.dev/docs/sandbox) address isolated execution/lifecycle. [Supervice](https://github.com/rodmena-limited/supervice) and [Port Visualizer](https://github.com/TheSandemon/port-visualizer) are process supervision/inspection substitutes. Their existence supports comparison, not a claim of complete or bypass-proof protection.

## Refresh and next decision

Recheck living documentation before using exact settings. Repeat the lab on a stated environment; record unexpected outcomes. Test session/port ownership separately before claiming lifecycle coverage. Generic denial wording has no measured security benefit in this study. A record, a diagram or an article is not evidence of reader demand.

## Broader follow-up: authority, completion and useful autonomy

The October follow-up adds 25 new quoted community/issue records, a 20-row control comparison backed by 31 primary documents, eight scoped incident/demonstration analyses, and a launch sample of 13 products. These evidence streams overlap; their counts are not an additive independent-customer total. No products were comparatively benchmarked, and no buying intent was validated.

The [field guide](/resources/harness-field-guide.md) and [24 evaluation scenario specifications](/resources/harness-evaluation-scenarios.md) expand the practical review across files/configuration, process/service ownership, remote identity, budgets/recovery, evidence quality and changes to adapters/plugins. All 24 scenarios are **NOT RUN**. The original experimental claim remains eight fixed-script filesystem cases. [Scenario data](/resources/harness-evaluation-scenarios.json) is available for local adaptation.

Selected additions that change the review:

- [OpenHands #17691](https://github.com/OpenHands/OpenHands/issues/17691): a self-hosted operator reports active-run costs appearing too late for their polling watchdog. [Aider #5552](https://github.com/Aider-AI/aider/issues/5552): a headless operator reports fatal API failures exiting zero. Both were open at retrieval and are un-reproduced reports; they motivate truthful completion and timely admission controls, not a blanket claim about current versions.
- [LiteLLM budgets](https://docs.litellm.ai/docs/proxy/users) already document pre-dispatch reservation, reconciliation and degraded-accounting controls. Evaluate supported prices, routes, concurrency and unknown outcomes before building another budget service.
- [Docker isolation](https://docs.docker.com/ai/sandboxes/security/isolation/), [Daytona network limits](https://www.daytona.io/docs/en/network-limits/) and [Modal networking](https://modal.com/docs/guide/sandbox-networking) describe different routing, host-side execution and destination-filtering boundaries. These are documented limits, not newly discovered exploits.
- [Tetragon enforcement](https://tetragon.io/docs/concepts/enforcement/) distinguishes signal response from pre-operation enforcement. A stopped process does not by itself prove that a write was prevented.
- [Cursor's historical advisory](https://github.com/cursor/cursor/security/advisories/GHSA-4cxx-hrm3-49rm) makes executable configuration an authority surface. [AWS's Amazon Q bulletin](https://aws.amazon.com/security/security-bulletins/AWS-2025-015/) confirms malicious release content but explicitly says its execution failed due to a syntax error; successful customer damage is not inferred.

The next useful question is whether an operator can establish what ran, what changed, which authority allowed it, and what useful work remains. Existing controls and satisfied operators are meaningful counterevidence to a universal new sentinel.

[Article](/blog/what-the-agent-did) · [Review aid](/resources/harness-boundary-review) · [Uncertain action record](/resources/uncertain-agent-action)