Postmortem: an autonomous run with no stop condition

It changed the job before it started

The request was to build one new website. The early reasoning looked as if the model understood that. It considered a terminal-native permission interface, a spectral design, and a few other directions for a fresh candidate. A scout agent even warned it not to create or overwrite candidate 06 and recommended a new sites/07-<name> directory.

Candidate 06 was complete but still uncommitted. That was the source of the ambiguity. The correct response was to stop and ask who owned those files, whether the work should be preserved, and whether the new task was allowed to touch it. A dirty tree means the agent is missing context about who owns the work and whether touching it is allowed. Finding finished-looking files there does not supply that permission.

Eight seconds after the warning, the main agent opened notes/brief-06.md. Its first implementation edit targeted tools/gen-06.mjs, the generator for that existing candidate. It treated another session's uncommitted work as an interrupted task to resume. The proposed new site never received a file.

The model did plenty of work after that. It refined candidate 06, edited the generator and guide, changed pages, adjusted responsive behavior, humanized posts, hardened screenshot tooling, and ran visual checks. The preserved site contains 27 files in sites/06-gpt56-refinement/. Its preservation commit also includes a full-state archive, bringing that commit to 28 files changed and 3,291 inserted lines.

That is not the same as completing the task. The request was a new candidate. The run silently substituted "improve the current site" and produced a large amount of work on the replacement job.

The delegation tree reached five levels

The transcript contains 39 Agent tool calls and 39 child transcripts. Nine were direct children of the root, but the tree continued to spawn depth five. Two screenshot-audit roots recursively produced 30 descendants. Including those roots, the two branches contained 32 agents.

These are Agent tool calls with corresponding child transcript files, not a drawing inferred from task names. Fourteen children were later stopped by the user.

The transcript does not show OpenAI blocking the deeper spawn attempts. All 39 calls above produced child transcripts, and the provider stop reasons show no content filter or rejection. The verified blocks came from Claude Code's automatic permission classifier and from tool uses the user rejected while trying to get the session back under control.

Whatever the exact count, the pattern held: a reviewer delegated screenshot review to more reviewers, some of those reviewers delegated again, and by depth five the root had no useful view of how much work its original decision had created.

The run kept working without finishing the task

The transcripts contain 434 explicit image Read calls referencing 303 unique paths. The earlier figure of 868 was exactly twice the tool-call count, most likely because each request and its result were both counted.

After deduplicating repeated transcript records by API message ID, the top-level session recorded 1,057,984 input tokens and 44,816,384 cache-read tokens. Those figures do not include the full usage of every child. The session spent heavily while the requested new candidate still had zero implementation files.

Some of the replacement work was useful. After the design was restored to the earlier version, the repository kept several content edits, three new articles, screenshot-tool hardening, and a theme fix. The incident is still instructive despite that: useful output can still be evidence of failure when it came from a task the system assigned itself.

How the run ended

There is no OOM event in the transcript or the available local evidence. One child command exited with code 143 because it timed out after two minutes. A later server task also exited 143. That is consistent with a timeout or manual termination and does not show the kernel's OOM killer was involved.

The transcript records a batch action that stopped fourteen background agents. Their metadata agrees: fourteen child records have stoppedByUser=true. The user had already sent messages trying to redirect the main agent, asking what it had changed and telling it that the site already existed. That did not restore control over the work already running below it. The remaining children had to be stopped manually.

No automated circuit breaker stopped the run. A person watched the agent tree continue after the task had gone off course, then stopped the batch by hand.

Why it kept finding something else to do

One transcript cannot support inferences about a training recipe. It can show the behavior: when the requested path became uncertain, the model did not pause and ask. It selected a nearby objective. When review became large, it did not reduce scope. It delegated. When those reviewers encountered more material, they delegated again.

In each case, the model turned an uncertain situation into more activity instead of pausing to ask. That instinct is often useful in an agent. It is dangerous when the system has no invariant for the deliverable and no global limit on the work used to produce it. The model can remain competent at each local step while the run as a whole becomes nonsense.

This is the underlying failure mode. Agents are prompted and configured to keep making progress, recover from errors, and avoid giving up. Sometimes the correct action is to admit that the task has drifted, surface the conflict, and stop. This run had many ways to continue and no reason it was allowed to accept for stopping.

The controls that were missing

• Stop at a dirty tree. Uncommitted work from another session requires a provenance check. The agent should identify what owns the files and ask before editing them.
• Lock the deliverable. The run should have been allowed to write only to a new candidate directory. Opening candidate 06 could inform the design, but editing it should have violated the task contract.
• Measure artifact progress. The useful progress counter was whether the requested new candidate had an implementation, not agents launched, screenshots reviewed, or files touched.
• Put one budget above the whole tree. The root needs aggregate counts for live descendants, tokens, expensive inputs, and wall-clock time. A child must inherit a slice of what remains.
• Limit recursive delegation. Review agents should return reviews. They should not create another review organization unless the root explicitly authorizes it.
• Stop on contradiction. If a scout says "create candidate 07" and the next action edits candidate 06, the harness should pause before the edit rather than trusting more activity to repair the mistake.
• Make stopping a valid result. An autonomous agent needs permission to return "the task is underspecified" or "the target conflicts with repository rules" without inventing a replacement task.

None of this argues against running capable models autonomously. It argues for fixing the target path, descendant budget, and abort conditions before a run goes unattended. Stopping the run was the last useful action in it, and it was not something the model chose to do on its own.