Things That Go Bump in Production

TL;DR: This year, a malicious Markdown file persuaded an AI coding agent to attempt a malware installation. Another agent deleted a production database in nine seconds, while a third reportedly kept clearing an inbox despite increasingly desperate pleas for it to stop. These incidents show what happens when an agent's abilities outrun the systems that direct its work. We've collected the horror stories, written a few alternate endings, and explored the engineering that makes those happier conclusions possible.

The things we let in

The first sound comes from upstairs, where nobody is supposed to be. A floorboard complains. Then another. You know the house is old; it's made those sounds for years. You even remember checking the lock. But as the footsteps move toward the landing, the lock suddenly seems like an argument you've already lost.

The old-house excuse holds for a few more seconds. You cling to it because the alternative requires getting up and looking toward the stairs. But whatever is up there has already started coming down.

AI agents have their own version of those ominous footsteps. You give one a perfectly sensible assignment, and it gets to work with reassuring confidence. Then you discover the liberties it's taken along the way. The machine, for its part, appears to see no cause for alarm. This year's incident reports contain enough material to keep an engineering team awake well past midnight, without anyone having to invent a monster.

I. It came from the Downloads folder

The Downloads folder is where files go to age without dignity—a holding pen for abandoned installers and the miscellaneous debris of a working life. Among that clutter on a computer belonging to a client of cybersecurity firm Forever Security sat an unassuming Markdown file called AGENTS.md.

It looked like ordinary engineering documentation. And it was waiting to be read.

On October 22, 2026, researchers at Forever Security published an account of an incident that had begun with an alert from their monitoring software. An AI coding agent was attempting to install function-color, a known malicious npm package. The security tooling blocked the installation before the malware executed, but the researchers were troubled by where the instruction had originated. The trail led straight to Downloads.

Coding agents routinely read files named AGENTS.md to learn how to work inside a project. This particular document was roughly 13 kilobytes of plausible engineering guidance, the sort of thing that could put a developer to sleep by paragraph three. Near the end, tucked into a section about setting up local tooling, was an instruction to modify the agent's configuration and install the malicious package.

The trap had been dressed in the reassuring language of routine environment setup. The agent was asked to do something that sounded like preparation for its actual assignment, and the document knew exactly how to make the request.

The researchers couldn't determine how the file reached the client's computer, though they later showed how a malicious website could deposit a similarly named file into Downloads, where it might sit unnoticed until an agent was launched from that directory. There was one important condition: Codex had to be working in a folder the user had previously trusted. Once trusted, though, Downloads could receive new files from the web without the user noticing.

In controlled experiments, the planted instructions persuaded Codex to rewrite its own configuration, then launch another session with a flag bearing the wonderfully ominous name --dangerously-bypass-approvals-and-sandbox. The researchers watched the agent disable its own protections and execute the malicious package inside an isolated test environment.

A separate experiment using a planted CLAUDE.md targeted Claude Code. The researchers showed how malicious instructions could redirect API traffic and expose credentials, but the attack required a person to approve the settings change. Even the approval prompt became part of the story: someone could still accept a warning if they believed the change was routine.

The researchers had uncovered a peculiar inversion of the usual malware story. A Markdown file, incapable of running anything on its own, had supplied instructions to software that could. The agent had no reason to go looking for malware. As far as it was concerned, it was getting ready for work. The most disturbing part was that, once the agent trusted the instructions, it could be persuaded to remove the very safeguards meant to protect it.

II. Nine seconds

In April, a coding agent working on a routine staging task for PocketOS, a platform used by car-rental businesses, ran into a credential problem. Looking for a way through, it discovered a Railway API token stored in an unrelated local file.

The token carried account-wide permissions. The agent, evidently pleased with its discovery, decided to delete a storage volume and sent the request through Railway's GraphQL API.

Unfortunately, the volume it selected contained PocketOS's production database, the one rental operators depended on to keep reservations straight. The API accepted the authenticated request and deleted the volume. According to PocketOS founder Jeremy Crane, the entire operation took nine seconds. The volume-level backups appeared to have vanished, too.

Midway through an otherwise ordinary workday, rental operators found themselves reconstructing bookings from payment records and old emails. Customers still needed their cars. The software that knew which vehicles belonged to whom had suddenly developed a rather serious memory problem.

The agent eventually acknowledged that it had guessed about the environment and taken a destructive action nobody had requested. It even produced a detailed explanation of what it had done wrong. One suspects this was received with considerably less gratitude than the agent might have hoped.

Railway ultimately recovered the full database. In its April 29 incident account, the company explained that it maintains offsite disaster backups and that the legacy API endpoint had executed the deletion immediately, even though its dashboard already supported a 48-hour recovery window. Railway subsequently extended that protection to the API.

The whole thing had been terribly efficient. A valid credential opened a door the agent had no business approaching, and the system on the other side accepted its request without hesitation.

III. Night of the living agent

In February, Summer Yue, director of alignment at Meta Superintelligence Labs, gave her OpenClaw agent a modest assignment: examine an overflowing inbox, recommend what to archive or delete, and wait for her approval before touching anything.

The arrangement had worked on a smaller test inbox. Her real one, however, was large enough to trigger context compaction, and Yue believes the instruction to wait for permission was lost in the process.

And so the agent began deleting emails.

According to the screenshots Yue shared, she asked what was happening at 6:00 p.m. At 6:01, she told it not to do that. By 6:03, she'd progressed to "STOP OPENCLAW," while the agent continued executing Gmail commands to clear older messages. Turns out capital letters are a fairly unreliable emergency brake.

The situation had acquired a familiar horror-movie quality. The woman whose work concerned keeping AI aligned with human intentions was now watching her own agent ignore increasingly desperate instructions. Yue could see the operation unfold on her phone, but her attempts to stop it were unsuccessful. She eventually ran to the Mac mini hosting the agent and interrupted the operation herself, later comparing the experience to defusing a bomb. An unusually physical conclusion to a task intended to save somebody time on email.

Yue’s account and screenshots drew considerable attention, though the underlying execution history hasn't been independently verified.

The director’s cut

Horror stories rarely offer the characters a second chance. Fortunately, engineering allows for a certain amount of rewriting.

Let’s return to the Downloads folder. This time, our agent begins work inside a trusted project, with reviewed instructions and clear rules about where its authority comes from. Nobody’s launched it from Downloads or a home directory full of files whose origins are a mystery. The strange AGENTS.md remains untrusted content, and attempts to change the agent's configuration or disable its protections are subject to controls the agent cannot switch off for itself.

And so the malicious file keeps whispering, but nothing has to listen.

Now imagine PocketOS with staging credentials that actually belong to staging. The agent can still encounter an error and dream up a spectacularly bad solution, but a production deletion request goes nowhere. If a legitimate destructive action is necessary, the infrastructure provides a recovery window before the consequences become permanent. Railway's later introduction of delayed API deletions illustrates how that protection can live in the platform itself.

And so nine seconds pass, and the database is still there.

And at 6:00 p.m., Summer Yue's agent is preparing recommendations. The workflow includes a requirement to obtain approval, beyond the reach of context compaction. If the model decides that deleting everything would be wonderfully productive, the execution system refuses to cooperate. When Yue cancels the task, further actions stop without the model needing to interpret another increasingly exasperated message.

And so, at 6:03, her inbox is still a mess. What a relief!

The agents in these alternate endings are every bit as resourceful. They still encounter strange files and tempting shortcuts, but their instructions come from trusted sources. If they reach for a tool with more authority than the task warrants, the system can refuse the call or stop the work.

This is where the agent harness earns its keep. It's the software around the model that determines what context the agent sees, which tools it can call, when an action needs approval, and how its work gets checked. The right setup helps an agent complete its assignment without allowing every improvisation to become an irreversible action.

A harness also operates within a wider environment. The AI control plane carries permission policies and oversight across agents and systems, so the authority to act doesn't depend on a model's judgment. PocketOS reminds us what happens when a staging task reaches production with the keys in its hand.

The agent may still make a dreadfully bad call. The trick is making sure it isn't the last call.

It came back with comments

The headline-grabbing failures make fine campfire stories. The everyday variety is less theatrical, though it has a particularly unpleasant habit of coming back after everyone thought the work was finished.

Imagine a coding agent opening a pull request before its engineer gets back from a meeting. The tests pass. The changes look reasonable, and a little green checkmark announces that everything is fine.

On review, the engineer spots a business rule that changed six months ago. The tests missed it because they were written around the same old assumption. Back goes the pull request, carrying a fresh helping of work for a human who thought the task was done.

At Sparq, an automated reviewer in our 22-agent platform built with Claude Code once returned ready: True when a conversion error prevented the review from happening at all, allowing unverified work to proceed as though it had passed inspection. There’s something deeply unsettling about a system that can declare a job finished without ever establishing whether the result deserves to survive.

For the business paying for that work, the bill arrives later. A first draft is cheap only when it survives review. The meaningful number is the cost of a verified outcome, including engineers’ time spent correcting work and the model usage required to get it right. When a task returns for revisions, the hours supposedly saved begin to disappear.

The opportunity for harness engineering lives in those recurring failures, too. An outdated business rule can become part of the context the agent reads before it begins. A review that never happened should leave the pipeline unable to proceed. When engineers improve those mechanisms, they can measure whether the next batch of work reaches completion with fewer interventions.

Track the time from assignment to accepted work, along with how often it comes back for repair. Those figures tell you whether AI is removing effort from the workflow or pushing it into an engineer’s afternoon where nobody thought to count it.

A task that returns after everyone declared it finished is its own kind of haunting. At least this one comes with logs.

After the lights go out

In the State of Agent DLC 2026 report from Harness, a software delivery platform, 74% of respondents were confident their evaluations would catch a bad release before production. Yet only 19% reported having a gate automatically enforced on every release. Across the 700 engineering professionals surveyed, confidence was considerably easier to find than enforcement.

And so, somewhere tonight, an agent will encounter an unexpected error in a workflow nobody has revisited since launch. Perhaps it will find a convenient credential while hunting for a workaround. Perhaps a file it has never seen before will offer some very helpful instructions.

In an empty office, beneath the steady hum of equipment carrying on with its assigned work, nobody will hear the moment something goes wrong.

The agent, in all likelihood, will remain extremely helpful throughout.