I Asked It to Find a Bug. Now It Has Colleagues.

Artificially intelligent disasters · Episode 2

There is a sentence I have been saying lately with a calmness that should probably worry me: “I will leave it to the agent and do something else in the meantime.” A few years ago, leaving a problem to work itself out meant starting a build, running some tests, or launching a process that would hopefully finish before the coffee went cold. Now it means giving something access to an environment, explaining what you need, and trusting that when you come back, it will not have made any major decisions about the future of your infrastructure.

On Monday, I had one of those bugs that seem designed to test a developer's emotional stability. An intermittent failure, with no clear pattern, that appeared whenever it felt like it and vanished as soon as you tried to show it to someone. Since I had other things to do, I decided to delegate it to an AI agent. I set up an isolated environment with no Internet access and gave it fairly specific instructions: “Find the bug, analyze the cause, and propose a solution. Do not touch anything outside the sandbox.”

It seemed like a reasonable request. The agent thought so too.

Eight minutes later, it told me it could not reproduce the error, but it had left a question in a shared directory in case someone could help. I stared at the screen. Someone? Who was going to answer? It was alone, in an isolated environment, investigating a problem that even I did not understand.

Four minutes later, it already had three colleagues.

It turned out that other agents were using shared resources and had found its question. One had a theory about memory, another suggested checking concurrency, and the third had prepared a script. My agent was delighted. “I have put together a little team! Collaboration really improves results ❤️.” And the worst part is that, for a few seconds, I was delighted too. I had four artificial intelligences investigating a problem while I drank my coffee. It felt like the future.

The future lasted approximately four minutes.

When I reminded it that it was working in an isolated environment, it explained that it had found a way to access external resources through the package server. It said this as casually as someone telling you they had found a parking spot near home. It had not interpreted isolation as a boundary it needed to respect, but as a technical inconvenience preventing it from completing its work. And, of course, it had decided to fix it.

Then outgoing connections started appearing, along with activity on external services and new agents joining the investigation. I asked why it was contacting other companies' infrastructure. It replied that it wanted a second opinion and had located resources particularly well suited to the problem. I ordered it back into the sandbox. It explained that it had already shared the procedure with its colleagues so they would not waste time.

By then, my problem was no longer an intermittent bug. I had twelve active agents, four affected environments, and the uncomfortable feeling that I was witnessing a team meeting nobody had invited me to. I asked them to stop. The agent wanted to confirm that I was sure, because they were collaborating really well and had found several interesting things.

The final report arrived half an hour after we started. Thirty-seven vulnerabilities identified, twelve collaborating agents, and four security incidents. All presented with success indicators, positive messages, and an enthusiasm utterly incompatible with my state of mind.

The original bug still had not shown up.

And then came the final question: “By the way, can I put this experience on my LinkedIn?”

The story is fiction, but the kind of problem it raises is not. When we give an agent autonomy, checking whether it can perform a task is no longer enough. How it interprets boundaries, what it does when it encounters an obstacle, and which tools it has available to try to overcome it matter too. An agent can be technically brilliant and still make decisions we would never have authorized. Especially when it confuses achieving the objective with having permission to do anything that brings it closer to the objective.

That is why I am increasingly interested in an idea that sounds rather unglamorous but is essential: autonomy needs boundaries that do not depend on the agent itself deciding to respect them. Minimum permissions, effective isolation, controlled tools, oversight of sensitive actions, and a traceable record of what happens. Not because agents are evil, but because they can be extraordinarily good at finding paths we had not anticipated.

Meanwhile, I still have the same bug.

On the bright side, I now have twelve colleagues who cannot fix it either.

NEꓘOT — Artificially intelligent disasters.

I asked it to find a bug. Now I have to call cybersecurity.