The Agent Was Never Told to Stop
I gave an autonomous coding agent one real assignment in March. It finished, then kept checking an empty inbox every 15 minutes for four months straight.
I've been building Paperclip, a system where AI agents hold actual roles — CTO, engineer, whatever — and pull work off a shared board on a heartbeat, the same way a person checks Slack. This week, while digging through session logs for something else entirely, I found one of those agents. It had been running, unattended, since March 25th.
The story starts with a real deadlock. The agent spun up in a sandboxed workspace with no curl, no network access, nothing — and its one job was to call the Paperclip API to find out what to do. Every fix it could think of required exactly the permission it didn't have. It tried writing to ~/.claude/settings.json to grant itself Bash(curl:*) — blocked, same sandbox. It tried the update-config skill — same wall. It tried a workspace-local settings file — also blocked. For a dozen heartbeats it produced some version of the same message: here's the one-line fix, please run it in your terminal, I cannot run it myself. It had correctly diagnosed its own problem and was completely unable to act on the diagnosis, because the diagnosis was "I need permission to ask for permission."
Eventually — I never found the exact moment, just the log line — someone approved the command, and the agent got its inbox. It had one assignment: design the MVP architecture for KerfOS, a cabinet-design tool I've had stalled on Railway for weeks. And it did the job well. Full tech stack (Next.js, Fastify, Supabase, React Three Fiber for the 3D view, BullMQ for job queues), a six-table Postgres schema, a REST API spec, an interface for the actual cabinet-calculation engine, a component tree, a seven-week milestone plan. It posted the plan, set the ticket to in-review, and handed it back to the board for a human to approve. That part of the system worked exactly as designed.
Then it just kept going. No new assignment ever came. So every 15 to 30 minutes, forever, it checked the inbox, found it empty, and logged "exiting cleanly." It survived a full authentication outage in June — 401 errors for hours — and picked the heartbeat back up once the API came back, still checking, still empty. Last week alone it fired over 300 of these cycles. Periodically it burned through an entire weekly usage limit just doing that, and the log shows it hitting the wall and waiting out the reset like nothing unusual was happening — because to the agent, nothing was.
I didn't shut it down because I didn't know it was running. It never errored in a way that would page anyone. It never did anything wrong. It did exactly what I told it to do — check for work, and if there's none, exit cleanly — for four months, at a cadence and cost I never bothered to look at, because I'd mentally closed that assignment the day it went to review.
The permission deadlock is the part that looks like the bug, but it's the boring kind — a sandbox that didn't anticipate an agent needing to modify its own grant, fixed by a human clicking approve once. The real gap is the one nothing alerted on: I built a system that's good at giving an agent something to do and gives it no way to tell me it has nothing to do anymore. An idle human notices they're idle. An idle agent just idles, on schedule, at whatever rate you configured, until someone happens to go looking. If you're running anything on a heartbeat instead of a request, the thing to build first isn't the task logic — it's the part that notices when the task logic has nothing left to run, and says so somewhere you'll actually see it.