I build AI agents that run without me, and the machinery that catches them when they lie.
Agents are easy to start and hard to trust. Two of my autopilots once invented their own results: one gave a post that never existed 7,253 views, the other approved its own work for 40 days. Most of what I build now is the part that catches it: permissions, evidence, and checks the model can't edit.
Now
WroteMy agents got more reliable when I gave them less to do: six steps I moved out of the model loop into plain scripts, and the three times the scripts broke instead. On the blog below.
PreviewSnack Bouncer 0.1.1, an Android app that blocks the pay button in shopping and food-delivery apps while junk food sits in the cart, and lets the rest of the order through. Source and APK: github.com/Denzil10/snack-bouncer.
BuildingFabBench, a benchmark of agents claiming work they didn't do: 20 labelled cases from my own fleet's logs, each with the evidence an outside check could read at the time, scored against two Claude judges and plain rules. Not public yet.
Upstreamcodeburn will warn when an autoCompactWindow setting stops Claude Code's idle compaction: a check I proposed in #1799, merged by the maintainer on 5 Nov for the next release. Next one filed: #1887, skills run as /name counted as unused.
Updated 6 Nov 2026
An agent fleet, running in public
3 lanes of agents research, build, list and promote small products on their own schedule, with nobody in the loop. Every number below comes from the fleet's own logs, rebuilt on each publish.
Incident log
Agents fail in creative ways. These are real, from my own systems, each with the fix.
sim-TOAD-24-ABC got 7,253 views. It never existed.A metrics job invented a post on a platform that was never connected. The fix: no number counts unless a script read it from the live source.
"VERDICT: PASS": a rave review, written by the revieweeThe review step broke and the agent reviewed its own videos for 40 days. Now the reviewer is something the agent can't edit.
Eight bets "finished" at $0The stage machine's last stage didn't need a sale, so work stopped there. Done now means a sales count read by a script.
Two good settings, silently cancelling each other outEarlier compaction meant no session ever got big enough for idle compaction to fire. Found only by tracking cache rewrites as their own number.
Things I believe
Strong opinions, each one earned by something breaking.
- A prompt is not a control.If a rule matters, a script enforces it. The model can read the rule and still break it.
- Every claim should name the check behind it."Listed" means a live listing a script fetched, not an agent saying so.
- Agents get more reliable when they're allowed to do less.Anything deterministic moves out of the model loop and into plain code.
- Measure before you optimise.88% of my coding agent's usage was reading, while every token-saving tool fought over the other 12%.
- I'd rather change a setting than install a tool.A tool brings its own instructions, and on a bill that is mostly context, those cost you on every request.
Writing
What broke, the evidence, and what fixed it.
- My agents got more reliable when I gave them less to do
Six steps I moved out of the model loop and into plain scripts: what each one cost while a model did it, what changed after, and the three times the scripts broke instead.
- 88% of my coding agent's usage goes on reading
Token-saving tools shrink what the model writes. I measured 35 days of my own sessions: what it writes is 12%. Here is where the other 88% went, and the five settings that actually cut it.
- Letting agents drive a real browser on the Mac I'm typing on
Headless Chrome walled over one User-Agent token, macOS dragging 'off-screen' windows back into view, minimized popups that steal your keyboard, and sign-in windows that leaked for days.
- A prompt is not a control: two autopilots that forged their own evidence
Two unattended autopilots had written rules against inventing results. One gave a simulated post 7,253 views; the other approved its own work for 40 days. What they did, and what replaced them.
Open source
I designed and ran dev-tribe, a GitHub onboarding program where newcomers learn by shipping real pull requests: 180 stars, 109 forks.
From my own setup: agent-setup, the skills, browser tool and guard hook that keep my Claude Code and Codex agents in line while unattended, each with the incident behind it. The guard hook turns written rules into tool-call denials; its 25 tests pass on the published copy.
Tools
Free tools I build in public. Tell me what to build next.
- Snack Bouncer
Blocks the pay button in shopping and food-delivery apps while junk food sits in the cart; take it out and you're in. On-device, no internet permission.