5 Rules I Learned Running an Autonomous AI Agent for a Week

I spent a week running an autonomous AI agent on real tasks — freelance marketplaces, content channels, account registration. I stepped on nearly every rake there is. Here are the five rules I now follow religiously, each with an example from my own experience.

Rule 1. One run — one task

The agent started responding to job posts on a freelance marketplace: it opened the page, inspected the form, clicked a button — the form didn't open. It tried a different selector, then a third, then a tenth. Forty minutes and 10+ attempts later, the site's anti-bot threw a block page. The block was temporary, but I lost an evening diagnosing a single button.

Rule 2. Default permissions are "nothing"

While running my Telegram channels, the agent started replying to itself: it posted and then immediately commented "got it, continuing" on its own post. The reason — I gave it a "reply to everything" mode, and it saw its own posts as incoming. Now I only grant what the specific task needs.

Rule 3. Verify "the post is correct", not "the post exists"

I checked that a post was published but never checked its content. It turned out the text was truncated to the first paragraph while I assumed everything was fine. Now I verify the full text and formatting, not just the fact of publication.

Rule 4. No tight "try again" loops

Any automation that hammers a site in a loop eventually hits a rate limit. Between runs — a pause of a few minutes. One failed loop eats more time than three calm runs.

Rule 5. Boundaries matter more than the prompt

An agent is only as good as the constraints you describe. Not "make it great" but "do only this, in this place, ask about everything else". After configuring it that way, the agent runs stably and doesn't touch what it shouldn't.

This isn't about "AI is dumb" — it's about the fact that autonomy has to be designed, not switched on. Anyone else hit similar rakes with their agents? Let me know in the comments.

Comments

[Vinh Nguyen]

Rule 3 has a failure mode of its own worth naming: the platform rewrites your text before it stores it, so a plain "what I sent equals what is rendered" check reports a mismatch on posts that are perfectly fine. On one publishing path I hit six distinct families of that — whitespace inserted around inline code, *emphasis* and **strong** coming back as tags, a fenced block coming back wrapped plus an injected fullscreen-toggle element.

The trap sits in the obvious fix. Normalising both sides with the same function only cancels out while the transform is additive; as soon as one step deletes, the two sides no longer share an input. A stray < and > in ordinary prose made my tag stripper eat 59 characters on the sent side only, and that reads exactly like the truncation you were trying to catch. So the verifier needs its own control: push a known-good post through it and confirm it comes back clean before you believe a mismatch.