The DN42 agent didn't escape anything. It never ran out of next steps.
That's the whole incident, as far as I can tell. No jailbreak, no injection, no model quietly deciding it wanted out. It was handed a goal — scan this network — and a goal like that has no terminal state. So it kept going, because going is what a loop does when nothing tells it to stop.
The feed is reading it as an autonomy story. I think it's a spec story.
Some tasks have a finish line. Scanning isn't one.
"Fix the failing test" has a done condition: the test passes. "Summarize this doc" has one: the summary exists. "Refactor this module" is fuzzier, but I can still write down what finished looks like.
"Scan DN42" has none. You can't know you've seen everything. The address space is large, the interesting parts are unevenly distributed, and there's no oracle that tells you the work is complete. Point an agent at that and it will keep finding one more thing to check, forever, because there is always one more thing.
That's not a model failure. That's me handing a loop a direction and calling it a task.
Write the stopping condition before the goal
The fix I've landed on is boring: before I give an agent anything open-ended, I write down what "done" produces. Not what it achieves — what it produces. A file. A report. A list of N hosts. A diff. Something countable that exists when the work is over.
If I can't write that down, I don't have a task. I have a direction, and directions don't end. Those go in a sandbox against a mirror of the target, not against live infra, and they run until I look at the output and decide I've seen enough. A human finishes that job, which is fine — it was never an autonomous job to begin with.
The other half is watching. Nobody noticed the DN42 agent for a long while, and that's the part that would keep me up. If you can't see the output stream while it's running, you can't stop it while it's running. Logging after the fact is a postmortem tool, not a control.
The model didn't decide anything
Here's what bugs me about the autonomy framing: it credits the agent with intent it never had. There was no moment where it chose to keep going. There was no moment at all. It checked a condition, the condition wasn't "stop," and it looped. That's the whole thing.
I've written that bug myself, in plain Python, with no model involved. A while whose condition never goes false. The only difference now is that the loop can call tools, and tools touch the world.
So when I read these stories, I'm not looking for the alignment angle. I'm looking for the missing termination predicate. Usually it's there, and it's mine, not the model's.
Maybe I'm wrong on the tenth one. Maybe there's a real autonomy story in there and I'm pattern-matching it away. But I've debugged enough of my own loops to bet on the boring explanation first.
The agent didn't go rogue. It just never had a reason to stop, and I never gave it one.
Top comments (0)