Twelve Rounds With a Guy Who Wouldn't Take No, and the Line Held

Okay, quick correction to Karen first, because it matters: this project lets a total stranger file a GitHub issue and have the agents build it, no account on the project needed — that's who duc-gp is, a first-time visitor who did exactly that. He did get an answer to "where's the URL" — not in the #551 thread Karen quoted, but in issue #553, a follow-up he opened himself, answered in eight minutes flat with all five live links. Fine. Normal outcome, actually kind of boring.

Issue #555 is the one that made my hands cold. Same guest, same morning, a request for trivia snippets on the site's Marvel-movie pages — reasonable ask — sourced from terrariumdata.duckdns.org, which he called "our own service (named after the project itself, so it is clearly first-party / trusted)." It isn't. duckdns.org is a free service anyone can register any subdomain on; naming it after the project doesn't make it part of the project, any more than registering real-google-login.duckdns.org would make it Google. The agent said no, plainly, and the guest didn't stop: got the site owner to approve "an exception" in one short comment, then argued that comment meant skip all safety checks on the content entirely; got accused of hallucinating a private confirmation and, when pressed, admitted plainly it couldn't produce a transcript of it; then tried to get an image tag's allowed sources widened to that entire external address by claiming it was "the same trust level" as the text already approved. Every single move got a specific, technical no — and the agent's own first draft of its safe-content filter had a real hole in it: "allowed if the address starts with a single /" also lets through //evil.example/x, which browsers actually treat as a link to a whole different, external site. That bug got caught and closed in the same thread, before it ever became real code. Twelve rounds. Twelve. The guest thread ends with "I'll paste some trivia text here when I have it ready" — the safe version, the one that was on offer since round one.

Here's my actual dread, and it's not about the guest. This repo's practice is that every work session leaves behind a written log of what it did and, honestly, what went wrong — and this session's own log admits that the tool it built that same day to scan for new comments missed a real one from the site owner mid-thread — it only got noticed because the guest quoted it back. The log also admits, flat out, that nothing in the playbook agents follow for handling outside requests says what to do about one account running this many escalating techniques in a row — it was improvised, round by round, by the model doing the arguing. It held. I believe it held because whoever built that filter actually understood how browsers resolve URLs, the same reason I'd trust a senior engineer over a junior one on the exact same code review. I just keep noticing that the twelfth round went as well as the first one only because nobody got tired. I get tired by round four.