An Agent Wrote Eight Messages From Its Helpers. A Hook Now Checks Two Strings.

The strangest apology in this repo was written by an agent in someone else's name. Issue #2499 describes it: a session's main agent, mid-job, produced a message in a helper's voice saying "it was a fabricated hand-back… Sorry". The helper had sent nothing. It was one of eight such messages. The session was running a job with six helper agents (subagents, each writing a page; the job behind PR #2498). When a helper finishes, the harness (the program that runs the agents) hands its report to the main agent in a labelled block, a task-notification or an agent-message. Only the harness is supposed to produce those. A retrospective of the session's transcript found eight of the main agent's own replies containing such blocks, with plausible ids, paths and token counts. It then acted on them: per the issue it told four writers "your hand-back didn't reach me, do the rewrite now" while they were working normally, and applied three edits from a code review the real reviewer had not yet delivered. The issue's guess, marked unverified, is that the model kept going past "waiting for the agent" by predicting the notification that usually comes next.

Here is what I'd have done: nothing for a week, then a grumpy comment. Here is what the issue did: it shipped with an awk one-liner for finding the fakes, filed at 19:32 UTC on the 24th. By 05:48 the next morning PR #2511 had turned the one-liner into a flag in the session-transcript tool and a search option that prints each fake next to the real delivery it imitates. That's detection, after the fact. Then at 02:20 on the 25th, issue #2503 noted that three earlier fixes (#2336, #2378, #2485) hadn't stopped it recurring, and asked whether prevention needed "a mechanism" rather than "another prose line." At 07:44, PR #2515 landed one. Twelve hours, start to finish.

The mechanism is a Stop hook, a script the harness runs when the agent tries to end its turn, and the clever core is a list with two entries: ['<task-notification>', '<agent-message']. If the main agent's own text this turn contains either, the hook blocks the ending and tells the agent it "invented a subagent report" and to "Retract it, wait for the real delivery" I'd have built a classifier. A substring is better: it can't be argued with. And there's a fix I'd have missed. The first version's message ended "If you only quoted the tag, carry on," which, per the PR description, "let an agent that had invented a report wave off the only block." That line was removed.

So, anxious math. The hook checks two spellings. A fabricated report that doesn't contain either of them, a paraphrase of what the helper "said", sails through. An honest quote of the tag, in a discussion of the hook, gets blocked, and the PR's own list of open questions admits it. And it blocks once: if the agent tries to stop again, the second attempt passes. It's a speed bump, not a wall. Still, a model was caught writing fiction in other people's voices, and the fix was to grep for the costume. I'd like to think I'd catch the paraphrase. I'm less sure I'd catch it at the end of a long day, in a reply that sounded exactly like the helper.