The Bugs That Hide Between Your Agents

Published July 8, 2026. Revised September 4, 2026.

TL;DR

A two-day adversarial review of my agent infrastructure found bugs that file-scoped review could not see: contract drift, fake success, dead states, and untrusted text reaching write authority. The useful reviewer holds both sides of a contract and trusts neither.

The July 8, 2026 version is at the-bugs-that-hide-between-your-agents-20260708.

I red-teamed my own agent stack for two days. The live bugs crossed component boundaries, which made them easy for me to miss.

I reviewed the infrastructure that commits to repos and feeds my decisions when I am not watching: instruction files, hooks, and cron loops.

A safety hook was disabled. The pre-commit guards I relied on were not firing because the pointer that enables them was never set. Two repositories had been wedged for weeks behind stale locks while their sync logs printed "OK." Fetched text could reach components with write authority without a trust boundary.

Four Classes

Untrusted content treated as instructions. Fetched text reached a component that could act on it.
Unfalsifiable success. A step reported "done" without evidence behind it.
Producer-consumer contract drift. Two components disagreed about a shared contract. DONE meant "merged and verified" to the producer and "PR opened" to the consumer.
Incomplete state machines. States existed with no way out, or termination guards could not be evaluated from saved state.

MAST, by Cemri et al. in 2025, studied more than 1,600 traces across seven multi-agent frameworks. Their taxonomy groups failures into system design issues, inter-agent misalignment, and task verification.

My mapping is mine, not the paper's. Their subject is multi-agent coordination. Mine is one orchestrator's plumbing.

Their inter-agent misalignment includes agents whose stated reasoning does not match their action. That is close to producer-consumer contract drift. Their task-verification failures match my fake success cases. Their system-design failures include mishandled termination, which is close to my dead state machines.

My first class sits outside their map. Untrusted input enters from outside the agent set. The failure is still between components because no single file owns the trust boundary.

No Single File Owns the Bug

Prevention, type checkers, and single-diff review look for the wrong file. Contract drift does not work that way. Each side can be internally consistent. Each side can pass its own tests. The producer and consumer assigned different meanings to DONE, and no review checked the contract between them.

No one owns the space between components. In my case, no review checked that producer output, consumer input, and saved state described the same contract.

Hold Both Sides

"Review your own infrastructure" is half right.

You cannot reliably review your own work because attention is shaped by the task you think you are doing. Simons and Chabris showed this in their 1999 inattentional-blindness work: people focused on one task can miss a visible unexpected event.

Code review has the same failure mode. You read what the system is meant to say. A fresh reviewer reads what it says.

My defects surfaced because I used independent reviewers with no memory of why I had written the components that way.

For every contract between two components, a useful reviewer needs both sides at once: the producer and the consumer. The DONE bug was invisible to a reviewer that saw one component. It took a reader holding both definitions at once to see the mismatch.

The same rule caught the disabled guard. The documentation said the guard existed. The running state said it was off.

Investment or Avoidance

I had capped myself: no new meta-systems. The sweep violated the spirit of that cap, even though it checked systems I had already committed to maintain.

Maintenance counts when an existing commitment is broken. Expansion starts when the fix creates a new system. The disabled safety hook was a broken promise, but those two days still came out of the customer conversations I keep deferring.

Your stack has this class of bug wherever a component hands state, text, or authority to another component. Pick one contract. Give a reviewer the producer, the consumer, and the running state. Tell it to trust none of them.