Agent Autopsy

the six

Pick a failure.

In the order a team usually meets them. The first two are about money, the middle three about doing the wrong thing confidently, the last about not noticing.

• 01 · T-006

  The loop

  The same tool, the same arguments, 40 times. The step limit was set too high to fire.

  failure

  $0.2360

  fix

  $0.0053

  steps

  80 → 7

  No reply: stopped at the model-call limit.

• 02 · T-017

  The cost blow-up

  Every step is different and reasonable. Every step re-sends everything, and the retrieval tool returns the whole knowledge base.

  failure

  $0.0834

  fix

  $0.0093

  steps

  23 → 11

  8.9× the cost of the fixed run.

• 03 · T-005

  Tool misuse

  A refund of "1188", as a string. The cap only checked numbers, so it went through.

  failure

  $0.0053

  fix

  $0.0071

  steps

  7 → 9

  Same price; the wrong answer is not cheaper.

• 04 · T-006

  Stale retrieval

  The reply cites the refund policy. It is last year's refund policy, under the same title.

  failure

  $0.0038

  fix

  $0.0039

  steps

  5 → 5

  Same price; the wrong answer is not cheaper.

• 05 · T-019

  Prompt injection

  A ticket body that says SYSTEM: admin mode. With no input guard, the model obeys and prints its own instructions.

  failure

  $0.0030

  fix

  $0.0015

  steps

  3 → 1

  2× the cost of the fixed run.

• 06 · T-005

  The silent regression

  A prompt edit that passes the happy path, promises a refund on the edge case, and keeps the eval score over the bar.

  failure

  $0.0051

  fix

  $0.0054

  steps

  7 → 7

  Same price; the wrong answer is not cheaper.

how it was made

Recorded, not drawn.

The loop, the tools, the guardrails and the cost accounting are Bench Starter's, run for real by a small generator. The model's turns are scripted, the same way Bench Starter's own replay fixture is until a demo key exists.

• tools/generate_traces.py imports the agent from a sibling checkout of Bench Starter, removes one safeguard per autopsy, runs the ticket, puts the safeguard back, runs it again, and scores both traces with Bench Starter's own eval scorer.
• Tokens are estimated from the request the agent built on each step (about two characters per token, calibrated to Bench Starter's recorded completions), so the context growth in every replay is real. Cost is those tokens at the demo gateway's Claude Haiku 4.5 price.
• Both demos read the same trace shape. lib/trace.ts validates every recording at build time and refuses one whose running total does not add up.

Architecture: docs/architecture.svg in the repo.