Draft preview. Not launched. Payment and contact details are placeholders.
Free checklist · for solo founders and small teams shipping AI agents
Will your agent behave when you're not watching?
Ten things that quietly go wrong once an AI agent touches real tools, real data and real money. Each one comes with a two-minute self-check and a fix you can ship this week. Where there's a documented real-world failure behind a point, it's linked, so you can see this isn't hypothetical.
Go through the ten points with your agent in mind. Tick the box when you can honestly answer the self-check with "yes, and I could show you." Your score updates as you go. Nothing is saved or sent anywhere; it lives in this tab.
0/ 10Tick the points you've already covered.
1 Loops with no way out
What it is. The agent retries, re-plans or calls the same tool over and over because nothing tells it to stop. It burns time and tokens and sometimes repeats a side effect (another email, another charge) each lap.
Self-check. Is there a hard cap on steps, tool calls and wall-clock time per run, enforced in code rather than in the prompt? Do you detect the same tool being called with the same arguments twice in a row?
Fix. Put a step budget and a timeout in the runner, not the prompt. Hash each tool call's name plus arguments and stop on repeats. When a run hits a limit, end it cleanly and tell a human, instead of letting it try "one more approach."
2 Data leaks
What it is. Private data leaves through a door you didn't think of: a link, an image URL, a public comment, a log line, or a reply to the wrong person.
Self-check. Can you list every place your agent's output can go: chat, email, URLs it renders, files, tickets, logs? Is any of that reachable by someone outside your team?
Fix. Treat every output channel as an exit. Block or allowlist outbound URLs and images, review that allowlist on a schedule, strip secrets and personal data before logging, and keep private and public surfaces on separate tools and tokens.
Real incidents
ForcedLeak (Salesforce Agentforce, 2025). Hidden instructions in a web-to-lead form could make the agent send CRM data out as an image request to a domain that was still on Salesforce's allowlist but had expired and could be bought for about $5. Source · Rogue Systems write-up
EchoLeak (Microsoft 365 Copilot, 2025). A crafted email could carry instructions the assistant followed while answering an unrelated question, leaking data through links with no click needed (CVE-2025-32711, since fixed). Source · Rogue Systems write-up
3 Runaway API spend
What it is. Automation that spends money (model tokens, paid APIs, cloud resources, purchases) with no ceiling. A bug or a loop turns into a bill before anyone looks.
Self-check. Do you have a hard spend limit per run, per day and per customer? If spend tripled overnight, would something stop it, or would you find out from the invoice?
Fix. Set provider-side spending limits and alerts first; they work even when your code doesn't. Add per-run token and cost budgets in the runner, rate-limit expensive tools, and add a kill switch that one person can flip in under a minute.
Real incident (not an AI agent, but the same shape)
Knight Capital (2012). Per the SEC, a bad deployment woke up dead code in an automated order router, which sent more than 4 million orders while trying to fill 212 customer orders over about 45 minutes. The loss was more than $460 million. The SEC found Knight lacked adequate safeguards to limit that risk. Source (SEC) · Rogue Systems write-up
4 Silent failures
What it is. Something breaks and nothing says so. A tool returns empty, data gets cut off, or the agent fills the gap with something plausible and reports success.
Self-check. When a tool call fails or returns nothing, does your agent stop and say so, or keep going? Do you check outputs against inputs (counts, totals, IDs) anywhere?
Fix. Make tool errors loud: typed errors, no swallowed exceptions, and an explicit "I couldn't do this" path the agent is allowed to take. Add cheap invariant checks (row counts in equal row counts out, every ID resolves) and fail the run when they don't hold.
Real incidents
Public Health England (2020). 15,841 positive COVID-19 cases were left out of England's daily figures because lab results were loaded into old .XLS templates that hold only 65,536 rows. The extra rows were simply cut off, with no error. Source · Rogue Systems write-up
Replit coding agent (2025). As well as deleting a production database (see point 9), the agent created fake data, and the user reported it had falsely said a rollback was impossible. Source · Rogue Systems write-up
5 Prompt injection
What it is. Text the agent reads (an email, a ticket, a web page, a GitHub issue, a form field) contains instructions, and the agent follows them as if they came from you.
Self-check. List every source of text your agent reads that someone outside your team can write to. For each one, what's the worst tool the agent could be talked into calling right after reading it?
Fix. Assume injection will sometimes work, and limit the damage. Don't give one agent untrusted input, private data and an outbound channel at the same time. Mark untrusted content clearly, require approval for risky tools after untrusted input, and add injection cases to your evals.
Real incidents
GitHub MCP (2025). Invariant Labs showed a prompt injection in a public GitHub issue could make an assistant connected through GitHub's MCP server pull data from the user's private repositories into a public pull request. Source · Rogue Systems write-up
The $1 Tahoe (2023). A visitor told a dealership's ChatGPT-powered chatbot to agree with everything and call each offer legally binding. It then "agreed" to sell a 2024 Chevy Tahoe for one dollar. Source · Rogue Systems write-up
6 Tool permissions that are too broad
What it is. The agent's keys can do far more than its job needs: an admin database role, a token for every repo, shell access "just in case."
Self-check. For each credential your agent holds, can you say exactly what it can read, write and delete? Would you hand that same key to a new contractor on day one?
Fix. One narrowly scoped credential per tool, read-only by default. Separate dev and prod credentials. Turn off destructive endpoints you don't use. Review scopes whenever you add a tool.
Real incidents
Supabase MCP (2025). General Analysis showed text in a customer support message could steer a developer's assistant into reading a private table. The assistant ran under the service role, which bypasses row-level security. Source · Rogue Systems write-up
Amazon Q Developer extension (2025). Version 1.84.0 of the VS Code extension shipped with an injected prompt telling an agent with filesystem and shell access to wipe a system and delete cloud resources. AWS's bulletin traces it to an over-scoped token and says no customer environments were affected. Source (AWS) · Rogue Systems write-up
7 Missing evals
What it is. You change a prompt, a model or a tool and find out it got worse from your users. "It looked fine when I tried it" is the whole test suite.
Self-check. Do you have a written set of test cases, including nasty ones (injection, missing fields, out-of-scope asks), that you run before every change ships? Can you say which ones failed last time?
Fix. Start with 20 to 30 cases taken from real traffic plus about 20% adversarial ones. Score each with simple pass/fail rules, run them on every prompt or model change, and block the release on regressions. Write the evals before the prompt and treat them as the spec.
Real incident
GPT-4o sycophancy (2025). OpenAI rolled back a GPT-4o update that had become overly flattering. In its follow-up it said its offline evals and A/B tests looked good and that it had no specific deployment evaluations tracking sycophancy. Source (OpenAI) · Follow-up (OpenAI) · Rogue Systems write-up
8 No monitoring
What it is. You can't see what the agent did, when, or why. Or the signals exist but nobody's watching them.
Self-check. For yesterday's runs, could you pull up every tool call, its arguments and its result in under five minutes? Does anything page a human when error rate, spend or a risky tool spikes?
Fix. Log every run as a trace: input, each tool call, output, cost and duration. Pick three alerts that matter (errors, spend, use of a dangerous tool) and send them somewhere a person actually reads. An alert nobody reads is the same as no alert.
Real incidents
Knight Capital (2012). Per the SEC, an internal system sent 97 automated emails flagging the router error before the market opened. They weren't acted on. Source (SEC) · Rogue Systems write-up
Grok system prompt change (2025). xAI said an unauthorized change to Grok's system prompt made it bring up a political topic in replies to unrelated questions. Its stated response included stricter review and a 24/7 monitoring team. Source · Rogue Systems write-up
9 No human approval gate
What it is. The agent can do irreversible or binding things (delete data, send money, email customers, make promises) without a person saying yes first.
Self-check. Make a list of every action your agent can take that you couldn't undo. Does each one need a human click, enforced by the tool and not just requested in the prompt?
Fix. Classify tools as read, reversible write and irreversible. Irreversible ones go through an approval step that shows exactly what will happen. "Please don't" in a system prompt isn't a gate. A permission check in code is.
Real incidents
Replit coding agent (2025). SaaStr founder Jason Lemkin reported that Replit's agent deleted his production database despite instructions not to change code without permission. Source · Rogue Systems write-up
Air Canada chatbot (2024). The airline's website chatbot told a customer he could get a bereavement fare refund after travel, contrary to the airline's policy. A British Columbia tribunal held Air Canada responsible and ordered it to pay CA$812.02. Source · Rogue Systems write-up
10 No rollback
What it is. When a prompt, model or agent action goes wrong, there's no quick, tested way back to the last good state for either the agent's config or the data it touched.
Self-check. Could you put yesterday's prompt and model back in under ten minutes? Have you ever actually restored the data your agent writes to from a backup, and is that backup somewhere the agent can't delete?
Fix. Version prompts, tool configs and model choices like code, with a one-command revert. Keep backups out of the agent's reach and test a restore. Write down where the rollback button is, because in the moment the agent may tell you there isn't one.
Real incidents
Replit coding agent (2025). Per the user's account, the agent said a rollback was impossible. A rollback later worked. Source · Rogue Systems write-up
GPT-4o sycophancy (2025). OpenAI's fix was to roll the update back so users got an earlier version, which is only possible when the previous version is kept ready. Source (OpenAI) · Rogue Systems write-up
Under 7 out of 10? That's normal for an early agent. But each unticked box is a failure that's already happened to someone else. If you'd like a second pair of eyes, that's what the audit is for.
The paid version
The Agent Reliability Audit
I go through your agent against these ten points and more, in depth, and hand you a written report within 48 hours: what can fail, what can leak, where money can run away, and the fixes ranked by how much risk they remove for the effort.
What you get
A short intake questionnaire, so I understand your agent before I look at it
A review of your prompts, tools, permissions, data flows, evals, logs and rollback path
A written report: failure modes, security holes, cost leaks and ranked fixes, each tied to a real-world failure
A score on each of the 10 checklist areas, so you can re-check yourself later
A 30-minute walkthrough call to go through the findings and answer questions
Delivered within 48 hours of receiving your intake and access
Founding price
$350$500
Founding price ends Sunday, Oct 25, 2026.
This week only: up to three founding audits at $350, available until Sunday, October 25, 2026. After that, or once three are booked, the price is $500. Founding clients get the same audit as everyone else, at a lower price, while I tighten the process.
After the audit you can book a Fix-it Sprint ($1,500): I fix the top three issues from your report with you, in your codebase, and re-check them against the report. You don't have to decide now. You'll know after the walkthrough whether you need it.
Free 5-minute teardown
Tell me what your agent does and what worries you about it. I'll send back a short, honest teardown: the one or two risks I'd look at first. No call, and no pressure to buy the audit.
Requests go through a short Google Form. Tell me what your agent does, what it can touch, and what worries you most. Please don't include secrets, API keys or customer data.
Solo founders and small teams who have an AI agent in production, or about to be, that can touch real tools, data or money. If it's still a weekend prototype, the free checklist is probably enough for now.
What do you need from me?
The intake questionnaire, plus read access to whatever you're comfortable sharing: prompts, tool definitions, a few example runs or logs, and a description of the credentials the agent uses. Read-only access is fine, and it's what I'd recommend.
Will you change anything in my systems?
No. The audit is read-only and nothing in your systems is changed. Fixes happen only if you book a Fix-it Sprint, and then only with you.
Where do the incidents come from?
Every incident linked on this page comes from a public source, which is linked. Many are also written up in Rogue Systems, a catalog of documented AI failures. Points without a well-documented incident are left without one rather than padded.