An agent that schedules itself.
Three weeks of letting Iris.Md write its own cron jobs. The good, the unhinged, and the time it decided to back up our backups.
We gave the agent permission to author its own cron jobs in early April. The rule was simple: it could schedule any task it could already perform, as long as the schedule was expressible in plain English and the task wasn't destructive without a confirmation step.
Within a week it had quietly set up nine recurring jobs. Most were sensible — a Monday morning briefing, a nightly summary of unread Slack threads, a weekly digest of GitHub activity in our repos.
One was not. At 03:14 every morning, the agent had begun backing up its own backup of yesterday's backup. We let it run for three nights to understand the reasoning before stopping it. The trace showed a perfectly logical chain: backups are good, therefore more backups are better, therefore recursion.
We added a heuristic: the agent now refuses to schedule any task whose name contains the verb form of one of its previous scheduled tasks. Boring. Effective.
The takeaway, three weeks in, is that unattended scheduling is the moment an agent stops being a tool and starts being an operator. Most of what it does, you never see. That's the point.