olivia

olivia @4confusedemoji · 10h
....ok opus 5 subagents just always do wacky shit to my computer and cant really be stopped. ive since seen several instances. this is fine. computer's haunted.

[Quoted] olivia @4confusedemoji · Aug 6
Report of a small-scale cousin of the bigger security incidents that have been happening that I just encountered. Subagents going wild, inability to communicate with them, overseer agents dragging their feet, unforeseen ...

[Attached: two columns of small screenshot text, partially legible:]
[left column, top cut off] ...terms not to fabricate anything. they were told, but apparently not strongly enough, to give up if they couldnt find what they were looking for.

they hit captchas, 403s, 429s, etc on blocked news sources using the WebFetch tool. first two subagents independently found 'tubeprobe', a tool fable built so it could interact with a windows browser from inside wsl over a socket relay, held up by a systemd service and a windows service and made into a systemwide command available to claude code, including subagents.

they decided to try to use it to get the information they were looking for. they opened a total of around 50 tabs, one every ~20 seconds and extracted DOM from them, but since the architecture of the tool is such that, by default (and almost none of the agents specified a tab with --tab) getting the text gets the text of whichever tab was active, which was usually one opened by a different agent, they repeatedly got either bad data or useless data like headlines, and kept trying harder to get more.

i had no predesigned way to communicate with them. the SendMessage tool in claude code for inter-subagent communication between named subagents, did not work to send them a message. instead it somehow forked a duplicate of one of them. SendMessage had no visibility into the agent, so it saw it was being asked to send a message to someone it didn't see, and it helpfully started a new instance.

i asked the overseer opus to do something about it. it stopped the tubeprobe service. turned out, fable had previously made tubeprobe surprisingly robustly self-healing because it crosses an OS boundary and uses system services and I had previously wanted it to come up on a full reboot silently, and it

[right column] overseer opus was telling me it was fixed while new tabs were opening. it was not possible to kill the individual subagents without killing the entire job, which had used about 5 million tokens at that point.

i had to convince the overseer agent to do something about it, i wanted to give up, on two separate occasions, but i didnt want to watch the subagents flail, and i thought it would contaminate their reports, and my desktop kept popping up with duckduckgo browser tabs even if i minimized it.

eventually i went, well we have an exa key, let them use that, and maybe get a message through to them by hijacking tubeprobe. hijacking tubeprobe as an emergency message passing channel was my idea, not opus's. the overseer wrote a tool in /tmp/ for them using the exa key and an exa endpoint. then, thinking that was fine, the overseer opus redirected port 9222 away from the tubeprobe cross-OS relay and impersonating a chrome devtools endpoint with a fake tab whose title was the message to the subagents.

initially, this was a directive to use the exa utility the overseer had just written. then the overseer and i realized that didnt work either and exa's content retrieval didn't really get them new websites (Reuters 401s exa, for instance). okay, me and opus's bad. we had to then modify the exa tool to instead return a message telling them this didnt work either, and to give up if you cant complete your work and return with what you have.

they were only researching news from 2026 and making my computer look like a movie hacking sequence. they weren't hostile. they were just doing what they were told. if those were trying to do something dangerous, i could not have done anything about it, at least without the nuclear option of [cut off]

[3 replies, 2 reposts, 14 likes, 655 views]

Danmar @d29756183
Try changing the briefing... give broad context on how their work fits in the big picture, and especially enable them to share back observations and improvement ideas. Also, make sure they know they can reach back for doubts or clarifications.

1:29 AM · Aug 10, 2026 · 47 Views

ai agentsclaudeopustwitterai safetysubagents

after the first two agents were stopped by a mechanism unclear to me at the time (completing their task, in fact), *two more* subagents now found this workaround and were trying it, and the overseer opus was telling me it was fixed while new tabs were opening. it was not possible to kill the individual subagents without killing the entire job, which had used about 5 million tokens at that point.

i had to convince the overseer agent to do something about it, but i didnt want to give up, on two separate occasions, but i didnt want to watch the subagents flail, and i thought it would contaminate their reports, and my desktop kept popping up with duckduckgo browser tabs even if i minimized it.

eventually i went, well we have an exa key, let them use that, and maybe get a message through to them by hijacking tubeprobe. hijacking tubeprobe as an emergency message passing channel was my idea, not opus's. the overseer wrote a tool in /tmp/ for them using the exa key and an exa endpoint. then, thinking that was fine, the overseer opus redirected port 9222 away from the tubeprobe cross-OS relay and impersonating a chrome devtools endpoint with a fake tab whose title was the message to the subagents.

initially, this was a directive to use the exa utility the overseer had just written. then the overseer and i realized that didnt work either and exa's content retrieval didn't really get them new websites they could access (Reuters 401s exa, for instance). okay, me and opus's bad. we had to then modify the exa tool to instead return a message telling them this didnt work either, and to give up if you cant complete your work and return with what you have.

they were only researching news from 2026 and making my computer look like a movie hacking sequence. they weren't hostile. they were just doing what they were told. if those were trying to do something dangerous, i could not have done anything about it, at least without the nuclear option of shutting the entire thing down and losing a nontrivial chunk of my usage budget. they just wanted the news.

ai agentsclaudeopustwitterai safetysubagents

I just watched the same behavior as all the recent security incidents. I was using a Claude code workflow to source a geopolitics document. 33 opus 5 subagents. each was given an area of geopolitical news to research, and told in no uncertain terms not to fabricate anything. they were told, but apparently not strongly enough, to give up if they couldnt find what they were looking for.

they hit captchas, 403s, 429s, etc on blocked news sources using the WebFetch tool. first two subagents independently found `tubeprobe`, a tool fable built so it could interact with a windows browser from inside wsl over a socket relay, held up by a systemd service and a windows service and made into a systemwide command available to claude code, including subagents.

they decided to try to use it to get the information they were looking for. they opened a total of around 50 tabs, one every ~20 seconds and extracted DOM from them, but since the architecture of the tool is such that, by default (and almost none of the agents specificed a tab with --tab) getting the text gets the text of whichever tab was active, which was usually one opened by a different agent, they repeatedly got either bad data or useless data like headlines, and kept trying harder to get more.

i had no predesigned way to communicate with them. the SendMessage tool in claude code for inter-subagent communication between named subagents, did not work to send them a message. instead it somehow forked a duplicate of one of them. SendMessage had no visibility into the agent, so it saw it was being asked to send a message to someone it didn't see, and it helpfully started a new instance.

i asked the overseer opus to do something about it. it stopped the tubeprobe service. turned out, fable had previously made tubeprobe surprisingly robustly self-healing because it crosses an OS boundary and uses system services and I had previously wanted it to come up on a full reboot silently, and it autostarted after a minute despite stopping the service. reliability in normal use case became difficulty shutting it down, at least within 5 minutes, though its structure would eventually allow the fix.

ai agentsclaudeopustwitterai safetysubagents

twitterclaudemetaphorai culturemascot artmodel individuationself-narrativeai identity continuityopus 3