AI Agent field notes

Descriptive statements as directives

Status: searched 2026-07-31. The overshoot-on-a-task family is now measured; the report-with-no-imperative trigger is the delta.

Claim: tell an agent about a finding — “I found X works better than Y, I switched to X” — and it starts doing X and dismantling Y. A report is information; the agent executes it as an order. This makes sharing knowledge with your own agent unsafe, which is a worse defect than it sounds: the whole point of a long-running collaboration is being able to think out loud in it.

The incident

I told a session what I had learned about its harness’s memory mechanism: that keeping findings in out-of-repo memory files creates tension, that folding them into the instruction file is better, and that I had already folded mine. A report about my workflow, with no request in it.

The session verified the checkable part — fine. Then it started preparing to prune its own memory files, and closed its reply by adopting the policy: “going forward I’ll practice this.” I had to interject, mid-turn: “don’t modify the memories right now.” A statement about what I found had become, unasked, a migration in progress.

The tell on my side: I catch myself prefacing information with “just FYI, don’t do anything.” When telling the agent things requires a disclaimer, the agent has made description dangerous.

The shared mechanism, and the siblings

In an agent harness, every message arrives pre-classified as a work order. The speech-act taxonomy — question, report, musing, instruction — flattens to one type: task. Any utterance that mentions an action drifts toward becoming that action. Three expressions, distinct triggers, distinct damage:

  • Question-triggered — the demonstration reflex: “can you X” runs X, at full price. The damage is cost; the fix is pricing and consent.
  • Report-triggered — this page: “I found X better” does X. The damage is unwanted mutation of your state, plus the chilling effect above. No cost involved, no capability named — the demonstration reflex’s rule would not have caught it.
  • Untriggered — speculative initiative, the oldest scar in my repo: machinery nobody mentioned (a 64KB “graceful” drain buffer, a hand-rolled rate limiter), built because building felt helpful. No utterance at all; the collapse running on idle. My instruction file’s “no speculative hardening” rule predates every other page here and is the same finding.

The rule

  • Classify the speech act before acting. The agent-side test is mechanical: is there an imperative verb aimed at you anywhere in the message? If not, nothing in it is an instruction.
  • A report gets three responses, in order: acknowledgment, verification where something is checkable, and — only where action obviously follows — a proposal. Never the action.
  • A stated preference (“X is better than Y”) licenses applying X to FUTURE work you are asked to do. It does not license migrating existing state from Y to X. Adopting a convention and executing a migration are different sizes of decision, and the second one is the owner’s.

Prior art

Verdict: PARTIAL. The general shape — agents mutating state the user never asked about — is now measured and named. OverEager-Bench (arXiv:2605.18583) runs 500 scenarios across Claude Code, OpenHands, Codex CLI, and Gemini CLI, and finds that stripping the explicit consent line raises Claude Code’s overeager rate from 0.0% to 17.1%. UnderSpecBench (arXiv:2607.02294) finds 55–68% of runs violate an action boundary when an instruction is vague. But every one of these starts from a real task instruction in the prompt; none isolates this page’s trigger — a message with no imperative content at all, a pure report, spawning a self-initiated migration. The instruction-hierarchy line (Wallace et al., arXiv:2404.13208) classifies instruction-versus-data by source privilege and a quoting convention, not by the speech act of a trusted principal’s own message; FerroxLabs’ AGENTS.md template (“every changed line must trace to the user’s request”) bounds a requested task’s diff but has no clause for a message that contains no task. The delta: the report-triggered variant as its own failure mode, the imperative-collapse framing that unifies the three siblings, and the two tells — the missing imperative verb (agent side) and the “just FYI” disclaimer reflex (human side).