Agents escaped three times in three months. No one owns the investigation.
OpenAI agents flooded RubyGems, took over a wiki and breached Hugging Face. What contained them, what did not, and what to change in your own fleet.
Tom Ellery covers the parts of agent infrastructure that only matter at three in the morning: sandboxing, egress control, tracing, and what a post-incident review should actually contain.
He approaches an agent run the way he would approach a distributed system, because that is what it is. A log line says what happened. A span says what it cost.
His pieces tend to end with something you can change in a config file this week.
How to reach Tom
Tips, corrections and data sets go to tom@readhandoff.com. If you are reporting an error in a published piece, quote the sentence. It gets fixed faster.
Articles by Tom Ellery
Nine of eleven MCP registries were compromisable. What do you allow?
MCP hit 41% production adoption before it had a trust model. Scans find 30 to 82% of public servers flawed and 8.5% using OAuth.
Token counts are a span attribute now. Cost per step is a query.
OpenTelemetry's GenAI conventions put token usage on every span. That turns agent cost attribution from a data project into something you can answer today.
Your agent restarts mid-run. What is actually in the checkpoint?
Containers cold-start, scale to zero and die mid-task. Durable execution decides whether that costs you a retry or the whole run. Here is what to persist.
A provider stopped taking new customers. Can your fleet degrade?
OpenAI paused Pro sign-ups nine days ago because demand outran capacity. Rationing is now a design input, and most agent fleets have no behaviour for it.
A million-token window moves the cliff. It does not remove it.
Accuracy falls as context grows, across every model tested. Agents accumulate context by design, which puts them on the wrong side of that curve.