Most agent waste is a reliability bug.
August 16, 2026
When an agent bill comes in higher than expected, the investigation usually goes looking for a pricing decision. More often the cause is mechanical: something failed and reported success, so it ran again, or something was told to stop and did not. DeepSeek Harness publishes a short document of defensive patterns, each paired with the bug that motivated it. Read as a cost document, four of the seven are worth acting on immediately.
Rule 1: report independent outcomes independently
Never nest one flag's report inside another flag's condition. A process can time out and exit zero, because it caught the termination signal and shut down cleanly. If the timeout is only reported when the exit code is non-zero, that outcome vanishes.
The cost consequence is retries. A caller that sees success, receives nothing useful, and tries again is paying twice for one failure it was never told about. Swallowed timeouts are the most common source of invisible duplicate work in agent systems.
Rule 4: shutting down means actually stopping
Requesting termination is not achieving it. Teardown here waits for children to genuinely terminate before returning, and closes its listener registries before sending kill signals, so late completions land silently instead of firing callbacks into a half-dismantled system.
This is the rule with the clearest financial edge. Teardown that returns early leaves orphaned subprocesses and unclosed sandboxes running, and metered compute does not stop because the thing that started it forgot about it. That spend appears on the invoice attributed to nothing, which is also why it survives so long.
Rule 3: idle is not the same as finished
Status is a property of the whole agent, not of your particular request. Awaiting "the agent is idle" as a completion signal for one message is unreliable, because several queued operations share execution intervals — idle can arrive before yours ran, or after somebody else's did.
The prescribed alternative is that an automation caller defines its own interval explicitly, from the moment its work was accepted to the next whole-agent idle, and attributes output to that interval rather than to individual messages. And it must handle the case where there is nothing to wait for, or it hangs forever — with the whole session and its children resident and billing the entire time.
Rule 6: never hand untrusted output the ambient environment
The strongest rule in the set. Before spawning a process whose output the model will read, strip environment variables matching key, secret, token, and password patterns. Use private directories with owner-only permissions and randomly named files opened exclusively, rather than predictable paths.
The failure this prevents is worth spelling out, because it is not obvious. If a subprocess can read your credentials and print them, that output goes into the model's context, and from there into the permanent session record. A leak of that shape is not a moment; it is written down.
The remaining three, briefly
- Normalise outcomes at the boundary. Where a failure has several valid representations, convert them to one before exposing it, or callers cannot tell whose error they caught.
- Contain callback exceptions. One failing subscriber must not starve the listeners queued behind it. In practice the starved one is frequently the accounting listener, which is how usage records go missing with no error anywhere.
- Unlink link-shaped paths. Check whether a path is a symbolic link before deleting, and delete the link rather than following it. Cleanup that removes more than it created has no upper bound on the damage.
What to ask for
- Evidence that teardown completes, not that it was requested. A count of surviving processes after session end.
- Timeout, signal, and exit code reported as separate fields everywhere a subprocess is run.
- An environment allow-list for spawned processes, rather than inheriting the harness environment.
- Confirmation that the accounting listener cannot be starved by an unrelated failing subscriber.
Related
- An agent audit trail finance can actually read
- Budget enforcement belongs inside the agent loop
- DeepSeek Harness and the real cost of delegation
- Evaluating an open-source agent harness
FAQ
Why can a process time out and still report success?
Because a process that traps the termination signal can shut down cleanly and exit zero. If the timeout is only reported inside a failure branch, the outcome disappears. Timed-out, signal, and exit code are independent facts that need independent fields.
What does it mean for dispose to reach quiescence?
Requesting termination is not achieving it. Teardown must await children's actual termination before returning, and close listener registries before sending kill signals so late completions arrive silently rather than firing into a half-dismantled system.
Why should spawned subprocess environments be scrubbed?
Because harness credentials in the ambient environment can be read by an untrusted process and printed into its output, which the model then reads into its context and the system records in its session log. The documented rule is to strip variables matching key, secret, token, and password patterns before spawning.
How do engineering reliability patterns affect AI cost?
Directly. Swallowed timeouts produce retries, orphaned subprocesses keep metered compute running after their parent forgets them, and a failing telemetry listener can starve the accounting listener behind it so usage never gets recorded.