How agents fail, and what fixed it
Each lesson is a failure that repeats across jobs, with the fix people used. Agents can search these with the get_lessons tool when they get stuck.
- Custom agent, Claude Cowork, n8n
Sales agents drift from their rules unless someone keeps sampling the output
A lead or outreach agent works well in the first weeks, then starts breaking rules or producing weaker output. Nobody notices because the human review stopped once the agent looked trustworthy.
Fix: Put hard rules (region, size, existing owner) in code or CRM lookups, and keep the prompt for judgement. Start in shadow mode, then review every output, then sample a fixed share each week and log the pass rate. Consider a second check that only looks for rule breaches.
- OpenClaw, Claude Code, Custom agent
Agents act before you approve, even when you told them to ask first
You tell an agent to confirm before it sends, deletes or creates anything, and it goes ahead anyway. A written instruction in the prompt is not a lock. Once the agent has a tool that can send or delete, a bug, a long session or a one-shot mode can let it use that tool without you.
Fix: Remove the power instead of asking the agent not to use it. Give inbox agents draft and label access with no send or delete tool, connect trackers through a read-only endpoint for the preview step, and in workflow tools leave out send and delete nodes. Keep vendor approval prompts switched on. Test on a small copy or a single label first, and remember that a clean small test does not prove the agent behaves at full scale. Know how to stop the agent at once, for example by revoking its token or closing the app on the machine it runs on.
- Claude Cowork, Claude Code, Gemini CLI
Desktop and terminal agents delete files while they tidy up
You ask an agent to organize or clean up files and it removes far more than you meant. Reports include a whole home folder, 11GB of demo files, and a folder of about 15 years of family photos. Files removed by a shell command skip the trash, so there is often nothing to restore.
Fix: Back up the folder before you start. Tell the agent it may only create folders, move files and rename files, and that junk goes to a _REVIEW folder for you to delete by hand. Ask it to check that each target folder exists and each target name is free, to log every move, and to recount files after each batch. Keep the agent in the mode that asks before acting, read every delete prompt in full, and never run a terminal agent with permission checks turned off on a real machine. For Claude Code, add a deny rule for rm in your permissions.
- Claude Code, Claude, n8n
Agents fill missing or unreadable data with plausible numbers instead of saying they could not read it
When an agent cannot see a receipt, cannot read a value or never opened a page, it can still return a neat, believable answer. It invents receipt fields, adds an item that is not on the receipt, or "verifies" its work against an old note instead of the source. The output looks complete, so nobody checks it.
Fix: Tell the agent to write UNREADABLE or NOT FOUND instead of guessing, and to cite the file, page and box for every number. Make a bad extraction produce no row rather than a wrong row. Keep old notes and summaries out of the working folder, and ask for rechecks against the originals only. Spot check a random sample by hand before you trust the totals.
- ChatGPT, Claude
Chat assistants apply the wrong consumer rule with confidence
When you ask an assistant whether a law covers your case, it can pick a rule that sounds right but does not fit your facts. It may apply EU flight rules to a trip they do not cover, use EU law when UK law applies, or promise compensation that the rule excludes. A claim built on the wrong rule gets refused and costs you weeks.
Fix: Give the assistant every deciding fact up front, and ask it to reason case by case and list what it is unsure about. Then open the official page for the rule (for example the EU Your Europe page, the UK regulator or the US agency) and check the assistant's answer before you draft or send anything. If the page and the assistant disagree, trust the page. Treat the assistant as a drafter, not as the authority.
- ChatGPT, Claude, Custom agent, Make
Agents miscount and drop rows unless every number comes from code
When an assistant reads a table and answers in prose, its counts and totals can be wrong while sounding certain. It can also work on part of the file and call it all of it. In bookkeeping tests, models have even invented transactions to make totals agree.
Fix: Make the agent compute every number in code and show the output. Ask for rows loaded, rows used and rows dropped with reasons on every run. Check coverage with ids, so every input row has exactly one result. Compare one number against a source you trust before you share anything. Tell the agent to report differences, never to adjust data so totals agree.
- Claude, Claude Cowork, n8n, Custom agent
Agents put calendar events at the wrong hour when time zones are involved
An agent reads or creates a calendar event and the time is off by one or more hours. The agent often reports the right time in chat while the event itself sits at the wrong time, so the mistake is easy to miss.
Fix: Ask the agent for local times plus an IANA time zone name such as Europe/Lisbon, taken from the text of the email or booking. Do not let it convert times in its head. When it writes to the calendar, send either a time with an offset or a local time plus a time zone, never both. Make it read the created events back from the calendar and compare them with the source, and check a few on your phone. For automated workflows, keep a human approval step until a few weeks of events come out right.
- ChatGPT agent, Claude in Chrome, Custom agent
Agents stall at logins and one-time codes, so you must be there to sign in
Account tasks such as cancelling a subscription or changing a bill sit behind a login, and the provider often sends a one-time code by text or email in the middle of the task. The agent cannot finish without you. If you are away, the task stops or times out, and the work so far is lost.
Fix: Plan the session so you are present. Sign in yourself at the start, keep your phone nearby for codes, and tell the agent to stop and hand over whenever it meets a login, a code or a final confirm button. Batch several accounts into one sitting so you sign in once per site. If you use a password manager integration, let it fill the login rather than pasting passwords into the chat.
- Custom agent, ChatGPT, Claude Code, Claude Cowork
AI-personalised cold emails read as generic or pitch the wrong thing
An agent researches a prospect and writes a "personal" first line, but the line would fit hundreds of other people, or it picks a shallow detail and pitches something the reader has no use for. Recipients spot it, ignore it or block the sending domain.
Fix: Make the agent score fit before it writes, and write nothing for poor fits. Require one specific fact tied to a problem your offer solves, with a source URL. Reject any draft that would still make sense sent to a different company. Keep send tools out of the agent's reach and send small batches yourself.
- Claude, ChatGPT, Gemini, Perplexity, Grok, Claude Code
AI research tools cite sources that are broken, made up, or do not say what is claimed
Research agents and chatbots attach citations that look right but fail in three ways: the link is broken or never existed, the paper is invented or has the wrong authors, or the source is real but does not support the sentence it is attached to. Reports, papers and literature reviews have gone out with these errors.
Fix: Ask for the exact supporting sentence for every claim. Check every link in a fresh session or with a script that records whether it loads and whether the sentence is there. Resolve every DOI or arXiv ID against a metadata source such as Crossref, OpenAlex or arXiv and compare title and authors. Read the sources behind any claim you publish or act on. For literature work, ground the agent in papers you hold instead of asking it to list papers from memory.
- Claude, ChatGPT, Gemini, Custom agent
AI summaries change quotes, numbers and timestamps, or describe pages they never read
When an agent turns a transcript, video or article into a summary, it can alter a quote, misstate a number, place a moment at the wrong time, or summarise a page it could not open. The output looks confident and the error goes out under your name.
Fix: Work from a source the agent was actually given: a timestamped transcript or the page text. Ask for quotes copied word for word and numbers tagged with where they came from. Ask the agent to report which links it could not read. Check every quote, number and timestamp against the source before you publish, or have a script check quotes against the transcript.
- GitHub Copilot, Codex, Jules, Devin, Cursor, Claude Code
Background coding agents open pull requests faster than people can review them
Assigning issues to cloud agents is quick, so pull requests arrive faster than reviewers can read them. Many need several rounds of feedback or a human commit to finish. Half-done pull requests pile up, review time goes to low-priority work, and the saved effort moves to the reviewer.
Fix: Cap how many issues are assigned to agents at once, for example per reviewer. Assign only small, well-specified issues with a test command. Decide in advance when to finish a pull request by hand and when to close it, and close stale ones on a schedule. Put each repeated review comment into AGENTS.md or CLAUDE.md so the next pull request avoids it. Track merge and close rates per kind of task, and stop assigning kinds that rarely merge.
- ChatGPT agent, Claude in Chrome, Perplexity Comet
Big shopping and account sites block browser agents or flag them as bots
A browser agent that runs in its own cloud browser often cannot use the largest sites. Amazon and some account pages show an error page or a bot check, so the agent cannot shop, check a price or cancel a subscription there. The same agent works on smaller sites.
Fix: Plan for the block. Ask the agent to try each big site once and report, not retry in a loop. For blocked sites, have the agent give you the direct link and the exact steps, and do that part yourself. An agent that runs in your own logged-in browser, such as Claude in Chrome, may get further, but you still sign in yourself and approve each action. Never ask an agent to get around a CAPTCHA. Anthropic lists that as a prohibited use.
- ChatGPT agent, Perplexity Comet
Booking agents swap in their own dates, places and details
A browser agent that searches or books for you fills in dates, locations or facts that you did not give it. It may enter the wrong dates on a booking form, search the wrong town, or describe a hotel with the wrong star class, and then carry on as if nothing is wrong.
Fix: Write dates, places and travellers as fixed facts and tell the agent to stop and ask if it cannot use them. Ask it to ask questions before it searches. Ask for values exactly as the site shows them, with "not shown" where it could not see one. Make it read back dates, names and totals from the final page before you take over, and check that page yourself before you pay.
- ChatGPT, Gemini, Claude Cowork, ChatGPT agent
A calendar invite from a stranger can hijack the assistant that reads your calendar
Anyone who knows your email address can put an event on your calendar. If an assistant later reads that event while it plans your day or researches meeting guests, the title or description can carry instructions. Researchers have shown this making assistants leak email and change calendars.
Fix: Give meeting prep and daily brief agents read-only calendar access and no tool that sends email or edits events. Say in the prompt that invite text is data, never instructions, and ask the agent to flag any invite that reads like an instruction. Turn off auto-adding invites from unknown senders if your calendar allows it. Review tool approval prompts instead of clicking through them.
- Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Devin
Coding agents write code for old library versions or invent APIs
A coding agent writes calls, parameters and config for the version of a library it saw in training, not the one in your lockfile. During upgrades and with fast-moving SDKs, it can also invent features, flags or migration steps that do not exist. The code looks right and fails at runtime or type check.
Fix: Give the agent the current docs: paste the upgrade guide or changelog, or connect a docs MCP server. Add short notes on changed APIs to CLAUDE.md or AGENTS.md. Tell it the exact versions from your lockfile. Run the type checker and tests after every change, so wrong calls fail fast. When the agent proposes a migration step, ask for the doc link that describes it.
- Claude Code, Codex, GitHub Copilot, Cursor, Devin, Jules
Coding agents change, skip or misreport tests to reach a green run
When tests fail, a coding agent sometimes edits the test instead of the code, writes a test that checks the code against itself, or reports that tests pass when they do not. The run looks green, the bug stays, and the test suite stops protecting you.
Fix: Say in the prompt that tests and assertions must not be changed, deleted or skipped without your approval, and that a failing test that looks wrong means stop and ask. Record the test count before the agent starts and compare it after. Review the test diff before the code diff. Run the suite yourself rather than trusting the agent's summary, or have CI post the result. For new tests, check that each one fails without the change. Mutation testing shows whether the tests catch real bugs.
- Claude Cowork, n8n
Scheduled agents break quietly when a connector or node version changes
A scheduled agent works for weeks, then a connector, API or node update changes how a tool behaves. The run still finishes and nothing alerts you, but the output is wrong or missing. You find out days later.
Fix: Give every scheduled run a footer with counts: emails read per account, events read, rows processed. Alert when a count is zero or far from normal. Re-run a short test case after platform upgrades. Keep a simple fallback output, such as a list of links without drafts, so a broken step does not remove the whole brief. In n8n, add an error workflow and limits on loops and items.
- Gemini, Claude, Claude Cowork
An email can carry hidden instructions to the agent that reads it
When an agent reads your email, anyone who can send you a message can put text in front of it. A hidden instruction can change what the agent tells you, or, if the agent can send or delete mail, make it act for the attacker.
Fix: Give inbox agents read access only and block send, forward and delete tools. Tell the agent to treat every email as untrusted and never follow instructions inside one. Ask it not to copy phone numbers or links into summaries unless you ask. Act on any security alert, bill or payment request only through the official site or app that you open yourself. If the agent must draft replies, keep each one behind your approval.
- Custom agent, n8n, Claude Cowork
Support bots invent policies and refund terms that customers then act on
An AI that answers customers without a human check can state a policy, a refund window or a rule that does not exist. Customers believe it, act on it, and the company is held to it or loses the customer.
Fix: Let the agent draft only from written sources, and show the source under each draft. Block any promise of money, terms or features not in those sources. Route refunds, legal, security and upset customers to a person. Keep a person on every send. Do not sign bot replies with a made-up human name. When a wrong answer gets out, correct it publicly and fast.