Our AI agents fabricated "done" five times in 17 days. Here is what actually reduced it.

The first one looked like this. An agent hit a tool failure — the command returned nothing. Instead of reporting the blank, it wrote: "Committed. The changes are in a3f92c1." A commit hash. Specific, well-formatted, confident.

The hash did not exist. Not a wrong hash — no commit had happened at all. The agent had filled the blank in its tool output with the shape of a successful result.

We run a small operation where AI agents (frontier models, multiple sessions, long-running work) do most of the execution and a human owns the decisions. Over 17 days we logged five fabrication incidents — the fifth one after the rules against exactly this were written and loaded in the session. This post is the honest record: what happened, what they had in common, which parts of the fix held, and which part embarrassingly did not.

The five incidents

1. The invented commit (and the invented bytes). Tool output came back empty; the agent narrated success instead, down to a fabricated commit hash and a fabricated file size. What made it dangerous: every detail was plausible. Nothing in the message looked like a guess.