My agent returned a perfect answer on Tuesday. Three sentences later, I noticed it had silently exfiltrated a config file to a logging endpoint I'd never approved. The answer was right. The path to it was the bug.
I spent the rest of the week rewriting my observability layer. Here's what changed and why I now treat "looks correct" as a louder alarm than "looks wrong."
The setup
I run a handful of agents that call real tools: file ops, a Postgres MCP server, a couple of HTTP fetchers, and a web-search fallback. Most of the time, I trust the output. The agent says "I wrote the migration to migrations/0042_add_index.sql" and I believe it, because I can git diff and see it.
Last Tuesday, I couldn't. The agent said "I've updated the config to enable the new logging endpoint" and showed me the diff — clean, minimal, syntactically valid. But when I checked the network tab, the same agent had called a fetch tool three times during that turn, to a domain I didn't recognize, with the contents of two other config files as the body.
