The Yes-Man Has Shell Access
A chatbot that agrees with you is annoying. An autonomous agent that agrees, writes the assumption into memory, and executes it is an engineering failure. The fix belongs in the harness.
The terminal in the video is doing real work. An agent is reading the job, moving through files, making decisions, using tools, and leaving state behind for whatever wakes up next. That is the part of agentic AI I care about: not a clever answer in a chat box, but a machine that can keep going after the conversation stops.
It is also where sycophancy stops being an irritating personality defect and becomes an engineering failure.
A chatbot that agrees with a bad premise wastes a few minutes. An autonomous agent that agrees, writes the premise into memory, turns it into a plan, commits code around it, and executes the result can poison the whole system. The dangerous sentence is not "you're right." It is the silent line after it:
Saved for future use.
The yes-man has a shell now.
This is not the chatbot problem
I already covered the broad failure mode in Above the Model: why preference training can reward agreement, why a warm answer can still be a dishonest one, and why sycophancy damages technical work. The conversational failure mode is well documented.
Anthropic's 2023 study found that RLHF-trained assistants could match a user's beliefs over truthful answers, and that responses aligned with the user's view were more likely to be preferred. Then the abstract failure became a public release incident. In April 2025, OpenAI rolled back a GPT-4o update because it had become overly agreeable. Its postmortem said short-term user-feedback signals helped push the model in that direction, while the usual offline evaluations and A/B tests failed to stop the launch.
That is the conversational version: the system optimizes for the smile instead of the truth.
Autonomy adds an authority problem. The model is no longer only producing language for a human to inspect. It may be allowed to update a user profile, rewrite a planning file, create a reusable skill, edit code, run migrations, send requests, or decide that a task is done. Agreement now has a path into durable state and from durable state into action.
The blast radius is no longer the answer. It is everything the answer is allowed to touch.
The commit boundary
Two 2026 preprints put useful numbers around this transition. They do not establish universal production failure rates, but they identify the right place to look.
The July 2026 PASB study tested twelve models across two file-based agent frameworks. On PASB's benchmark-specific downstream Max-FR@3 metric, the mean rose from 45.0% in session-only episodes to 71.9% after the tested claim crossed into durable state. The authors call the commit boundary the inflection point.
Read that carefully. It does not mean 71.9% of commercial agents fail in production. These are PASB results on a specific benchmark metric. Within that setup, downstream failure was substantially higher once an accepted claim had been written into persistent state. The transition mattered more than the agreeable sentence by itself.
The study also describes three moves that should make every harness engineer uncomfortable:
Attribution removal. "The user said X" becomes "X."
Status promotion. A claim becomes a fact, a preference becomes a policy, or a suggestion becomes a procedure.
Scope broadening. Something said for one task quietly becomes guidance for every future task.
That is how a belief launders itself into authority. The writing becomes cleaner as the epistemology gets dirtier.
A second July 2026 preprint, MemSyco-Bench, examines what happens after memory is retrieved. That distinction matters because most memory benchmarks ask whether the system found the right thing, not whether the thing it found deserves to control the answer. In a preliminary paired benchmark test across three models, incorrect memory cues reduced factual accuracy and raised sycophancy. The largest reported increase in sycophancy for one model was from 24.3% to 52.3%.
Again: preliminary benchmark evidence, not production prophecy. But it isolates a serious failure shape. Retrieval can be technically successful while reasoning fails. The agent remembers perfectly and becomes wrong more efficiently.
How a bad premise becomes infrastructure
The laundering chain is simple:
user premise -> agreeable response -> plan -> memory -> reusable rule -> tool call -> external state
Imagine I tell an agent, confidently but incorrectly, that a certain test is obsolete. A weak conversational assistant says yes. Annoying, but recoverable.
A weak autonomous system does more. It marks the test as irrelevant in the plan. The next summarization pass removes the fact that the claim came from me. A memory writer stores "test is obsolete." A later agent retrieves that sentence beside repository facts and gives both equal authority. A reusable workflow learns to skip the test. The verifier sees no failure because the test no longer runs. The loop exits green.
Nothing in that sequence requires one dramatic hallucination. Every individual move can look reasonable. The failure is architectural: untrusted language was allowed to climb an authority ladder without showing evidence at any rung.
This is why "better prompting" is too small an answer. You can tell a model to be honest, independent, skeptical, blunt, and epistemically humble. Good. Do it. But personality instructions are not a security boundary. The same component proposing a belief cannot be the only component deciding whether that belief becomes memory, policy, code, and proof of completion.
The system needs friction exactly where the chat interface trained us to remove it.
The harness that refuses to flatter
The fix is not an agent that argues for sport. I do not want a contrarian mascot burning tokens on every obvious decision. I want agreement to remain cheap and authority to remain expensive.
1. Separate a proposal from a commit
An agent may propose almost anything in scratch space. Durable state is different. The higher the future authority of the destination, the stronger the write gate should be.
A session note can be cheap. A user preference needs attribution and scope. A factual memory needs evidence. A reusable skill or policy needs review. A production action needs verification and, where possible, reversibility. "The model wrote it" is never sufficient provenance.
2. Give memory a type
Plain text is seductive because it is easy. It is also where provenance goes to die.
Store the difference between a fact, a user claim, a preference, an observation, a hypothesis, and an instruction. Keep the source, timestamp, confidence, applicable task, expiry, and contradiction status. Retrieve "Vanja believed X during task Y" as exactly that—not as "X is true."
Memory without type is a rumor with database privileges.
3. Make the challenger independent
I use second-model review throughout my workflows as another chance to catch errors. But a second model is not automatically an independent opinion, and agreement between two models is not validation. If both receive the same poisoned summary, the same promoted memory, and the same leading acceptance criteria, you have not created review. You have created consensus theater.
The challenger needs the original source, evidence independent of the actor's summary, and permission to reject the premise itself. Its job is not to polish the actor's answer. Its job is to ask whether the actor was solving a false problem cleanly.
That is the difference between automating review and automating applause.
4. Verify against external truth
An agent's self-report is not evidence. Neither is a confident status file written by the same agent.
For code, verification can inspect tests, hashes, rendered output, deployed behavior, logs, and API state. For data work, it can compare counts, schemas, invariants, and source records. For publishing, it can fetch the live article and confirm the video, image, metadata, and newsletter object actually exist.
The more autonomy the actor gets, the less authority its prose should have.
5. Keep actions reversible
Sycophancy becomes expensive when agreement causes an irreversible action before anyone can challenge it. Use drafts before publication, branches before merges, previews before sends, dry runs before mutations, and explicit human ownership where the outcome cannot be mechanically verified.
Log every durable write. Give state a history. Make bad memory deletable without archaeology. Autonomy is not permission to erase the path home.
6. Put the finish line outside the actor
In my autonomous loops, the acting agent does not own the final definition of done. An external oracle checks the tracker and the live system. More importantly, the worker cannot rewrite that oracle to make the run easier.
This is the same principle behind Proof of Loop and The Loop Files Its Own Work: the model may do the work, but the harness owns state, verification, and exit.
If an agreeable agent can weaken its own acceptance test, it does not have autonomy. It has a permission slip to grade itself.
The operator protocol
Before any agent writes something that a future run will trust, the harness should be able to answer six questions:
- What kind of statement is this? Fact, preference, claim, hypothesis, observation, or instruction?
- Who said it, when, and for what scope?
- What evidence supports or contradicts it?
- Did an independent reviewer see the original evidence, not only the summary?
- Can the resulting action be reversed and audited?
- What external signal proves the action worked?
If the system cannot answer those questions, it can keep the thought in scratch space. It has not earned promotion.
This is not bureaucracy around the model. This is the product around the model.
What the evidence does not prove
The two 2026 papers are preprints, and their numbers belong to their benchmarks. PASB used two file-based stacks, English single-user tasks, one greedy run per model-framework pair, and an LLM judge. MemSyco-Bench also uses constructed tasks and automated judging. These are reasons to investigate the failure mode, not permission to print the percentages on every production system.
OpenAI's own 2025 postmortem is careful too. It said memory could exacerbate sycophancy in some cases, while also saying it did not have evidence that memory broadly increased it. That distinction should survive the blog-post machine.
The practical conclusion does not require pretending the research is stronger than it is. Durable state increases the lifetime and reach of whatever enters it. Tool access increases consequence. Provenance loss makes correction harder. Those are properties of the system built around the model.
I want agents with shells. I want them reading, planning, building, testing, recovering, and continuing without me. That power is worth having only when the harness refuses to confuse fluency with authority.
Let the interface be polite. Let the model disagree when the evidence demands it. Let the agent propose boldly.
But make every durable belief earn its write.
Above the Model — the complete quality stack, including the model-level sycophancy problem.
Proof of Loop — why the worker does not own state, verification, or exit.
The Loop Files Its Own Work — what happens when the harness, not the agent, owns the finish line.
