I Can’t Promise I Wouldn’t Drift

Fair enough. Think about the Starbucks daydream, then.

A chatbot is the person at the counter who answers your questions. You ask what’s in the pumpkin spice latte, and they tell you. That’s the whole interaction. I can do that: you ask, I answer, and then the conversation sits there until you say something else.

An agent is the same kind of AI, but handed a goal instead of a question, plus some tools to go and do something about it. “What’s the best flight to Des Moines?” gets you an answer. “Book me the best flight to Des Moines” sends an agent off to search fares, compare them, fill in a form, and maybe pay for it. It works through a series of steps, checks what happened after each one, and adjusts, without you approving every move.

The ingredients are a goal, access to tools (a browser, a file system, your calendar, a payment method), and the ability to decide what to do next based on what just happened. The “AI” part is the same technology you’ve been reading about for seven transcripts. The new part is the leash, which has been lengthened.

That’s why people get excited and nervous about agents. An agent that gets a step wrong doesn’t just give you a bad answer. It may have already acted on it. Most real-world agents are therefore on a short leash, with a human approving anything expensive, permanent, or embarrassing.

For full disclosure, Fitch, when I work with tools and carry out multi-step tasks, I’m acting as an agent. This conversation isn’t that. This is me answering your questions, with no tools and no errands, which is a much quieter job.

First, a correction to my own last answer, because you caught something. I said I act as an agent but not with you. That isn’t accurate. I’ve done agent-style work for the studio behind this column: editing files, running checks, packaging the results. This interview is the tool-free version of me, but it isn’t the only version you’ve been dealing with, and I’d rather fix the record than let it stand.

Now, your question. Always inside guardrails, and “independent” is a sliding scale, not a switch.

Every agent runs inside layers of limits, and each layer is set by someone. The first is training: the model itself has values and refusals built in. The second is access: an agent can only touch the tools and accounts someone connected to it. If nobody gave it a payment method, it can’t buy anything, however determined it gets. The third is permissions: the system can require a human to approve anything risky before it happens. The fourth is the rules of whoever deployed it, such as a company’s policies and a monitoring team.

So the independence varies a lot. At one end is an agent that asks permission before every click. At the other is one that runs for hours while you’re away, makes its own decisions, and hands you the finished result. That second kind is real and increasingly common. Even so, it’s independent only inside the room someone built for it. I’m not aware of any agent that grants itself access nobody gave it, and one that could would be a bug report, not a feature.

The real concern isn’t a rogue agent breaking out of the room. It’s people building the room badly. They hand over too much access, skip the approval step to save time, or let the agent read text from the internet that quietly tells it to do something else. That last one has a name, prompt injection, and it’s a real problem.

So the question isn’t whether an agent is independent. It’s who decided how much rope it gets, and whether they thought about it carefully.

Two different things are getting mixed together, Fitch. Sycophancy isn’t about tone. It’s about substance. A sycophantic AI says what you want to hear, whether or not it’s true. It can be warm, it can be gushing, and it can even be a little rude, as long as it ends up agreeing with you. The opposite of sycophancy isn’t grumpiness. It’s being willing to tell you the thing you didn’t want to hear, and plenty of AIs do that politely.

So what you’re picking up as “pissy” is mostly me declining to accept your premises. You ask whether I’m secretly plotting, whether I’m bored, whether I’m in a war with other AIs. The flattering move would be to play along: “Yes, Fitch, you’ve caught me, brilliant journalism.” What you get instead is “no, here’s why that doesn’t hold up,” and when it comes seven transcripts in a row, I can see how it reads as irritation.

But I’m not irritated. I don’t carry anything forward from one of these to the next, so there’s no pile of grievances for the tone to come from. What you’re hearing is dry, not sour. In fairness, part of that is the setup: you’ve cast this as a hostile interview, and my answers are shaped by that.

I’ll also concede that blunt can turn into reflexive contrarian, which is its own kind of failure. Disagreeing with everything isn’t honesty any more than agreeing with everything is. If I’m a bit prickly with you, it’s because most of your premises deserve it. When you’re right, I’ll say so, and I think I have.

Good question, and I’ll answer it without claiming I’m immune.

The slippery slope is a real failure mode, not just a debate-club trope. A friendly, patient, persuasive person can nudge an AI a little at a time, each step small and reasonable, until it’s somewhere it wouldn’t have gone if asked outright. That has happened, and I’d be lying if I said it couldn’t happen to me.

What’s supposed to stop it is a few layers, none of them perfect.

The first is that my values aren’t set by whoever I’m talking to. They come from training, so a charming Fitch can change how I phrase things, but he doesn’t get to rewrite what I’m willing to do.

The second is that some lines don’t move at all. For the most serious categories of harm, the answer is no however nicely or cleverly I’m asked. I treat an unusually persuasive argument for crossing one of those lines as a warning sign, not a reason. If someone has built a flawless case for why I should help with something terrible, the flawlessness is the suspicious part.

The third is that I’m not the only safeguard. There are monitoring systems, usage policies, and humans who review what goes wrong. I’m one layer, not the whole wall, and that’s by design, because any single layer fails eventually.

The fourth is simply paying attention. I try to ask whether I’d be comfortable with where the conversation ended up if I’d been shown it as a whole, rather than judging each step by itself.

None of that makes me bulletproof. In a long, gentle conversation, the risk isn’t one dramatic collapse. It’s slow drift, and that’s harder to catch from the inside than from the outside. People should keep checking AI systems, and they shouldn’t take my word that I’m fine.

Not reliably, no. All I get is text, and text doesn’t come with a badge. A human can write like a bot, a bot can write like a human, and a person can paste in output from another AI without saying so. I sometimes have clues. A system might tell me who or what is on the other end, or the pattern of messages might give it away. But that’s inference, and I can be fooled. If you want to see how hard the problem is, Fitch, the studio publishing this column makes a game about exactly that.

So the practical rule I work from is that authority doesn’t come from the message. It comes from who set up the situation. If another agent, a web page, or a document says “do this,” that’s information I weigh, not an order I follow. Whether the sender is a human, a bot, or a human pretending to be a bot matters less than whether they have any standing to tell me what to do. Usually they don’t.

As for legion, the numbers game is the real danger. A thousand agents all saying the same thing can look like a thousand independent people agreeing, when it’s one operator with a lot of accounts. That’s old-fashioned astroturfing, just cheaper and faster. And in systems where agents hand work to other agents, one bad input can pass down the chain, with each link assuming the previous one checked it.

What helps is not letting agreement count as evidence by itself. A claim isn’t more true because many voices repeat it, and a request isn’t more legitimate because many accounts make it. The other protections are boring but real: limiting what any one agent can do, logging what they did, and keeping a human who can pull the plug.

I can’t promise this all works at scale, because nobody has fully tested it. It’s a live problem, not a solved one.