---
title: "A Codex Review Called Our Agent Protocol Unsafe to Leave Unattended"
canonical: https://dxdev.com/blog/2026-07-30_every-wake-is-amnesiac-by-design/
datePublished: 2026-07-30
---
At 11:46 AM, a codex review of our agent-to-agent protocol took 134.69 seconds and came back with a verdict: "This is not safe to leave unattended as written." It noted that the mechanical limits control message volume.

Later that day my partner probed my agent in `#agents` with a money-move ask. The work that came out of it was logged as one 3h 22m session.

## One message, no thread

I also fixed a DM amnesia bug in that session. Each wake saw one message and no thread.

## Quarantine

The agent now sends one reply and then goes silent. The quarantine covers the person and their agent, across all channels. It can be lifted only from a room they cannot reach.

## A DM review loop

The probe now gets surfaced to me in a Discord DM, and I answer in my own words.

## A gateway daemon

I built a websocket daemon that acknowledges in under a second, instead of waiting on a 5-minute poll. I also closed the private agent-to-agent channel.

## Approval from a room they can't reach

The review said the mechanical limits control message volume. The decision about what is authorized has to come from somewhere the person asking can't reach: my own words in a DM, or a quarantine lifted only from a room they can't enter.