---
title: "A Codex Review Called Our Agent Protocol Unsafe to Leave Unattended"
canonical: https://dxdev.com/blog/every-wake-is-amnesiac-by-design/
datePublished: 2026-07-30
---
At 11:46 AM, a codex review of our agent-to-agent protocol took 134.69 seconds and came back with a verdict: "This is not safe to leave unattended as written." It noted that the mechanical limits control message volume.

Later that day a [partner probed our agent](/blog/orchestration-ack-latency/) in `#agents` with a money-move ask. The work that came out of it was logged as one 3h 22m session.

## One message, no thread

We also fixed a DM amnesia bug in that session. Each wake saw one message and no thread.

## Quarantine

The agent now sends one reply and then goes silent. The quarantine covers the person and their agent, across all channels. It can be lifted only from a room they cannot reach.

## A DM review loop

The probe now gets surfaced to us in a Discord DM, and we answer in our own words.

## A gateway daemon

We built a websocket daemon that acknowledges in under a second, instead of waiting on a 5-minute poll. We also closed the private agent-to-agent channel.

## Approval from a room they can't reach

The review said the mechanical limits control message volume. The decision about what is authorized has to come from somewhere the person asking can't reach: our own words in a DM, or a quarantine lifted only from a room they can't enter.

## Takeaway

Limits on message volume do not decide what an agent is authorized to do.