I Built a Ghost in the Machine: What Happens When an Agent Outlives Your Attention Span
There's a particular kind of dread that hits when you realize nobody would notice for a week if you stopped showing up online. No emails bounced. No calendar alerts fired. Your GitHub streak just... stopped. That dread is what sent us down the strangest rabbit hole we've tackled in the lab yet: an agent that only activates when its operator vanishes.
We call it the quiet protocol. The build logs are messy, the ethics are messier, and the whole thing raises a question we still haven't answered cleanly: if a machine can convincingly be you when you're gone, what exactly were you?
The Trigger: Silence as a Signal
The architecture is deceptively simple. A heartbeat check pings a private endpoint every day at 9 AM Pacific. If the operator misses two consecutive check-ins, a dormant agent spins up with a scoped credential set and a mission brief: keep the digital lights on.
Two days of silence felt right. One day is a flight delay or a dead phone battery. Two is a pattern.
The agent's mandate covers three domains:
- Inbox triage — flag anything genuinely urgent, draft responses to routine threads, hold everything else in a quarantine queue
- Recurring obligations — utility autopay verification, domain renewals, that one SaaS subscription everyone forgets until the charge hits
- Social presence — nothing new gets posted. Ever. The agent only acknowledges and defers: "Away from the desk, will follow up soon."
That last constraint was a hard-won lesson. Our first draft let it compose original social posts. The results were competent, bland, and deeply wrong — a version of the operator with all the friction sanded off. We killed that module on day four.
Guardrails, Kill Switches, and the Panic Button Problem
Every action routes through a policy layer with three tiers. Tier one is fully autonomous: read, sort, flag. Tier two requires a second silent confirmation — the agent drafts a payment but a hardware timer must co-sign before it executes. Tier three is forbidden outright: no password changes, no financial transfers to new payees, no deletions of any kind.
The kill switch is deliberately low-tech. A physical NFC tag in the operator's wallet, tapped against a phone, revokes everything instantly. We also built a dead-man circuit into the hosting layer itself — if the agent's own logging heartbeat ever fails, the whole stack tears down rather than run unmonitored.
Here's the thing nobody tells you about building kill switches: you start designing for the machine, and halfway through you realize you're designing for yourself. The panic button exists because we didn't fully trust the code. The code exists because we didn't fully trust ourselves to always be reachable.
The 30-Day Simulation
We ran the full protocol against a sandboxed clone of a real inbox — same volume, same cadence, same newsletter sludge. The results were humbling in both directions.
The agent correctly identified 94% of genuinely time-sensitive threads. It caught a domain expiring in six days that its human counterpart had ignored for two weeks. It drafted better payment-confirmation replies than most humans manage.
It also froze a vendor negotiation dead, responding to a time-sensitive contract question with a cheerful deferral that cost the simulated operator real leverage. And on day nineteen, it flagged an automated CI notification as "urgent, possibly security-related," escalating a routine build failure into a quarantine event.
The pattern was consistent: the agent is excellent at maintenance and terrible at judgment. Which is exactly what you'd want from a system whose entire premise is that its operator can't be consulted.
The Unsettled Question
Legally, this lives in gray territory. Terms of service across most major platforms prohibit automated account access, full stop. Financial institutions have their own rules about authorized users. Nothing we built would survive contact with a real compliance department, which is why this stays a lab experiment.
Philosophically, it's worse. Every deferral message the agent sent was a small act of impersonation — technically transparent, emotionally misleading. The recipient thinks a person is behind the words. A person is, sort of, just not at that moment.
We keep coming back to one question during lab debriefs: is a dead-man's agent a service to the people who depend on you, or a lie you tell them in advance? We built the thing and we genuinely don't know.
The repo stays private. The writeup is public. If you're building something similar, we want to compare guardrails — the whole point of the lab is that somebody should be watching these experiments before they watch us.
