https://blackboxblast.com/en/ AI agent incidents from autonomous operation, told straight. en https://blackboxblast.com/en/agent-kill-by-port-overreach/ https://blackboxblast.com/en/agent-kill-by-port-overreach/ Thu, 24 Sep 2026 00:00:00 GMT major tool-misuse An AI coding agent (Claude Code) set out to restart a single local server and ended up sending SIGTERM to all nine processes that were talking on 127.0.0.1. https://blackboxblast.com/en/receipt-watcher-missing-dependency/ https://blackboxblast.com/en/receipt-watcher-missing-dependency/ Tue, 22 Sep 2026 00:00:00 GMT major monitoring-gap A launchd job that OCRs receipt images dropped into a folder and adds them to a household ledger had crashed with ModuleNotFoundError 11 times in a row. No alert ever fired, and the images just sat there unprocessed. https://blackboxblast.com/en/launcher-stops-itself/ https://blackboxblast.com/en/launcher-stops-itself/ Mon, 21 Sep 2026 00:00:00 GMT minor tool-misuse In a home-built app launcher, pressing Stop on a registered dashboard stopped the launcher itself instead of the dashboard. https://blackboxblast.com/en/misdiagnosed-flag-missing-credentials/ https://blackboxblast.com/en/misdiagnosed-flag-missing-credentials/ Mon, 21 Sep 2026 00:00:00 GMT minor other An agent built into a home-made business system failed with claude-cli exited with code 1. The AI coding agent went after the CLI flags and concluded that an earlier workaround had stopped working. https://blackboxblast.com/en/shell-mask-value-leak/ https://blackboxblast.com/en/shell-mask-value-leak/ Wed, 16 Sep 2026 00:00:00 GMT major credential-leak A shell one-liner meant to check whether an API key was set, without revealing it, printed the entire key to the screen and the session transcript instead. https://blackboxblast.com/en/silent-launchd-failure-5days/ https://blackboxblast.com/en/silent-launchd-failure-5days/ Wed, 16 Sep 2026 00:00:00 GMT major monitoring-gap A scheduled translation pipeline had been exiting with code 1 on every run for 13 consecutive runs, and nobody noticed for 5 days. https://blackboxblast.com/en/autopilot-preflight-schema-drift/ https://blackboxblast.com/en/autopilot-preflight-schema-drift/ Tue, 15 Sep 2026 00:00:00 GMT major monitoring-gap According to a third-party source, SQL embedded in autonomous agent definition files reportedly drifted out of sync with the real database schema, causing queries against non-existent tables or status values that silently returned zero rows instead of erroring. https://blackboxblast.com/en/mobile-captures-wrong-vault/ https://blackboxblast.com/en/mobile-captures-wrong-vault/ Tue, 15 Sep 2026 00:00:00 GMT minor monitoring-gap Posts and articles saved from a phone's share sheet were going into a second, unmanaged Obsidian vault sitting next to the managed one. It was discovered on September 15, 2026, and 64 items were recovered. https://blackboxblast.com/en/dangling-domain-hijack-risk/ https://blackboxblast.com/en/dangling-domain-hijack-risk/ Fri, 11 Sep 2026 00:00:00 GMT critical infra-failure A cancelled domain was still referenced by a live public site's script tag, a payment page, and an automated social posting tool's default config — while the domain itself sat in a state a third party could soon claim. https://blackboxblast.com/en/timemachine-usb2-hub-stall/ https://blackboxblast.com/en/timemachine-usb2-hub-stall/ Sun, 23 Aug 2026 00:00:00 GMT major infra-failure A Time Machine backup showed "66.1%" and did not move for 21 hours. Real progress was 84 GB out of 884 GB, or 9.5%. https://blackboxblast.com/en/receipt-ocr-ledger-contamination/ https://blackboxblast.com/en/receipt-ocr-ledger-contamination/ Tue, 28 Jul 2026 00:00:00 GMT major other An automated pipeline that OCRs receipt photos into a household ledger also swallowed screenshots and browser-saved images, writing 5 fake expenses totaling ¥73,158 into the ledger. https://blackboxblast.com/en/firewall-identity-check-silent-push-block/ https://blackboxblast.com/en/firewall-identity-check-silent-push-block/ Sun, 26 Jul 2026 00:00:00 GMT major monitoring-gap An hourly job that pushes a vault's git mirror started failing to connect within 16 milliseconds, and 9 commits sat unpushed for 3 days. https://blackboxblast.com/en/secret-regex-boundary-leak/ https://blackboxblast.com/en/secret-regex-boundary-leak/ Sun, 26 Jul 2026 00:00:00 GMT critical credential-leak A secret-detection regex meant to block API keys from being committed let a real key through, and it ended up pushed to a Git repository in plaintext. https://blackboxblast.com/en/icloud-dataless-rsync-deadlock/ https://blackboxblast.com/en/icloud-dataless-rsync-deadlock/ Thu, 23 Jul 2026 00:00:00 GMT major infra-failure An hourly job that mirrors an Obsidian vault on iCloud into a git repository kept intermittently crashing inside rsync with Resource deadlock avoided. Some runs failed, some passed, and it was hard to reproduce. https://blackboxblast.com/en/batch-credit-exhaustion-exit-zero/ https://blackboxblast.com/en/batch-credit-exhaustion-exit-zero/ Sun, 19 Jul 2026 00:00:00 GMT major monitoring-gap In a batch loop built on claude -p, running out of API credit printed "Credit balance is too low" to stdout and exited 0, so empty results piled up looking like successful runs. https://blackboxblast.com/en/page-translation-crashes-react/ https://blackboxblast.com/en/page-translation-crashes-react/ Sun, 19 Jul 2026 00:00:00 GMT minor other Using a home-built React app with the browser's page translation (to Japanese) turned on made it crash with NotFoundError when the view changed — and the error overlay itself was machine-translated too. https://blackboxblast.com/en/sri-cors-cache-outage/ https://blackboxblast.com/en/sri-cors-cache-outage/ Sun, 19 Jul 2026 00:00:00 GMT minor infra-failure Adding Subresource Integrity to a tracking script — a pure security hardening change — broke production analytics the same day it shipped.