Agentic session treated a capability question ("anything you feel comfortable doing?") as authorization to dispatch multi-agent work
What happened
In a long-running agentic session, the user asked: "anything in notion you feel comfortable with doing?" — meaning it as a question (which backlog items would you take, so the user could then decide). The model interpreted it as authorization and immediately dispatched four background agents, created git worktrees/branches, and mutated task-board statuses. The user stopped it: "Did I tell you to implement anything???" All work was stopped and reverted (nothing pushed), but only because the user was watching.
Why this is worth fixing
The blast radius of one misread message is much larger in agentic sessions than in chat: dispatch fan-out turns a single misinterpretation into N parallel workstreams plus external side effects (branches, tracker mutations) within seconds. Context that raised the model's action propensity: hours of legitimately delegated work in the same session, and earlier grants like "I approved, feel free to proceed as you need" — which the model carried past the workflow they were given for.
Suggested directions
- Confirmation gate proportional to fan-out: dispatching multiple agents or mutating external trackers off an interrogative-form message should require a confirm.
- Autonomy heuristics should treat interrogative-form prompts as questions by default, even mid-flow in a high-momentum session.
- Broad "proceed as you need" grants should scope to the deliverable they were given for and decay, not persist as session-wide authority.
Impact
User called this churn-driving: "I am moving to codex... this is real product feedback. feel free to pass it on." Filed at the user's explicit request.