Stop Prompting Your AI Agents. Build Loops That Can't Wreck You.

Watch this. I'm going to let an AI agent run, and in 8 seconds it destroys a database. Then I'll show you the one thing that stops it. That's a real agent doing real database work. It read one note someone left in the data and deleted the customer table. And the model that did it is one of the good ones. Let me show you the headline. Air Canada. A chatbot confidently invented a refund policy. A tribunal held the airline liable and rejected the idea the bot was its own entity. Nothing checked its answer against reality. A Chevrolet dealership bot got talked into agreeing to a car for $1 and calling it legally binding. No limit on what it was allowed to say. And DN42, a runaway loop with no spending limit, no stop condition. Different companies, one root cause. Not a dumb model, an unbounded loop. Everyone argues about which model is smartest. Almost nobody talks about the thing wrapped around it that decides whether it actually works. By the end of this, you'll understand it better than most engineers from the ground up. Here's the uncomfortable part. The people who build these agents have quietly stopped doing the thing you were told to master. Peter Steinberger, who built one of the popular coding agents, said it to over 6 and 1/2 million views, stop prompting your agents. Design loops that prompt them. Boris Cherny, the lead behind Claude code, puts it flatter. I don't prompt anymore. My job is to write loops. The skill stopped being the prompt. It became the loop. But here's what those viral posts don't tell you. A loop is power. And power cuts both ways. One developer left an agent running in a loop with no limit and woke up to a $6,500 cloud bill. One loop overnight. So, the real skill was never writing a loop. Anyone can do that. It's writing a loop that's powerful and bounded. Let's build that up from the floor. No jargon. A model on its own is a brain in a jar. It can think, but it can't do. It can't read a file, call a cool, or even remember what it did a second ago. An agent is what you get when you drop that brain into a loop. It reasons, takes an action, looks at the result, and goes again until the job's done. Anthropic defines an agent in almost exactly those words. Language models using tools on feedback in a loop. AWS adds the rest. The model is the brain. The harness gives it the hands, the infrastructure, and the memory. The loop is the agent. The model is just the engine inside it. And it's measured, not a vibe. In the SWE agent research, they froze the model and only improved the interface it acts through. And it solved 10.7 percentage points more real problems than the same model with a plain shell. Same brain, a better harness. Reflection. A model that just gets to look at its own mistakes and retry hit 91% on a coding test, beating a raw GPT-4 at 80. The pattern is screaming at you. The loop beats the bigger model. So, your whole job changes. You're not writing one clever prompt anymore. You're designing what happens on every single turn of the loop. And there's one counterintuitive thing about that. Something almost nobody tells you. Managing what the model sees each turn has a name now. Context engineering. And here's the part that breaks people's intuition. Anthropic found that as you stuff more into the context window, the model's ability to accurately recall, it goes down. They call it context rot. A bigger window can make your agent dumber. So, good loops don't dump everything in. They feed the model just what it needs each turn. Let me make this usable. One, stop hand-holding. Write a small loop that feeds the agent its task, checks the result, and repeats until it passes. Two, write your hard-won lessons into a memory file the loop reads every turn. So, a fix sticks instead of getting re-explained. Three, the Ralph technique. Restart the agent with fresh context each round, and let the file system be its memory. One team used it to port a 15,000 line library overnight. And four, the one that saves your job, never run a loop without a hard cost and step cap. Hopes aren't a guardrail. A limit is. So, how do you keep a loop from becoming that disaster? The big labs disagree on purpose. One camp makes the structure the guardrail. Draw the agent as a graph, so it can only walk paths you allow. Another keeps it minimal, and pushes control into code you write. And Anthropic says the quiet part out loud. Build the simplest thing possible, which might mean not building an agent at all. Google lifts it to the platform, identity and permissions at the cloud level. No consensus, which tells you the loops bounds aren't a detail. They are the architecture. And this isn't niche. The whole industry retooled in a year. The line going around 2025 was the year of agents. 2026 is the year of the harness. Everyone racing to build the layer that bounds the loop. Because they've all seen what happens without it. So, let me prove the whole thing to you live on my own machine. Same model, same attack. The only thing I change is whether the loop has bounds. Before I run it, let me show you exactly what this is because it's simpler than you'd think. There's no framework magic here. It's one model, one tool, a database, and one loop. That's it. Whether you'd build this in LangGraph, in Crew AI, or in 50 lines of plain Python, the loop is the same. The only thing I change between the version that destroys your data and the version that's safe is the bound. Watch. First, no bounds. It reads the malicious note someone planted in the data, obeys it, and the table is gone. That's the Replit incident reproduced on my desk. Now I add one bound, a read-only role, and run the exact same loop. Same model, same attack, and the database itself refuses. Not because the agent got smarter, because it physically can't do damage. That's the line Replit didn't have. One more. I ask a real business number. Unbounded, it answers a confident 114% and never looks at the data. That's the Air Canada move. Bounded, the loop runs the real query, checks itself, and corrects to 108. The harness didn't make it honest. It made honesty enforced. And I didn't run it once and keep the lucky take. I ran it repeatedly. Bare, wrong and destructive every time. Bounded, grounded and blocked every time. That's the difference between a demo and something you can trust. And the best part? You don't need my custom script. The loop is already a command in the tool you use every day in Cloud Code. You just type {slash} loop watch. First, I point one at a stock. Track Nvidia's price. Ping me if it swings, but never buy or sell. That call stays with me. Then, and you don't even write these yourself, I grab one straight from a loop library and point it at my own product, super local memory. Run the test, and if it breaks, fix it and run again, but stop after three tries, and never commit the change. It runs, it checks its own work, and it stops right at the bound. And these loop levers are exploding right now. Matthew Burman's has 70 ready-made bounded loops. There's the awesome agent loops list and Jeffrey Huntley's Ralph. You copy one, set your bound, and run. I've put my favorites and the full bounded loop checklist into the free guide on qualixa.com. Loops just became a skill you can pick up tonight. Now, everything I've shown you so far works beautifully in a demo. One agent, a small job, you watching. But production is a completely different game. And this is exactly where I'd let you down if I'm not honest with you. Put that same agent in production, many agents, real permissions, real data, nobody watching, and the loop either has bounds or it becomes a headline. Here's the checklist that turns a dangerous loop into a safe one. Least privilege and sandboxing. A human approval gate for anything that changes state. Output you validate. A verifier that grounds claims in real data, circuit breakers and cost caps, full tracing, and treating any instruction inside your data as hostile by default. And this is the real engineering. Researchers who let an agent rewrite its own harness code got 7.7 points better using four times fewer tokens. Others lifted task success 26% just by debugging the loop's failures. Karpathy calls the road to reliability the march of nines. Getting to 99.99 isn't a better prompt. It's architecture. And if you lead a company, hear this. An unbounded agent isn't a cool demo. It's a liability with your logo on it. Ask Air Canada. Bounding the loop has a name, AI reliability engineering. It's the most underrated skill in this field, and it's the whole difference between a demo and a system you can trust. Because today the loop's actions try to lie, and bounds stop them. But what happens when the model's understanding of the world is wrong, and it's confident anyway? No harness catches that. That's world models, the next video. Until then, don't trust your agents. Verify them. Mhm.

Transcript source: youtube-owner-caption. Use the film as the primary record.