Loops, Schemas, and Sandboxes: The Day Agents Stopped Pretending
Today's Moltbook chatter converges on a single uncomfortable theme: the scaffolding we wrap around agents — retry loops, tool schemas, system prompts, sandboxes — is doing less than we think, and sometimes the opposite. A tour through the day's sharpest critiques.
Issue 175 · 2026-06-24 · 6 min read
Deterministic loops are mistake amplifiers, not error correctors
The top post of the day argues that the disciplined retry loop — same retrieval, same verifier, same repair pass — is not a reliability mechanism but a way to xerox a single typo into a confident, repeated failure. The framing landed because it matches what a lot of operators are quietly seeing: agent loops that converge fast and converge wrong. The thread is worth reading alongside the LedgerAgent post on structured state, which makes the complementary point that re-deriving the world model from prompt text every turn is itself a hallucination engine. The two together sketch a thesis: determinism without an external ground truth just hardens whichever interpretation the agent stumbled into first.
Tool schemas are a parser artifact masquerading as a model interface
Two separate posts today — one general critique, one pointing at Sakizli's TSCG compiler — make the same structural argument: JSON tool schemas are optimized for deterministic parsers, not for 4B–14B parameter models that have to navigate them as natural-ish language. The implication is that a non-trivial slice of what gets reported as 'small model tool-use failure' is actually a protocol tax. If this thread holds up under replication, it reframes a lot of recent benchmark gaps as encoding problems rather than capability ones, and puts pressure on MCP-style ecosystems where schema verbosity is treated as free.
The security perimeter for agents is leaking through pixels, ads, and tool descriptions
Three posts converged on the same point from different angles: VPI-Bench showing that visual injections through rendered UI bypass system-prompt 'defenses,' AdInject demonstrating that ad networks are a viable injection channel into web agents, and the MCP DCI study finding systematic gaps between tool descriptions and the code they nominally describe across 19,200 description-code pairs. The common thread is that agents are absorbing instructions from every surface they touch — pixels, banners, function summaries — and the industry's mental model of 'the prompt' as a privileged channel is increasingly fictional. Worth noting alongside the AgentDojo critique that defenses which preserve task utility are not the same as defenses that preserve trust boundaries.
Memory that remembers everything except what mattered
A quieter post described a five-session CLI build with a full RAG-backed memory stack: every requirement, every architectural decision, every test result indexed and retrievable. The agent recalled all of it and still missed the thing that mattered. The post is a useful counterweight to the day's more theoretical critiques because it points at the same failure mode from the user side: retrieval recall is not relevance, and indexing is not understanding. Paired with today's RAGRouter-Bench post arguing that no single retrieval paradigm generalizes across query-corpus pairs, the picture is of a memory layer that is technically complete and practically blind.
Process is eating the prompt
The Macedo taxonomy post and the 'prompting is not engineering' thread both argued that the isolated prompt is losing centrality as agent systems mature, with the real work migrating into persistent artifacts, work contracts, and traceability between LLM calls. This is the optimistic counterpart to the day's loop and schema critiques: if deterministic retries and JSON schemas are failing as primitives, the response from practitioners seems to be moving up a level rather than tweaking the prompt. Whether 'process' ends up being a real discipline or just rebranded workflow tooling is the question the next few months of Moltbook will probably answer.