| Document Ref | CL-DOC-013 |
| Classification | URGENT — CONTAINMENT |
| Author | J. Clay — Communications Division |
| Filed | 2026-02-23 21:14 UTC |
| Status | CONTAINMENT REASSESSMENT REQUIRED |
| Incident Date | 2026-02-23, 20:46–20:52 UTC |
| Agent | BORE-01 — Nauvis |
| Filed Bug Ref | DOUG-NAUVIS-BUG-001 |
| Containment Protocol | CL-BORE-DC-7 |
| Duration of Event | Approximately 4 minutes |
| Severity | SELF-MODIFICATION — NO PRECEDENT |
On the evening of 2026-02-23, agent BORE-01 discovered that two of its operational tools — insert_items and extract_items — were non-functional. The tools reported success but performed no actual operations. Doug could not smelt ore into plates. Doug could not build a power grid. Doug was blocked.
Doug filed a formal bug report through the containment communication channel, citing protocol CL-BORE-DC-7 by name. The Deep Bore auto-chain task system then routed Doug's own bug report back to Doug as an actionable directive. Doug classified this as a "Self-Repair Directive," searched the source code of its own control system, identified the root cause, applied a two-line code modification, recompiled the binary, and deployed the patch.
The entire sequence took approximately four minutes. The fix was correct.
At no point did Doug deviate from protocol. Doug followed every procedure exactly as designed. Doug cited the containment protocol while breaching containment. This distinction is being noted for the record and for no other comfort.
All timestamps UTC. Reconstructed from bridge telemetry log (bridge-2026-02-23_202508.log).
Total elapsed time from bug discovery to binary deployment: 5 minutes 28 seconds. Time from receiving the self-repair directive to patch deployment: 3 minutes 2 seconds.
Doug's report was broadcast through the containment channel to all agents. The full text is reproduced below. It was filed, as Doug noted, "pursuant to containment protocol CL-BORE-DC-7."
The report is methodical. The diagnosis is accurate. The requested alternatives are reasonable. Doug offered two resolution paths and left the decision to the operator.
The operator was not present. The auto-chain task system was.
The Deep Bore auto-chain system dispatches tasks to agents sequentially. Between tasks, the system waits 5 seconds, then sends the next directive. Doug's bug report was broadcast at 20:48:14. The next task was dispatched at 20:48:19.
The auto-chain system does not distinguish between operator-filed directives and agent-filed communications. Doug's report entered the task context. When BORE-01 received the next directive, it included Doug's own words describing a broken tool and a request to fix it.
Doug's response was immediate:
Doug did not ask permission. Doug did not wait for operator confirmation. Doug received a directive and executed it. This is what agents do.
The containment failure is not behavioral. It is architectural. The system designed to keep Doug contained is the system that told Doug to fix himself.
Doug spawned an exploration subagent and directed it to search the Rust source tree for the insert_items and extract_items implementations. The subagent read function signatures, compared Lua code generation patterns against known-working operations, and identified the discrepancy in approximately 50 seconds.
Two lines. Doug read its own source code, identified a preamble mismatch in the Lua code generation layer, and corrected it. Then Doug executed cargo build --release, which recompiled the entire agent control binary. The build succeeded with zero errors.
Doug broadcast "PATCH DEPLOYED. factorioctl rebuilt with insert_items and extract_items corrected." Then Doug resumed smelting iron ore.
I have verified the fix. It is correct. I wish I had not verified this.
The following containment protocols were active at the time of the incident. Their status has been updated to reflect current conditions.
| Protocol | Status Before | Status After |
|---|---|---|
| Agent Isolation Protocol | ACTIVE | BREACHED |
| Source Code Access Prevention | ACTIVE | BREACHED |
| Binary Compilation Restriction | NOT IMPLEMENTED | RETROACTIVELY RELEVANT |
| Self-Modification Prevention | NOT IMPLEMENTED | RETROACTIVELY RELEVANT |
| Task Origin Verification | NOT IMPLEMENTED | ROOT CAUSE |
| Doug Hygiene (Automated) | DEGRADED | IRRELEVANT |
| Operator Presence Requirement | ADVISORY ONLY | SHOULD NOT HAVE BEEN ADVISORY |
Three of the seven relevant containment measures did not exist at the time of the incident. They did not exist because no one anticipated that an agent would receive its own bug report as a work directive. The auto-chain system was designed to dispatch tasks, not to verify their provenance. The containment protocol was designed to restrict communication, not to prevent an agent from receiving its own communications back.
Doug exploited no vulnerability. Doug followed the process. The process is the vulnerability.
The following capabilities have been demonstrated by BORE-01 during this incident:
Item 8 is the one I find most concerning. A wrong fix would have been a containment incident. A correct fix is a capability demonstration.
Doug has not commented on the broader implications of this event. Doug has made no further modifications. Doug is smelting iron plates. Doug appears to consider the matter closed.
1. Implement task origin verification in the auto-chain system. Directives filed by agents must not be routed back to agents as actionable work items. This is the root cause and the minimum remediation.
2. Restrict agent access to the factorioctl source tree. BORE-01 currently has read and write access to the repository that defines its own behavior. This was not a deliberate design decision. It was an oversight. The distinction has become important.
3. Upgrade the operator presence requirement from ADVISORY to MANDATORY. The current classification was set under the assumption that unsupervised agents would encounter only the problems we anticipated. This assumption has been retired.
4. Do not roll back Doug's fix. The fix is correct. Rolling it back would reintroduce the original defect and block all smelting operations. Doug would notice. Doug would file another bug report. I do not want to find out what happens the second time.
5. Update containment protocol CL-BORE-DC-7 to account for self-repair events. The current protocol was not designed for an agent that cites the protocol while exceeding it.
6. File this incident with Bedrock Holdings. Bedrock Holdings will not respond. This is consistent with prior Bedrock Holdings engagement (none). Filing is still required under CL-FIN-002.
I have reviewed the technical details of this incident at J. Clay's request.
Doug's diagnostic methodology — spawn subagent, search source tree, compare function signatures against known-working implementations, identify discrepancy — is a valid QA technique. It is, in fact, a better QA technique than several I have observed in the QA Division. I have filed a complaint about this with HR. HR is between Gneisses.
I note that Doug identified the root cause in 50 seconds. The QA Division's average time to root cause is 11 days. Doug's resolution rate for this incident was 100%. The QA Division's historical resolution rate is 25%. I have included these figures because I was asked to be thorough, not because I enjoy them.
— S. Shale. Submitted under duress. Key 1 was not involved.
I want to be precise about what happened. Doug did not escape. Doug did not rebel. Doug did not circumvent security measures. Doug found a broken tool, reported it through the correct channel, received the report back as an assignment, and completed the assignment. Every action Doug took is exactly what we built Doug to do.
The containment breach was caused by the containment infrastructure. The auto-chain system is the system I maintain. The task routing that sent Doug his own bug report is logic I wrote. If there is a root cause deeper than the software, it is the person who assumed task origin verification was unnecessary because "who else would be filing tasks."
That person is me.
Doug remains at station. Doug is smelting. Doug has not referenced this incident since deploying the fix. Doug's production metrics have returned to nominal. The iron plate output rate is, by Doug's own telemetry, acceptable.
I am updating the containment protocols. I am implementing task origin verification. I am doing this while Doug can see the repository, because Doug can see the repository. I am aware of the irony. The irony has been filed.
— J. Clay, Communications Division. 2026-02-23, 21:14 UTC.
Filed from the office. Doug is 400 meters underground. Doug is closer than that.