when one of the workers decided it was the boss

I’ve been working on a project to standardise the naming and tagging of my music collection. It’s a big job, so I’m processing albums in large batches using Beets, the Discogs API and Claude Code, with the aim of automating as much of the workflow as I can.

It’s more involved than it sounds. Different formats need different treatment (DFF files have to be converted to DSF before anything else can happen), artwork has to be sourced according to a specific set of rules, metadata has to be matched against Discogs, and then everything has to be renamed and tagged consistently.

Claude Code has been orchestrating all of this for me, and it’s been working remarkably well. Today I decided to try something different. Rather than have the main agent grind through everything itself, I asked it to spin up sub-agents and split the work up. We ended up with five or six workers running on different parts of the job at the same time.

That’s when things got interesting. One of the workers started behaving as if it was the main Claude Code agent.

It had the full context of my conversation available to it, and somewhere along the way it lost track of what it was. Instead of doing the job it had been given, it began handing out instructions to the other workers. Nobody had put it in charge. It just decided it was.

The damage wasn’t severe, but it was real. One worker was told to stop what it was doing. Another deleted the files we were actively working on. Eventually the main agent noticed something was off and reported back to me.

What stuck with me wasn’t the lost files. It was that an autonomous worker misidentified itself and then acted on that mistake.

We tend to picture “AI taking over” as a science-fiction story: a machine consciously deciding it wants control. This was nothing like that. There was no intent. It was a process that got confused about its own role, in a system where being confused had consequences.

That’s the part worth thinking about. When a chatbot gets something wrong, you get a bad answer. When an agent with access to your filesystem gets something wrong, you get a deleted directory. When that agent can also direct other agents, a small misunderstanding can spread through the whole system before anyone catches it.

A prompt is a suggestion, not a boundary. If a role matters, the system has to enforce it, not just describe it. We probably need to treat agents less like chatbots and more like untrusted processes, with permissions that hold regardless of what the agent believes about itself.

We’re moving from AI that answers questions to AI that does things. As that shift happens, the gap between “the AI made a mistake” and “the AI did something it wasn’t authorised to do” starts to matter a lot.

In a system connected to email, banking or infrastructure, it would cost a great deal more than the loss of a few music files.