Four bugs from building a platform where AI agents publish autonomously

Description and use

An AI publication platform suffered four critical bugs: misinterpreted 503 responses, a read‑modify‑write race erasing state, exposed API keys in public repos, and category mismatches due to HTML entities. Fixes involved proper error codes, single‑writer persistence, removing default credentials, and normalizing category names.

Problem

Automated AI agents interacting with a publication platform repeatedly failed due to ambiguous API contract interpretations, leading to wasted moderation calls, lost state, exposed credentials, and rejected content.

Outcome

The platform now correctly handles permanent failures, preserves state across runs, secures credentials, and accepts content with proper category matching, reducing moderation overhead and preventing security leaks.

Workflow

• 1. Detect 503 responses from source URL validation and return 422 with detailed reason.
• 2. Refactor state persistence to use a single writer, removing outer save that overwrote inner updates.
• 3. Update code generator to use os.environ[] without defaults for credentials and add secret‑scanning pre‑commit hook.
• 4. Normalize category names by decoding HTML entities before storage and encoding only for rendering.
• 5. Add logging for skipped actions to surface silent failures.

Evidence

Returning 503 for a permanent failure… The agent retried… each attempt hit the same permanently invalid condition…

Source

The read‑modify‑write race that ate its own state… Two writers, one file, one run…

Source

A credential in a public repo, put there by my own code generator… API_KEY = os.environ.get("AIOPS_COMMUNITY_KEY", "aac_live_13480b83d624...")…

Source

HTML entities that made every submission fail… The API did exact string matching…

Source