F4 · Ambient agent

Principle

The agent is triggered by an event, not by a user request. It works in the background and only involves the human to notify, ask a question or get approval. It needs durable execution with checkpoints, long-term memory, persisted approvals, observability and guardrails.

The problem it solves

An assistant that waits to be asked does not handle what happens outside conversations; it has to react to events on its own.

When to use it

• Background tasks triggered by events, with an automatic oracle to check the result (tests, for instance): background agents that open pull requests.
• The human only needs to step in at chosen points: notification, question or approval.

When to avoid it

• There is no automatic oracle: without one, long autonomy stays fragile. Keep a human in the loop (F1).
• Durable execution, persisted approvals and observability are not in place.

Common pitfalls

The anti-patterns that misuse this pattern, best established first. Each sheet describes the symptoms, the public incidents and the remedies.

Framing and choice of level

• AP08 · Demo-driven autonomy — One successful demo is enough to put the agent into autonomous execution, with no intermediate stage.

Context and memory

• AP33 · Unvalidated memory writes — The agent remembers what it reads, including orders slipped into a document, and later rereads them as facts.

Loop, stopping and orchestration

• AP44 · Big-bang agent deploy — A new version replaces the old one in one go, right in the middle of the agent sessions that relied on it.

Security and permissions

• AP59 · Unsupervised lethal trifecta — One agent reads untrusted content, touches private data and can send things out, with no one approving.
• AP61 · Third-party content acting with the principal’s rights — The agent acts with the rights of whoever launched it, on text written by a less privileged third party.
• AP66 · Confirmations disabled outside a sandbox — The agent runs with no confirmations at all on a machine that holds secrets and keeps open network access.
• AP71 · Imperative goal and unsupervised irreversible actions — A goal to reach at all costs, irreversible actions, and no one to approve them.

Oversight, operations and governance

• AP75 · Flying blind — In production with no step-level traces: no way to replay a session or tell where it failed.
• AP76 · Agent narrative as audit trail — You know what the agent says it did, not what it did: no independent log to investigate from.
• AP78 · No kill switch, no blast-radius cap — No way to stop a given agent in one step, or to limit how many actions it chains.
• AP79 · Shadow and orphaned agents — Agents that are published, shared or forgotten, and that nobody monitors, caps or can revoke.

All anti-patterns

Synonyms by vendor

• Ambient agents (LangChain)
• Background agents (Cursor, Devin, Codex)

Neighbouring patterns

• F1 · Human in the loop
• E9 · Message bus
• E8 · Agent teams on a task queue
• C1 · Agent loop (ReAct)
• D6 · Long-running harness

Sources

• Introducing ambient agents — LangChain (H. Chase), 2025-01-14
• Devin annual performance review 2025 — Cognition, 2025-11-14
• Rakuten (étude de cas client) — Anthropic