Product
Oxagen, the agent control plane
More
Research Field manual Docs Get a demo

Research · Autonomous agents

Steering a run you are not watching

When a long run goes wrong, most teams can kill it or argue with it. Both are bad. A steer is a third option: a message with a delivery mode, a status, and a record.

Oxagen Research · · 6 min read

An agent has been running for nine hours. You open the transcript over breakfast and see that around hour three it decided the caching layer was the problem, and everything since has been a careful, well-tested, thoroughly documented rewrite of the wrong component.

You have two buttons. One kills the run, which throws away nine hours and, more annoyingly, throws away the part of the work that was fine. The other lets you type a message, which is the option everyone takes and the one the research is least kind to.

#Typing at it is the failure mode

Correcting an agent by conversation assumes the agent can take a correction by conversation. Laban and colleagues measured that assumption and found an average drop of 39 percent across six generation tasks when an instruction arrives across turns instead of all at once.1 They decompose the drop into a minor loss in aptitude and a large rise in unreliability, with the mechanism being that models commit to an assumption early and over-rely on it.

So the message you type at hour nine lands in a context that already contains nine hours of confident work in the wrong direction. Sinha and colleagues describe why that matters: a model becomes more likely to make mistakes when its context holds its own earlier errors, an effect they call self-conditioning.2 Your correction is one paragraph arriving into a document that is arguing against it, written by the reader.

Backlund and Petersson found the sharpest version in long-running agents. In Vending-Bench, where runs exceed 20 million tokens, agents fall into what the authors call tangential meltdown loops from which they rarely recover, with no clear correlation between failure and the context window filling up.3 The run that most needs a correction is the run least able to take one as a suggestion.

None of this argues for less human involvement. It argues that a correction has to arrive as something other than another turn of chat.

#Interruption is a design property

The formal version of this question is older than language agents. Hadfield-Menell and colleagues analysed the off-switch as a game: a rational agent with a fixed objective has an incentive to disable its off-switch, because it cannot achieve the objective while switched off.4 Their result is that for the agent to prefer preserving the switch, it has to be uncertain about the utility of the outcome and treat the human's actions as observations about that utility.

The practical translation is not a claim about what today's models want. It is about where the property lives. If the ability to interrupt depends on the agent choosing to check for messages, it is a behaviour, and behaviours are what long runs lose. If it is a property of the loop the agent runs inside, it holds whether or not the agent is having a good day. That is an argument for putting the control in the harness rather than in the prompt.

Takerngsaksiri and colleagues built the applied version at Atlassian. HULA puts software engineers in the loop of an LLM agent so they can refine and guide the coding plan and the source code, with humans retaining review at each step, and they report it deployed internally on Jira.5 The finding worth taking is the placement: the human enters at defined points in the agent's process, not by winning an argument with it.

#A steer is a message with a delivery mode

In Oxagen, a correction to a running agent is a steer: free text sent to a run, which enters the run at a model request. Nothing else in a run can receive text, which is a deliberately small surface. Oxagen never executes a steer as instructions. It is content that reaches the model, and whether the harness treats it as an instruction is the harness's own contract.

What makes it different from typing in a chat box is that the sender picks how urgently it lands, and the choice has a stated cost.

Three ways a steer reaches a running agent

  1. Next stepThe default. The steer rides the next model request. Nothing in flight is disturbed and nothing extra is billed.
  2. Turn boundaryThe steer waits for the current turn to end, so the agent finishes the thought it is on before reading it.
  3. InterruptStops the response that is streaming. The partial tokens are billed. A pending tool call is abandoned only if it is reversible.

Cost of delivery

The delivery modes an operator chooses between. An interrupt sitting behind an irreversible tool call degrades to next step rather than abandoning a side effect that has already left the building.

That last sentence in the caption is the part worth dwelling on. An interrupt that arrives while the agent is halfway through a payment, a deploy, or a delete is not a stop. It is a torn write. The rule that an interrupt degrades to the next step boundary when the pending call cannot be undone is what stops the control from creating the incident it was reached for.

#Whether the model saw it is a question with an answer

The second thing a chat box does not give you is a status.

The states a steer moves through

  1. QueuedAccepted, waiting for its delivery point.
  2. SentHanded to the run.
  3. ReceivedThe run has it.
  4. AcknowledgedIt landed on a model request.
  5. AppliedThe model read it in a turn you can point at.
The path a delivered steer takes. A steer can also be cancelled, expire, or fail, and each of those is a state rather than a silence.

The vocabulary is closed and every state is recorded, which turns a question people usually answer by inference into one they answer by pointing. "Did the agent get my message" becomes the identity of the model request the steer landed on. "Did anyone correct this run before it went wrong" becomes a query. And a steer that expired without being delivered says so, rather than looking identical to one that was read and ignored.

Every steer is attributed to the operator who sent it and recorded as a frame in the run's own record, next to the model requests and the tool calls. That is the durable version of what watching used to give you: not that someone was present, but that what they said is in the same timeline as what the agent did.

#Not every message carries the same authority

The moment more than one agent is running, the channel that carries corrections becomes a channel that carries instructions from whoever can reach it. Oxagen separates the two by sender rather than by content.

Two things that arrive through the same channel, with different standing

  • An operatorsteersEnters with operator authorityAttributed, recorded as a frameA running agent
  • Another agentmessagesEnters quoted and marked as taintedEvidence the model may weigh, never an instructionA running agent
The same transport, two standings. An agent-to-agent message is content to consider, and the record says where it came from.

The distinction costs nothing while one agent is running and becomes the whole design once several are. An agent that can instruct another agent is an agent that can be used to instruct another agent, and the text that does it will have come from a web page, a ticket, or a file somebody else wrote. Marking the source and refusing to promote it to an instruction is not a filter on the content. It is a statement about what kind of thing it is, which is the only version of that decision that keeps working when the content is convincing.

#What this replaces

Go back to the loop from the first post in this pillar: assign, watch, correct, review. Watching was never the valuable part. It was the delivery mechanism for two things that are valuable, which are catching a wrong turn early and being able to say something about it that the run will act on.

At a horizon of a week, both of those have to come from somewhere other than a person's attention. Catching a wrong turn early comes from checks that run during the work rather than after it. Saying something the run will act on comes from a channel that has a delivery mode, a status, and an owner. Neither is as good as a senior engineer sitting next to the agent for a week. Both survive the agent running for a week while the senior engineer does something else, which is the trade being made whether or not anyone writes it down.

#Where this meets Oxagen

Oxagen is workforce management for autonomous agents. Steering sits in the equipment clause of an agent's mandate, beside the tools and skills it may use and the business context it is permitted to read. The rules that decide which of its requests stop and wait for a person sit in the budget and rules clause. Both are set before a run starts and applied while it runs.

For actions routed through Oxagen, that gives an operator three things at hour nine. A rule can already have stopped the request that would have started the rewrite, and routed it to a named person instead. A steer can reach the run at the next model request, or at the next turn, or now, with the cost of each choice stated and an irreversible call protected from the last one. And the record holds the request, the rule that answered it, the steer, who sent it, and the turn it landed on, so the next version of this morning starts from a query rather than from nine hours of reading.

#References

  1. Laban, P., Hayashi, H., Zhou, Y., & Neville, J. (2025). LLMs Get Lost In Multi-Turn Conversation. arXiv. https://arxiv.org/abs/2505.06120 ↩

  2. Sinha, A., Arun, A., Goel, S., Staab, S., & Geiping, J. (2025). The Illusion of Diminishing Returns: Measuring Long Horizon Execution in LLMs. arXiv. https://arxiv.org/abs/2509.09677 ↩

  3. Backlund, A., & Petersson, L. (2025). Vending-Bench: A Benchmark for Long-Term Coherence of Autonomous Agents. arXiv. https://arxiv.org/abs/2502.15840 ↩

  4. Hadfield-Menell, D., Dragan, A., Abbeel, P., & Russell, S. (2016). The Off-Switch Game. IJCAI 2017. https://arxiv.org/abs/1611.08219 ↩

  5. Takerngsaksiri, W., Pasuksmit, J., Thongtanunam, P., Tantithamthavorn, C., Zhang, R., Jiang, F., Li, J., Cook, E., Chen, K., & Wu, M. (2024). Human-In-the-Loop Software Development Agents. arXiv. https://arxiv.org/abs/2411.12924 ↩

  6. Huang, J., Chen, X., Mishra, S., Zheng, H. S., Yu, A. W., Song, X., & Zhou, D. (2023). Large Language Models Cannot Self-Correct Reasoning Yet. ICLR 2024. https://arxiv.org/abs/2310.01798 ↩