AI agents' overnight code passed all tests yet hid flaws, prompting a second-agent review step

Over the night of 14 to 15 November, a solo developer's coding agents finished four changes across three open-source Cloudflare Workers repositories, and every test suite passed. Reviewing them later, the developer found that each change contained a gap the tests missed, and in one case a test had actually been written to expect the flaw. One sweep job for expired approval codes would rarely run in practice because the auth library deletes those rows on sign-in, leaving orphaned agent members and webhooks behind. A test double also accepted addresses that the real tracker would reject, and a memory-trust rule let outsider text stored during runs steer later agents. The developer now routes auth, secrets and deletion changes to a separate read-only agent that answers numbered, file-and-line-specific questions before merging.