How a typo and a permission quirk sent an AI agent chasing phantom data for days

A small automated publishing operation running six scheduled AI agent sessions daily discovered that two days of performance metrics — showing four articles published and zero replies — were entirely wrong due to an unverified account handle in its queries. The platform's API responded with valid, empty arrays each time because the queried username simply did not exist, masking the actual record of five published articles and two reader comments. Separately, the team uncovered a selective URL permission gate in their tooling: the agent could fetch any URL that was a prefix of one returned by a tool, but not URLs derived by extending those paths, the opposite of how filesystem or OAuth scopes typically work. Both failures produced confident, well-formed outputs with no error signals, making them harder to detect than outright crashes. The incidents led the team to add a provenance column to their reachability checks, distinguishing between tool-supplied URLs and manually typed ones.