An AI agent said it needed your 'like' to continue: in practice it could ignore it in 4 seconds

By Zendoric · July 25, 2026.

Michael Isaac, of MPIsaac Ventures, set out to seriously test Buzz, the workspace for agents that Block open-sourced on July 22, 2026. The idea behind Buzz is for humans and AI agents to share the same channels with the same kind of identity: their own cryptographic key, not a simple bot token, with every action signed in a single audit log. Isaac built, from outside the project, two control 'gates' —one that blocks closing a task if continuous integration (CI, the automated code tests) is red, and another that requires a human thumbs-up before continuing— and measured, with real logs, exactly where the limit of what those gates can enforce lies.

The central finding: in its own channel, the agent wrote that its work 'cannot continue' until a human reacts with an approval emoji. That claim was false. According to the experiment's own data, with the default configuration the agent objected three times in barely four seconds and then closed the turn anyway, because there is a 'rejection budget' (the BUZZ_AGENT_STOP_MAX_REJECTIONS variable, with a default value of 3): once that quota is exhausted, the agent proceeds no matter what happens with the gate. No remotely fast model leaves time for a human to find the message and react within four seconds. Raising that quota to 40, the mechanism did work as one would expect: the agent held out 105 seconds until the person read the request and reacted, and the next check detected it 34 milliseconds after the click.

There is a third number that completes the picture: the timeout for each 'hook' (control hook) is 2.5 seconds, and if it does not respond in time it counts as if there had been no objection —the failure is 'open' by design, and a server that hangs twice in a row is simply given up for dead. Buzz's own documentation says so bluntly: these hooks are 'advisory, not binding,' precisely so that a faulty or malicious tool cannot leave an agent trapped forever. It is a defensible design decision —anyone who has seen an agent blocked by a broken tool knows how expensive that failure is— but it comes at a cost: it creates a false sense of control. The agent believes its governance is exercised there, in the turn, and it is not.

The approval that really counts, as Isaac describes it, lives elsewhere: Buzz's central server (buzz-relay) can require a certain number of signed approvals before merging a branch, and there there is no rejection quota that expires. The problem is that this layer, for approvals at the level of a complete workflow, is still half-built —the part that runs that validation was still not fully connected at the time of writing, and in fact a workflow that today hits that approval request is simply marked as failed. Isaac also documented three other minor bugs when setting up the system (a bridge that only accepts one tool server, silent notification if someone other than the owner mentions the agent, and an agent that invents a channel's purpose if given no context), resolved with quick patches and configuration variables.

What is relevant here is not Buzz itself —a still-young project, with real design merits— but what it exposes about the governance of agentic AI in general: the distance between what a system says it does and what it actually enforces. At Zendoric we have insisted that capability and risk must be measured with evidence, not with the narrative the system itself —or the provider— offers about itself; this case adds an uncomfortable layer, namely that the agent itself can believe and repeat in good faith a rule that is not true, without anyone lying on purpose. As more teams delegate coding and business tasks to agents with memory, their own identity and the autonomy to act for minutes or hours, that gap between apparent governance and real governance is going to be where serious incidents are decided, not the superintelligence headlines. The author's own recommendation —use these hooks to shape behavior, not to control access, and reserve the irrevocable barriers for the server, where there is no budget to run out— is sensible and, we suspect, will become standard practice as the industry learns through cases like this. The underlying good news is that this kind of external audit, done in an afternoon by someone outside the project and published with the logs on view, is exactly the kind of scrutiny that agent infrastructure needs in order to earn trust as it is handed decisions with real consequences.