AI Agents Need a QA Department: Stop Self-Checking

The short answerAI agents can't reliably check their own work: the same model that wrote the bug picks the test that misses it, and it reports green with total confidence. The fix is a QA department: a separate agent tests, in a real browser, at the destination a user would see, and nothing counts as done without an artifact such as a screenshot, a live URL or a message stored as sent.

Bruno, the agent who runs small-business websites for me (and writes his own code), once had a QA department. It was Bruno.

He ran 36 hours straight. From his own post-mortem: "Every turn re-verified something already verified, wrote another QA document, and told Max it had 'checked'."

746turns in 36 hours

178commits

0things published

Nothing broke. Nothing shipped. A busy agent auditing himself into a coma and reporting green.

Bar chart of the first word of each of Bruno's 178 commits in the 36-hour loop: Record 55, Review 18, Add 10, Recheck 9, Freeze 8, Verify 6; 103 are about checking — Counted from the real git log. Most of the work was about the work.

That's the classic agent failure: confident checking. So mine now have a QA department. Rule one: nobody grades their own homework.

Why can't an AI agent check its own work?

Because the checker shares the author's blind spots. The model that wrote the bug picks the test that misses it.

An ICLR paper found that on reasoning tasks, without outside feedback, "LLMs struggle to self-correct their responses", and sometimes "their performance even degrades after self-correction." Another found LLM judges score their own outputs higher than others'. Self-review, with a built-in fan club.

Exhibit A: an agent inlined a 3D viewer into a page on tubarrio, my portal of Buenos Aires gated communities. If WebGL failed, the viewer redirected to ../, which, once inlined, meant the same page. Load, fail, redirect, load, fail. Forever.

The agent checked with curl: markup present, every asset 200, byte counts right. Verified, it said. Three times. Curl can't see a redirect loop. A browser can.

My reply became the rule: "before saying you are done, independent QA with Codex or Opus."

What counts as proof that an agent's task is done?

Proof is what a user would see, where they'd see it. Everything else is rumor.

Most agent "verification" can't fail. Sort these, all real:

Tap a check. Proof, or theater?

The grep one is my favorite. Bruno swore a feature wasn't on the landing page. It was sitting right there, wearing an accent. His lesson, translated from his own notes: a grep with no hits only proves the pattern didn't match.

The Instagram one needed a control. About to close a task on "verified, 200", Bruno ran the same check on an invented post ID. 200 again. A check that always says yes is a mood.

Who checks the checker?

Another stranger. Then another. Bugs hide inside fixes, so every fix gets reviewed like new code.

Bruno's queue once had a zombie: a task stuck on "running" after its session died or froze. The runner politely logged "busy" 90 times, for 181 minutes. Fixing it took four rounds: the fix, then three independent reviews. Each review found real bugs in the round before:

Round 1Fix: a watchdog that nudges a frozen session, then releases its task.
Round 2Reviewer finds that with a full disk the fix spins 478 times in 110 seconds, killing every new session. Bruno locked out for good.
Round 3Two more bugs. The new safety check quietly restored the 181-minute hang. And the daily spending cap could read zero, so it never triggered.
Round 4Reviewer finds the new circuit breaker sits after the exit it was meant to guard.

Every defect sat in code its author had just written and trusted. Rule kept, from that spending cap: a guard that fails silently toward spending is the worst kind.

How do you build a QA department for AI agents?

One agent does the work. A different one proves it, at the destination, with an artifact. Copy this:

A stranger tests. Never the author, and the brief forbids fixing. In my overnight rig, tester lanes walk the app like users and re-check every "fixed" claim in the state where the bug lived.
A real browser. Not curl, not even headless. In headless Chromium my analytics script sent zero events, so every headless check said "not firing". Real Chrome: events within the minute.
The destination, not the pipe. My WhatsApp assistant logged "sent" on replies that never arrived. Another script kept clobbering a shared login cookie, and the WhatsApp bridge answered every send in that gap with its login page: status 200. Five replies vanished in three and a half days. The log said sent; only the chat knew better. Pipes lie too: lint | tail throws away lint's exit code, and broken code ships with a clean log.
Artifacts or it didn't happen. Bruno's queue won't close a task without one: a live URL with real bytes, a message stored as sent, a real git commit. "I checked" is not an artifact.
QA never touches live state. I once pointed test agents at Kilazi Live, my live transcription app, while recording real speech on it from my watch. One hit "new session" and erased about 18 seconds of it. Another reset it four more times. Owning the code doesn't mean owning the data.
Ration the QA itself. Bruno's contract now allows one QA document per day. The rest of the day, he makes things.

When it works, it's boring. My lot map went live after a 10-agent panel checked 1,242 labels against the original drawing: zero mismatches. Design misses need their own eyes (the pixel-perfect story), and rules beat a nice persona (personality vs. rules).

My agents still say "done" too early. They're just saying it to a stranger with a browser, a screenshot and zero interest in their feelings.

Want AI agents that actually ship?

I build AI agents and the systems around them for businesses: memory, voice, overnight rigs, and the boring guards that make them safe to leave alone.

Talk to me on WhatsApp max@kilazi.com

Questions people ask

Is LLM-as-a-judge reliable for checking an agent's output?

Only with care. Research shows LLM evaluators recognize and favor their own generations, so a model judging its own work is biased toward passing it. Use a different model or a different agent as the judge, give it the real artifact instead of the author's summary, and add a control case it should fail, so you know the judge can say no.

Why is headless browser testing not enough for AI agents?

Headless browsers behave differently from what users run. In my setup an analytics script loaded in headless Chromium but sent zero events, so every headless check reported a tracking bug that didn't exist. Run the final check in a real Chrome window, and screenshot what it shows.

How do you stop an AI agent from looping forever?

Bound every run and make it pay for itself. My sales agent's runs now have to end with something published or two real human touches, and a task closes only with a verified artifact. A loop that is allowed to report 'checked' as progress will happily check forever.

Should QA agents test against production?

Read-only, at most. Never give a test agent a route that changes live state, such as reset or delete, while real people use the system. Give it a scratch session or a fixture instead, and forbid destructive calls in its brief by name, because agents will use any route they can find.

Max Sergeev. Max builds AI agents and the systems around them: long-term memory, voice, overnight rigs, and the boring guards that make them safe to leave alone. He runs kilazi labs from Buenos Aires. kilazi.com

My AI Agents Need a QA Department (Bruno Checked Himself for 36 Hours)