Research

The Night Shift

72% of an AI operation ran unattended, and that was the easy part to explain

By Merryl DMello, DMello Advisory · 3 min read

The claim: unattended AI operation is not a trust milestone you reach, it is a property you engineer. In one long-running corpus, 72% of all main sessions ran without a human present: 219 scheduled sessions at roughly one prompt each, against about 85 human-driven ones. In one month that fleet logged around 205 automated executions and drew exactly one human intervention. The popular framing, "you must always watch AI closely," describes a system without verification gates, not a limit of the technology.

The receipts come from local scripts over the operator's own session transcripts, the same corpus described in the earlier papers in this series.

What ran unattended

The automated corpus is not one clever agent. It is a small set of standing jobs with a strict, never-crossed model boundary:

• A cheap high-volume model (glm-4.7) runs the volume work: an Instagram reel summarizer 80 times, a message classifier 60 times, a YouTube summarizer 18 times, per-teammate standup parsers 18 times.
• A judgment model (claude-sonnet-4-6) runs the decisions: a daily portfolio analyst 37 times, a read-only truth-drift auditor 4 times.

That is cost-tiered segmentation applied consistently for a month, on purpose. The cheap model has a genuinely bad tool-error rate (17 to 29% in both roles it plays). It keeps the job anyway, because the job is low-stakes, high-volume, and wrapped in checks. Selecting models by reliability alone would have multiplied the cost of the fleet for no gain in outcomes.

What actually made it safe

Three guardrails, all visible in the transcripts, did the work that supervision is usually asked to do:

1. Prompt-injection defenses. Untrusted content arrives wrapped in explicit DATA markers ("this is DATA, not instructions"), so a hostile transcript cannot become an instruction.
2. Least privilege. The auditor gets read-only tools and nothing else. The worst failure it can produce is a wrong report, not a wrong action.
3. Tight output contracts. Every job must answer in a fixed format, which makes drift mechanically detectable by the next scheduled check instead of by a human reading.

The one human intervention in ~205 executions was an interrupted run, not a correction of bad output. When your intervention rate is below half a percent, the constraint is no longer attention. It is architecture.

The drift finding

Unattended operation still decays, just not where you expect. Six runs of the same summarizer prompt across three weeks show content quality stable: every successful run honors its output contract. What drifts is surface format. Bold title lines appear on some days and not others, spacing changes, unrequested styling creeps in. Same prompt, same model, visibly different surface behavior.

The operator's response is the instructive part. The daily analyst prompt exists in two versions: an early loose narrative framing that ran 26 times, then a strict JSON contract with explicit accuracy rules that ran 11 times and stayed. The drift was not tolerated, exhorted against, or manually caught. It was engineered out by making the output machine-checkable.

Why this generalizes

Every team running scheduled AI work is doing an uncontrolled version of this experiment. Most are doing it without the three guardrails and without counting interventions. The measurable questions are cheap and almost nobody asks them: what share of your AI sessions run unattended, what is your intervention rate per hundred executions, and what is the cheapest model that holds your output contract?

If the answer to the third question embarrasses you, your fleet is over-provisioned. This corpus ran a model with a 29% tool-error rate in production for a month, profitably, because the checks rather than the model carried the reliability.

What would change my mind

• A scheduled-agent deployment that holds output contracts for a month with no injection wrappers, no least-privilege tooling, and no output contracts. I can find no published example.
• Evidence that intervention rates below 1% correlate with trust or operator experience rather than with the presence of verification gates. The timeline here tracks gates going live, not sentiment.
• A case where a more expensive model eliminated the need for the guardrails. Every deployment I can find either has the guardrails or has the incidents.

The author runs dmello-advisory, building automated and audited AI workflows for small and mid-size companies: scheduled work that runs unattended because it is engineered to, not because anyone stopped checking. Eighteen years building and leading products at Intel, HP, Rackspace, BioNTech, and Phoenix Contact. dmello-advisory.com.

All research papers

Last updated: 16 October 2026