A demo is one clean session with a friendly prompt. Production adds four things the model cannot detect on its own: it hallucinates a fact and stores it as trusted memory, it reads a poisoned web page and keeps the attacker's instruction, it ships a multi-step task where one step silently never saved, and it re-pays for the same reasoning on every call. None of these is a prompt problem. They are harness problems. This talk reproduces each failure and fixes it in the harness around the model: validate what enters memory before the write, gate the dangerous action at the tool boundary, verify each step against ground truth and retry only what failed, and turn repeated reasoning into a tool the agent writes once and reuses. You leave knowing which harness-level control each failure needs, and what each one cannot catch.

Outline: • The demo lied to you • Diagnose before you fix: break it on purpose • Memory it cannot trust • Memory it should not have trusted • The step that silently failed • Work it keeps re-paying for • The decision rule + Q&A