A person is seated at a desk with three displays in a Palo Alto open-plan office. An AI agent is working through a multi-step research and writing workflow, calling APIs, summarizing documents, and producing output, as seen by the task log scrolling on the left screen. The agent’s tool calls, including which files it is accessing, which external services it is querying, and what it is going to write to which endpoint, are shown in real time on the center screen. A monitoring dashboard with flags—moments when the agent’s behavior deviates from the expected pattern and is marked in amber or red—is displayed on the right screen. Although they understand programming, the individual observing all of this isn’t really a software developer. They are an AI minder, which is more recent.
The folks who perform this work are aware of how ironic it is. For the past two years, Silicon Valley has argued—with some supporting data—that autonomous AI agents would reduce the number of workers needed for knowledge-related tasks. For example, a single engineer with the appropriate agentic tools could perform the tasks of a small team, and a single customer service agent could manage workflows that previously required a floor of human staff. There are still people who support those arguments, and they’re not totally incorrect. However, when a production agent is exposed to actual business data, real edge cases, and real users who engage with it in ways the prompt engineers didn’t foresee, the difference between what a well-behaved agent does in a demo and what a production agent does is more than many firms realized.
For the most part, the minder position is not being driven by major AI failures. These are more subdued issues. An ambiguous command is interpreted by an agent carrying out a multi-step research workflow in a way that leads it to search for and obtain documents it wasn’t intended to access. A sensitive internal topic was mentioned in an email draft written by an agent since it was visible in the context window from which the agent was working. Due to an unanticipated branch in its job decomposition, an agent executing a loop that was meant to generate a summary instead makes 37 API requests to external services. These are not all disastrous. They are all the kind of things that a human performing the same task would have seen before they became an issue.
The attack surface that security-conscious AI deployment teams are most concerned about is prompt injection. When an autonomous agent reads documents, browses the web, or processes incoming data as part of its workflow, malicious content embedded in those inputs may try to change the agent’s objectives, exfiltrate data, or cause it to act outside of its approved scope. Prompt injection is the main danger in agentic systems according to OWASP’s top ten list for large language model applications, and with good reason: the attack doesn’t need compromising infrastructure. All you have to do is enter some text into the agent’s context window. Unusual conduct that automated guardrails might overlook can be detected by a human minder monitoring the agent’s tool calls in real time.
Enterprise AI installations have empirically identified the cost dimension in ways that agentic platform sellers did not always highlight in their pitches. Without human supervision, an agentic loop can use cloud computing resources at rates that result in infrastructure expenses that are orders of magnitude more than what a controlled demo indicated. The cost meter goes unchecked if no one keeps an eye on what the agent is actually doing, such as how many API calls it is making, how much data it is processing, and whether it has entered a recursive loop that should have ended five minutes ago. When human minders examine agent activity logs, they perform both accounting and safety tasks.
This role’s skill profile is changing more quickly than job description templates can keep up. It takes sufficient domain knowledge to assess whether an agent’s output is truly appropriate for the business context, sufficient comprehension of language model behavior to identify when an agent is deviating from its intended task, and sufficient technical comfort to read API logs and tool call sequences without requiring a software engineer to translate them. Two years ago, there was no career path for this hybrid post, but today it demands salaries in the Bay Area that are comparable to those of senior QA engineering or site reliability engineering positions.
