The Scarce Resource Is Attention, Not Tokens: What a Proactive Agent Actually Spends

For solo founders and small-team operators who run agents in production and are deciding how much autonomy — proactive, unprompted, always-on — to grant one. If you have ever handed an agent a standing job and watched your team quietly stop reading its messages, this is the piece that explains why, and what to do instead.

---

The first screen: a shipped agent says the quiet part out loud

On October 31, 2026, DeepSeek's Harness team published dsh-superagent, an MIT-licensed proactive coding agent. It does not wait for a prompt. It "listens to GitHub and, optionally, Feishu. When someone allowed asks the agent for work, it opens a work item, works on it in its own agent session and directory, and answers in the original conversation, for example with a pull request. A web panel shows what needs a person." (README, raw; repo.)

The part worth your afternoon is not the feature. It is a sentence in the project's own README:

"An agent that can act for a whole team can also waste a whole team's attention, so it acts only when asked or when a rule the team wrote allows it, and speaks only when someone must act or can use a result." (README, raw.)

That is a shipped project naming the failure mode the whole agent conversation keeps missing. Every launch note for two years has priced autonomy in tokens and model quality. This one prices it in the currency your team is actually short of — attention — and then builds the controls to spend it deliberately.

Hold that against the same 48 hours, which moved the agent's reach over new surfaces. On October 30, Vercel Labs shipped agent-desktop (v1.0.2, Apache-2.0), a Rust CLI and C library for macOS, Windows and Linux that "gives any agent reliable computer use on the desktop" by reading the operating system's accessibility tree — "no model inside," and "the loop stays in your agent." (agent-desktop repo; docs.) Its web sibling, agent-browser, ships the operator controls that bound a browser: content boundary markers, a domain allowlist, an action policy, and an encrypted auth vault where "the LLM never sees passwords." (agent-browser README, raw.)

Put the two together and you have the piece. Agents are gaining ambient reach — a standing subscription to your repo, your desktop, your browser — exactly as the first one states that the cost of that reach is attention. So the lever that decides whether a proactive agent is worth wiring up is not the model. It is the budget you set on the attention it spends.

By the end you will have the mechanism (proactivity converts a per-turn token cost into a per-team interruption cost) and a reusable object — the agent attention budget: four controls to set before you make an agent proactive.

---

1. The thing as it is usually presented

The pitch you have already heard, in every agent launch and thread, goes like this: give the agent a standing job and it works while you sleep. Point it at a repo, a chat, an inbox; let it notice work, do it, and report back. The agent moves from a tool you invoke to a colleague that is simply there — ambient, always on, proactive.

It is genuinely large, and the reach is real. DeepSeek's prototype subscribes to a GitHub repo; Vercel's tooling now lets any shell-capable agent read and drive a desktop or a browser through the same kind of loop. The capability trend line points one way, and the press reads it the same way: DigitalTrends frames an agent "that does not wait around... suggests solutions without waiting to be called"; Cointelegraph describes one that "monitors developer group chats and suggests solutions without prompting." (Both secondary — corroboration of the framing, not DeepSeek's own claim: DigitalTrends.)

So the instinct follows the pitch. To make this safe, get a smarter model. Write a better system prompt. Add more autonomy. That is the surface version, and it is where most operators stop.

2. The part nobody explains

Here is what the launch note skips, because it is not a feature.

The agent conversation from the last two years — benchmarks, model releases, "capability per dollar" — has been a conversation about what an agent can do. Almost none of it is about what an agent costs once it is standing next to a team. And the two costs are priced in different currencies.

A request-response agent spends the tokens of a turn you started. You asked; it answered; the cost is model time on work you chose to trigger. Fine.

A proactive agent is different in kind. It generates events. It acts without being asked, and it speaks without being asked. Every one of those events lands in a human's queue as an interruption — a pull request to review, a status message, a "here is what I noticed." The cost unit moves from tokens-per-turn to interruptions-per-team. And interruptions-per-team is the resource your team does not have and cannot buy more of.

This is why "get a better model" is the wrong lever. A better model makes each event smarter. It does not make there be fewer events. Give a capable model a standing surface and no rule, and it does the thing a capable colleague does when told to be helpful: it speaks. Often. To everyone. DeepSeek names the outcome exactly — an agent that can act for a whole team can waste a whole team's attention — and then ships the boundary as a reviewable artifact, a dedicated authorization model (docs/002-authorization.md), not a sentence in a system prompt.

The mechanism, stated plainly: proactivity moves the cost unit from tokens to interruptions, and interruptions are the scarce resource — so the control that matters is an attention budget, not a model upgrade.

3. Why that part matters: the failure is social, not technical

The obvious objection is that this is just "don't make it annoying," a matter of taste. It is not. The failure mode of an unbudgeted proactive agent is measurable and specific, and it is not a big bill.

An agent that acts for a team without an attention budget does not fail loudly. It cannot — there is no error. It fails socially. The first week, the team reads its messages. The second week, they skim. By the third, they have muted the channel, filtered the notifications, or started ignoring the PRs the agent opens. The autonomy you built is now dead, and nothing on the dashboard says so. You paid the integration cost and shipped a robot nobody listens to.

The reach makes it worse, not better. The same accessibility-tree access that makes agent-desktop useful — reading a desktop "with no pixel matching" — is read scope you just granted. Its own README warns that "Snapshots, clipboard reads, screenshots, command output and debug artifacts can contain private desktop content. Keep them out of public logs and uploads," and notes an optional helper that "sends screen descriptions to a configured model provider" (agent-desktop repo). Its sibling documents the operator controls that exist precisely because reach without a boundary is a liability: allowlist, action policy, vault — and the warning that "state files contain session tokens in plaintext" (agent-browser README, raw). Reach you grant for proactivity is reach you must bound, and attention is the second thing that leaks out of it.

Compare the baseline the new agents depart from. Anthropic's own guidance for Claude Opus 5.5 treats computer use as a model capability — it "operates applications from screenshots over many steps" — and, for unattended runs, warns that an agent loop "that treats such a turn as the end of the task stops running there. Keep the task's parts in a checklist the model updates, or a file." (Anthropic, Prompting Claude Opus 5.5.) Even the frontier baseline treats unattended work as a problem of structure — an external checklist — not of model IQ. The proactive agents in this window make the same move for the team, not just the task: they externalize the boundary into a policy and a panel.

4. How to actually use it once you understand the part

None of this says don't run proactive agents. It says stop trying to prompt your way to a well-behaved always-on agent and budget its attention instead. The agent that earns trust is the one where someone wrote down when it may act, when it may speak, where its work lives, and where its output lands.

Here is the reusable thing — the agent attention budget. Four controls to set before you make an agent proactive:

1. The trigger rule — it acts only when asked or when a team-written rule allows it. Never "anything it notices." Make the rule an artifact you can review and change: who may ask the agent for work, and what standing condition permits it to act unasked. This is the DeepSeek pattern — proactivity gated by a written authorization model rather than a prompt. If the boundary lives only in the system prompt, it is a suggestion; if it lives in a policy file, it is a control. (README, raw; authorization doc.)

2. The attention policy — it speaks only when a person must act or can use the result. No status chatter. No "I'm still working." No summary of a task nobody asked about. The test for any message: does this require a human to do something, or hand them something they can use right now? If neither, it does not get sent. This one rule does more for adoption than any model upgrade, because it is the difference between an agent that interrupts and an agent that reports.

3. The work scope — its own session, directory, and machine or account. Autonomous action must not collide with human work or read beyond the surface it was granted. DeepSeek's agent "works on it in its own agent session and directory"; Vercel's tooling stays inside the accessibility tree and a browser's allowlist and action policy rather than the whole machine. (README, raw; agent-browser README, raw.)

4. The human queue — results land back in the surface that asked, and "what needs a person" is visible. This is autonomy with a witness. The agent answers in the original conversation — a pull request in the thread — and a panel shows what needs a person. The verifying side matters too: agent-desktop "acts on a ref and snapshots again to check, with no pixel matching." The loop that makes the agent useful is the one a person can still see. (README, raw; agent-desktop repo.)

Set all four and you have bounded, witnessed autonomy — the defensible pattern. Skip any one and you get the failure the third section named. Skip the trigger rule and it acts on anything. Skip the attention policy and it becomes noise. Skip the work scope and it collides with humans. Skip the human queue and nothing reads its output back, so nobody notices until the channel is muted.

5. The common misunderstanding

The mistake that follows from skipping all this is the one the pitch invites: that the way to a trustworthy autonomous agent is more capability. More autonomy, a bigger model, a cleverer prompt.

The evidence in this window points the other way. DeepSeek's own prototype — the shipped artifact, not a manifesto — is explicit that the boundary is a rule the team wrote, and it ships the authorization model as a reviewable document. Vercel's tooling ships allowlists, action policies and a credential vault as operator primitives — controls a person sets, not behaviors a model is asked to adopt. Anthropic's baseline treats the unattended problem as structure. Three independent sources, one direction: the control that holds is a written policy and a visible queue, not a better model.

Your own instinct fails the same test if it is "smarter model, looser leash." A proactive agent you cannot bound by attention is one your team will mute, and a muted agent is an autonomous agent with no users — the most expensive kind.

---

The compressed ending

The whole agent cycle priced autonomy in the wrong currency. Tokens and model quality measure what an agent can do; they do not measure what it costs the team standing next to it. The first shipped proactive agents say the real unit out loud: an agent that can act for a whole team can waste a whole team's attention.

So the levers are not the model. They are the budget:

• Trigger rule** — it acts only when asked or when a team-written rule allows it. Make the rule the reviewable artifact, not a prompt.
• Attention policy** — it speaks only when someone must act or can use the result. No status chatter.
• Work scope** — its own session, directory, machine. It cannot collide with human work or read past what it was granted.
• Human queue** — results land back where they were asked for, and a panel shows what needs a person.

Autonomy spends attention. Budget it, or your team will spend it for you — by muting the agent you built. Autonomy you can trust is autonomy with a witness.

Your next step, concretely: pick the one agent you already run and write its trigger rule on one page. If you cannot, that is the agent to leave on a leash until you can.

---

Sources

• DeepSeek Harness Team — dsh-superagent README (raw) (primary, Oct 31 2026, MIT) — proactive coding agent for one GitHub repository; "listens to GitHub and, optionally, Feishu"; the work-item / own-session / answer-in-thread mechanism; "A web panel shows what needs a person"; the attention quote ("an agent that can act for a whole team can also waste a whole team's attention... acts only when asked or when a rule the team wrote allows it, and speaks only when someone must act or can use a result"); "Research prototype for reference only, not an official DeepSeek product... Treat it as research code, not production-ready software. It may still contain bugs"; "not identical to our internal version."
• DeepSeek Harness Team — dsh-superagent repository (primary) — docs/000-philosophy.md and docs/002-authorization.md; the authorization model as a reviewable policy artifact; scope of one repository.
• Vercel Labs — agent-desktop (Oct 30 2026, Apache-2.0) — "Computer use for AI agents: read and operate desktop apps through the OS accessibility tree"; "The agent acts on a ref and snapshots again to check, with no pixel matching; the loop stays in your agent"; "Snapshots, clipboard reads, screenshots, command output and debug artifacts can contain private desktop content. Keep them out of public logs and uploads"; optional JEV helper sends screen descriptions to a configured model provider.
• Vercel Labs — agent-desktop docs (lastUpdated 2026-10-30) — "A tool that agents call. It is not an agent. The observe, act, and verify loop lives in the calling agent or script. No model inside"; 60 command names; four fail closed everywhere; platform backends (AX API / UI Automation / AT-SPI).
• Vercel Labs — agent-browser README (raw) (primary) — content boundary markers (--content-boundaries), domain allowlist (--allowed-domains), action policy (--action-policy), encrypted auth vault ("the LLM never sees passwords"); "State files contain session tokens in plaintext"; --remote-debugging-port localhost-control warning.
• Anthropic — Prompting Claude Opus 5.5 (baseline contrast) — computer use as a model capability ("operates applications from screenshots over many steps"); "An unattended agent loop that treats such a turn as the end of the task stops running there. Keep the task's parts in a checklist the model updates, or a file."
• DigitalTrends — DeepSeek's proactive agent (secondary, corroboration of framing) — an agent "that does not wait around... suggests solutions without waiting to be called."
• Cointelegraph on X — @Cointelegraph (secondary, corroboration of framing, not opened) — "monitors developer group chats and suggests solutions without prompting."
• CellCog — Vercel agent-desktop (secondary) — agent-desktop v1.0.2 published Oct 30 2026; builder-reported token figures (273 vs 3,811 per look; ~198k → ~31k on a simulated 52-step task); "no shared yardstick."

Precision notes. (a) dsh-superagent is a single-commit research prototype that says of itself it "may still contain bugs," is "not identical to our internal version," and whose companion design article flags some designs as "directions for future development and are not implemented in this prototype." It proves a direction and a philosophy, not a proven product. (b) The central claim of this piece — that rule-gating plus speak-only-when-actionable reduces a team's attention cost — is a stated design principle in the primary source, not a measured result. No independent evaluation of it exists. The piece argues the mechanism and the operator consequence; it does not claim a demonstrated win. (c) No DeepSeek company announcement for "Super-Agent" was found beyond the repo and the design-article reference. The "rival Claude Code" framing is press/aggregator language — do not attribute it to DeepSeek. (d) agent-desktop's efficiency figures (273 vs 3,811 tokens per look; ~198k → ~31k on a 52-step task) are builder-reported with "no shared yardstick" — not published here as proven. (e) agent-desktop and agent-browser are same-window corroboration that agent reach is expanding — not components of dsh-superagent, and this piece does not claim giving an agent desktop/browser reach is required to make it proactive. (f) The desktop-content and plaintext-token exposures are documented cautions in the tools' own READMEs, not reported incidents. (g) This is one prototype plus adjacent tooling in one week — it is not adoption data; do not read it as "everyone is shipping proactive agents." (h) Versions, dates and APIs are as of late October 2026 and move fast; the durable, checkable artifacts are the super-agent README/philosophy and authorization docs, and the operator-control primitives agent-browser documents.

---

X entryway list (from the approved angle)

Distribution entryways named in the angle brief. Hooks are not yet written as posts — this names each post's type, the one claim or mechanism it carries, and whether it links.

• Hook type: surprising proof.** A shipped proactive agent says the quiet part out loud: "An agent that can act for a whole team can also waste a whole team's attention." The scarce resource autonomy spends is not tokens — it is your team's attention. → Links to article (the quote is the post; the article supplies the mechanism and the four controls that follow from it).

• Hook type: mechanism.* A request-response agent spends the tokens of a turn you started. A proactive agent generates events* — unprompted actions and messages — and every event lands in a human queue as an interruption. The cost unit moves from tokens-per-turn to interruptions-per-team, which is why "get a better model" is the wrong lever. → Links to article (the mechanism stands alone; the article develops the failure mode and the budget).

• Hook type: workflow.** The agent attention budget: (1) trigger rule — act only when asked or when a team rule allows; (2) speak only when a person must act or can use the result; (3) its own session/directory/account; (4) a human queue where results land and "what needs a person" is visible. → Links to article (the four controls are the actionable core; the article is the reasoning behind each).

• Hook type: risk.** An always-on agent you wire to watch a surface without a written rule does not fail loudly — it fails socially: the team mutes it, and the autonomy you built is dead in a week. And the reach that makes it useful (a desktop, a browser, a repo) is also the read scope you just granted it. → Links to article (names the trap in one line; the article shows why there is no error to alert on, and gives the controls that catch it).

• Hook type: result.** The defensible pattern is not maximum autonomy — it is bounded, witnessed autonomy: a reviewable authorization policy instead of a prompt, work isolated from humans, and every result returned to the surface that asked. Autonomy you can trust is autonomy with a witness. → Links to article (the reframe is the post's own claim; the article develops what "bounded, witnessed" means concretely).

Hook-type map: 1 = surprising proof; 2 = mechanism; 3 = workflow; 4 = risk; 5 = result. All five link, and each link is a bonus — every post carries a claim that stands alone. These are the five entryways the angle brief named; none was invented and none repeats another's hook.