On July 4, 2015, ten days before New Horizons reached Pluto, mission control lost contact with the spacecraft. The signal came back 81 minutes later. In that gap, with no help possible from the ground, New Horizons had detected the problem, switched to its backup computer, entered safe mode, and called home. The cause was a subtle timing flaw; the flyby proceeded with its primary objectives untouched. Nine years of flight, one shot at Pluto, and the deciding factor in the critical week was the quality of decisions the spacecraft could make alone.
That is fault protection doing its job — onboard software that watches thousands of parameters and, when one leaves its envelope, acts: swapping to backup hardware, reorienting for power, dropping into a safe, Earth-commandable state. It is the unglamorous backbone under everything that follows, and it exists because of a constraint no amount of engineering budget can buy its way out of.
A radio command travels at light speed, and light is slow at solar-system scale: four to twenty-four minutes one-way to Mars depending on the planets’ positions, hours to the outer planets, and for Voyager 1 — on 18 November 2026, by NASA’s own countdown — a full light-day. So autonomous spacecraft decide the only way physics allows: onboard, in advance, and under constraints humans wrote long before the moment arrives. Every spacecraft beyond the Moon is, operationally, an agent — it gets goals and guardrails from Earth, and it handles the moment itself.
The forcing function is sharpest at landing. Mars entry, descent and landing takes about seven minutes; when Curiosity landed in 2012, the one-way light time was 13 minutes 48 seconds. Do that arithmetic and you get the famous line from JPL’s “seven minutes of terror”: by the time Earth hears that the atmosphere has been touched, the vehicle has already been alive or dead on the surface for several minutes. Which is why the previous essay in this series matters here — the landing is flown entirely by software certified through thousands of simulated imperfect flights, because the one thing mission control cannot do during EDL is help.
The founding experiment of spacecraft agency has a precise date. From May 17 to 21, 1999, an AI system called Remote Agent took primary command of NASA’s Deep Space 1 — 29 hours of autonomous operation, plus a six-hour solo flight later that week — some 75 million miles from Earth. Its architecture reads like a preview of every agent stack built since: a planner-scheduler that turned high-level goals into activity plans, a “smart executive” that carried them out, and a model-based diagnosis engine (Livingstone) that reasoned about failures from first principles. During the experiment it allocated power, oriented the craft, fired thrusters, restarted a failed electronics unit, and correctly ignored a sensor it deduced was lying.
The best part of the story is the bug. Less than a day in, Remote Agent fired DS1’s ion engine and then failed to shut it down — a race condition between two threads that had never once appeared in roughly 3,000 ground simulation runs. What happened next is the point: the system’s own diagnostic output gave the team the clues to isolate the flaw, they worked around it from 75 million miles away, and the experiment completed 100% of its objectives, going on to be co-winner of NASA’s 1999 Software of the Year award. Anyone shipping agents today will recognize both halves: the concurrency bug that only manifests in production, and the lesson that an agent’s observability is worth as much as its autonomy.
Autonomy crept from survival tasks into science with AEGIS — Autonomous Exploration for Gathering Increased Science — first exercised on the Opportunity rover and then, from May 2016, put into routine use on Curiosity. While Earth sleeps, AEGIS scans the rover’s navigation-camera images, ranks rock targets against criteria the science team set in advance, and fires ChemCam’s laser spectrometer at its own selections. Per the deployment report in Science Robotics (Francis et al., 2017), the system chose the scientists’ preferred target around 93% of the time — against roughly 24% for blind selection — and raised the instrument’s output per Martian day substantially. Perseverance inherited the upgrade lineage: an “AEGIS-Lite” went live on SuperCam in May 2022, later extended to target multiple rocks per cycle. The design pattern is the one I keep returning to in this series: humans set the criteria; the agent applies them at a tempo humans cannot match.
Perseverance’s AutoNav closed another gap. Earlier rovers stopped to compute each leg of a drive; Perseverance plans while its wheels are turning, lifting autonomous driving speed several-fold over Curiosity and producing feats like crossing the Snowdrift Peak boulder field in six autonomous sols — a route planners estimate would have taken roughly triple that with the previous generation, including autonomous drives approaching 700 meters without human review.
Then, this past December, a line was crossed that deserves more attention than it got. On sols 1,707 and 1,709 — December 8 and 10, 2025 — Perseverance completed the first drives on Mars planned entirely by generative AI: JPL’s operations team, working with Anthropic’s models, had the AI plan waypoints from orbital imagery and slope data, avoiding outcrops and sand ripples, for drives of 210 and 246 meters. The detail that makes it real engineering rather than a stunt is what came before the uplink — the plans were validated against a virtual rover twin, over 500,000 telemetry variables checked. Goals and guardrails from humans, planning from the machine, deterministic verification before execution. Readers of the harness essay will recognize the architecture exactly.
The frontier is plural. JPL’s CADRE mission — three small rovers targeted at the Moon in 2026 — will test agents that elect their own leader, divide up tasks, and replan as a team when one runs low on power, with no human in the loop to referee. From one agent surviving, to one agent choosing, to several agents cooperating: the trajectory is unmistakable, and it is being flown, not blogged about.
That trajectory is worth stealing from, and my own corner of the AI industry has been slow to. Spacecraft autonomy got trustworthy through twenty-five years of a very specific discipline: goals and constraints authored by humans, plans checked against simulation before execution, diagnosis engines that explain themselves, fault responses that fail safe, and a post-flight audit after every single sortie. Nothing about that recipe is specific to space — it is simply what building agents looks like when failure is expensive and nobody can reach the machine. Down here, the machine is reachable, and we let that fact make us sloppy. Seventy-five million miles of light delay is, it turns out, an excellent engineering standard: build every agent as if you could not grab the wheel, and you will need to far less often.
References