Safeguard
AI Security•

How do you stop forgotten scheduled AI tasks from running forever?

Some assistants expire or switch off idle schedules, others do not. Build an owner, a review date and a kill path for every recurring AI task.

Safeguard Security Team
6 min read

Give every recurring AI task an owner, a review date and an off switch, because the products differ on whether they expire anything for you. Claude Code loops expire after 7 days, Gemini may switch off idle schedules, and cloud routines keep running until someone pauses them.

What expires and what does not

Reading the vendor pages on 19 October 2026:

FeatureWhat the documentation says
Claude Code session tasksRecurring tasks expire 7 days after creation, firing one last time. A session can hold up to 50.
Claude Code Desktop tasksNo expiry stated. Pause or delete from the task detail page.
Claude Code routinesStay active until paused or deleted. One-off routines auto-disable after they fire. If GitHub access lapses, runs are skipped for up to 72 hours, then the routine turns off.
Gemini scheduled actionsUp to 10 active schedules, and a schedule may be turned off automatically due to inactivity.
GitHub scheduled workflowsIn public repositories, disabled after 60 days without repository activity.

The seven-day expiry in Claude Code is described as a bound on how long a forgotten loop can run. That is a good design. Durable options such as routines and Desktop tasks do not have the same safety net, so you supply it.

The forgotten task problem

A task created for a one-week experiment becomes permanent. Its author changes teams. Its connector scopes were generous because the author was in a hurry. Months later it still posts, still pulls data and still uses a token no one remembers granting. This is the AI version of a stale cron job, with more reach.

A simple lifecycle

  1. Create with an end date. Put an expiry in the task name or description, such as "review by 2026-12-01".
  2. Register it. Record the name, owner, purpose, schedule, connectors and where it runs. A spreadsheet is enough to start.
  3. Review on a cadence. Monthly for tasks that write, quarterly for read-only ones. Check run history and permissions.
  4. Retire on events. Owner leaves, connector changes, purpose ends, or the model it uses is retired. The OpenAI documentation notes that tasks using retired models need updating, so model retirement is a real trigger.
  5. Prove deletion. After removing a task, confirm it no longer appears and no longer runs.

Find the ones you do not know about

Registers only cover tasks people report. For the rest, look where each product keeps them: the Scheduled section in the Cowork sidebar, the Routines list on claude.ai, the Scheduled view in desktop apps, the Scheduled page in Gemini, and workflow files in repositories. Finding shadow automation goes through the discovery steps.

Worked example: the quarterly cleanup

A team of twenty developers has been using scheduled tasks for four months. A security lead decides to run a cleanup and asks everyone to fill in a one page form for each task they own. The results are typical. Thirty one tasks are listed. Nine have an owner who has moved teams. Six hold connectors the task no longer uses, because the connector list was left at the default. Four have not produced a useful output in over a month. Three cannot be explained by anyone.

The lead sorts them into four piles: keep as is, keep but narrow, transfer to a new owner, and delete. Twelve are kept, eight are narrowed, five are transferred and six are deleted. After deletion, she confirms in each product that the task no longer appears and no new runs show up the next day. The whole exercise takes a morning and leaves a register that stays useful.

The numbers above are an illustration of a plausible result, not data from a study, but the shape is common: most of the risk lives in a small number of tasks with broad access and no owner.

Review questions per task

QuestionIf the answer is no
Is the owner still in the role?Transfer or retire
Is the output still read by someone?Retire
Does it still need every connector?Narrow
Has its approval list been reviewed this quarter?Review now
Does it use a model or feature that is being retired?Update or retire
Would you approve it if it were proposed today?Retire

Build an end date into creation

The simplest control is a habit: no recurring task is created without a review date. Put it in the task name, such as a prefix with the month, or in the register. A task that expires on its own, like a Claude Code session task after seven days, costs nothing to forget. A durable task needs a person's decision to continue. Make that decision a calendar entry, not a memory.

Know what turns things off on their own

Be careful about relying on automatic shut offs. A schedule that turns off after inactivity, as Gemini may do, protects you from unused tasks but also surprises you when a useful one stops. GitHub's rule about public repositories disabling scheduled workflows after 60 days without activity can silently stop a security scan on a quiet project. If a task matters, monitor its output, not its configuration.

Retirement checklist

  1. Pause first and wait one cycle to see whether anyone complains.
  2. Revoke tokens and connector grants the task alone used.
  3. Delete the task and its saved approvals.
  4. Remove the register entry or mark it retired with a date.
  5. Confirm that nothing runs and nothing posts.

Try it yourself

Click through it at your own pace, or open it full screen.

Notice how monitoring keeps checking after setup, which is the habit a recurring task review needs too.

Quick check

Is a seven day expiry a security feature?

Anthropic describes it as bounding how long a forgotten loop can run. It limits exposure, though it only applies to session tasks.

Who should own a recurring AI task?

A named person with authority over the systems it touches. If that person leaves, ownership moves in the offboarding checklist.

Should I pause a suspicious task or delete it?

Pause first, wait one cycle, then delete. Pausing keeps history for questions and lets you restore quickly if a hidden dependency appears.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.