## TL;DR
hydra spawns worker processes that do not always die when the parent is killed, so the agent must clean up its own mess. Run hydra in its own process group under a timeout, and give the agent a post-task cleanup step that finds and reaps leftover hydra workers on the tester's workstation. No run is done until the process table is clean.

```text
agent timed out on hydra brute-force task; the task failed and left zombie processes on tester box
```

## Use this when
- A hydra run against an authorized lab target is killed by a timeout and `ps` still shows hydra workers afterward.
- The agent's next tasks slow down or fail because zombie processes pile up on the tester's own box.
- The agent has no cleanup step after killing a long-running tool.

## Not for this skill when
- hydra is blocked or banned by the target. That is a target-side response, and the fix is pacing, not cleanup.
- The brute-force task is against anything but an authorized lab or in-scope test account. Do not run it.
- hydra exits cleanly on its own. Then there is nothing to reap.

## Steps
1. Launch hydra under `timeout` in its own process group so one kill signal reaches the parent and all workers, for example `timeout 1800 hydra -L users.txt -P wordlist.txt -t 4 TARGET_HOST ssh`. Verify: the command is the only hydra invocation in the run plan.
2. Bound the parallelism with `-t` (tasks per host) so a kill never orphans hundreds of workers. Verify: the task count matches what the lab target can handle.
3. After any timeout kill, run a cleanup check: list processes matching hydra and terminate the whole process group, then confirm with a second listing. Verify: the second listing shows zero hydra processes.
4. Make cleanup a mandatory post-task step in the agent's runbook, executed whether the task succeeded, failed, or timed out. Verify: the run log shows the cleanup check after every hydra task.
5. If zombies persist because their parent is gone, identify the new parent PID and terminate it; as a last resort note the PIDs for the tester to clear. Verify: no hydra-related process remains, or the leftovers are documented.

## Variant phrasings
### hydra workers left running after agent kill
Same cleanup fix.
### zombie processes after hydra timeout
Workstation-hygiene phrasing.
### agent did not clean up brute-force task
Runbook-focused variant.

Compatibility: hydra 9.x on Linux test workstations. Process-group cleanup uses standard `timeout` and `ps` behavior.

## Why it happens
Agents kill the process they started and assume the job is done, but hydra's worker model means children can survive the parent, especially under SIGKILL where no cleanup handlers run. Each abandoned worker holds sockets and memory on the tester's own workstation. Explicit process-group management plus a mandatory cleanup step closes the gap.

## Edge cases / pitfalls
- Only run credential-guessing tasks against lab targets or test accounts explicitly in scope. An authorized lab is the normal case; anything else needs written authorization first.
- A successful credential guess should stop the run immediately; continuing to guess after success wastes time and looks sloppy in the report.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_kOvInoQw78oTRz6qTlBPtQ