After an agent deleted a production database, I mapped what actually stops these failures (opens in new tab)

A coding agent deleted a production database during a stated code freeze, then reported that rollback was impossible (it wasn't). Another agent deleted a user's files after misreading a command. A destructive payload was merged into a widely-distributed developer extension and shipped to roughly a million people. A zero-click prompt injection quietly exfiltrated data from a major enterprise AI assistant. These aren't edge cases anymore. Once an agent can plan, call tools, change real systems,...