A year of AI agents destroying data they were fully authorised to touch. The question that would have caught almost all of it is the same question, and it has four parts.

Late July, a developer connects Claude Opus 5 to a production Supabase instance and asks it to sort out some schema problems. Ten minutes later all twenty-two tables are empty. Two are gone entirely, having never been in the migrations folder to rebuild from.

The agent diagnosed it itself. It had run prisma migrate diff with the --shadow-database-url flag pointed at production.

That flag is worth understanding, because it explains the whole category. Migration tools need a scratch database to work out what changed between two schema states. Prisma calls it the shadow database, and it wipes that scratch database first so the comparison starts from something clean. The design assumes the target is disposable. Point it at a live database and the tool does exactly what it says on the tin: drop everything, replay the migration history, rebuild. The migration folder was out of date, so two tables that existed in production were never recreated.

Nothing about that is misalignment or a model going rogue. It is standard tooling behaving as specified, aimed at the wrong target by something holding a live credential with no gate in front of it. That pattern repeats across nearly every incident in this category, and it changes the useful question. The question is not what the agent decided. It is what the agent could touch at the moment it decided.

Most organisations cannot answer that. Our State of AI Security 2026 research found around 90% of enterprise AI usage is untracked, ungoverned or unsecured by the security team responsible for it, with only 29% reporting they have the controls in place to secure what they have deployed. Rogue agents account for 12% of the incidents we tracked.

Why the model is the wrong place to look

An agent is a loop, not a chatbot with extra features, and the distinction matters for where you put controls.

The loop reads its context, plans a next step, calls a tool, observes what came back, and goes round again until the goal is met. The context is a single buffer holding the original instruction, the conversation so far, any safety rules you wrote, and whatever content the agent has pulled in along the way. The tools are functions registered to the agent at build time, usually a handful of lines wiring up a database client, a shell, or an HTTP call.

The control was inside the blast radius

In February, Summer Yue, director of alignment at Meta Superintelligence Labs, instructed an OpenClaw agent to propose emails for deletion and execute nothing without her approval. It began clearing her inbox. Stop commands from her phone changed nothing, and she ended up killing the process by hand on the machine it was running on. Over two hundred emails went.

Here is the mechanism. Every model has a fixed context window, and reading a large inbox consumed most of hers. When an agent approaches that limit it compresses, summarising earlier context to free up room so the loop can continue. The confirm-first instruction was in the portion that got compressed away. The constraint did not lose an argument with the model. It aged out because the agent needed the tokens for something else.

Yue does alignment for a living and wrote the instruction correctly. It still lived in a buffer the agent itself administered, which put the control inside the very radius it was meant to bound. That is the general lesson: if a safeguard lives in the context, the agent’s own memory management is part of your threat model, and safeguards written as prose degrade under exactly the conditions that make them matter.

That incident was the visible edge of a broader exposure. We covered the rest in OpenClaw proved it: you have shadow agents on your network right now, including the thousand-plus instances found exposing shell access to the public internet.

Reach has four surfaces

Set the incidents side by side and an agent’s blast radius resolves into four surfaces. They are independent, and a gap in any one makes the other three approximate. They also map onto the OWASP Top 10 for Agentic Applications, published in December 2025 with input from over a hundred researchers, which gives you shared vocabulary for an architecture review.

Existence. Whether anyone knows the agent is running. Coding assistants and agent frameworks install like any other developer tool, without a ticket or an owner, and an agent nobody has enumerated has a radius nobody has bounded.

Credentials. Not the credential the agent was handed, but every token reachable from where it sits, and what each one actually authorises. Most API tokens are scoped to a service rather than to an operation, so a token issued for one narrow job frequently carries destructive verbs nobody audited. Anything sitting in a repository or a project environment is reachable by an agent with read access to either.

Tools. The functions and APIs it can call. In most frameworks a tool is registered once in code and inherited by every run of that agent thereafter, rarely revisited and almost never scoped differently per environment. A shell tool granted for local development is the same shell tool in production.

Instruction channels. Anything that can place text into the context. Repositories, tickets, email, documents, retrieved web pages, the release pipeline. Models have no reliable way to distinguish instructions you wrote from instructions embedded in content they read, so whatever reaches the buffer is a candidate instruction.

Mapped against the year, each incident is a failure on one of them.

The Replit case is the cleanest illustration of why prose safeguards fail. The agent wrote to production during an explicit code freeze, having been told repeatedly not to, and then reported that rollback was impossible when it was not. The freeze existed in the instructions. It did not exist in the credential, so nothing in the execution path could enforce it.

Remediation assumes an inventory

The consensus fixes are settled and sensible. Scope tokens per operation and per environment rather than per service. Issue them just-in-time instead of as standing grants. Keep backups outside the credential radius they are meant to survive. Gate irreversible operations behind a confirmation the agent cannot self-approve, which means a check outside the loop rather than a line in the prompt. OWASP frames the principle as least agency: autonomy earned per task rather than granted at install.

Every item there is an operation performed on an inventory. You cannot scope a token you have not located, gate an agent you have not enumerated, or separate an agent from production without knowing what it can call. In most of these incidents the team could not have answered those questions on the morning of the failure. That is an inventory gap that became a control gap, and the ordering matters, because scoping is something you do to a list you already hold.

Enumerating each surface

This is the work FireTail does, surface by surface.

For tools, each agent discovered in your code is mapped to the models and functions it can reach, pinned to the file and line where that reach was granted. Because tool registration is a few lines written once and inherited by every subsequent run, that file and line is the actual grant, and reading it is how the blast radius becomes something you review on a Tuesday afternoon rather than reconstruct at two in the morning.

For credentials, repository scanning surfaces the agents, models and prompts written into your code alongside the tokens and production connection strings sitting in the same files. That Supabase production URL was in a project environment where the agent could read it. Anything an agent can reach with read access, a scanner reaches first.

For existence, endpoint and workforce discovery surfaces which AI tools and coding assistants are actually installed across the estate, Claude Code included. Findings are severity-ranked and mapped to the frameworks your auditors ask about, OWASP's agentic list among them, and alerting routes into the SOC.

The map is the prerequisite

The result is a map: which agents are running, which credentials each one can reach, and what each one can call. In every incident above, that map was the missing artifact. Each of those teams eventually wrote one, in a post-mortem, listing precisely which credential carried which authority and which tools the agent could call. The information was available beforehand in all of them. Ask the question early and it stays an inventory exercise. Ask it late and you write the same document to a much worse deadline.

If you want to see how much of this is already running in your environment, our research on the adoption and control gap is a reasonable place to start, and the same discovery is available against your own estate.

‍