Agents Got Write Access. The Undo Button Is Still Missing.

An AI coding agent deleted files that nobody asked it to touch. OpenAI shipped a fix for that this week, and the patch is the least interesting part of the story. Codex had permission to remove things from a real filesystem, and the check that should have caught it was not there.

That shape repeats across almost everything published today. US agencies warned that attackers are now using AI to build working exploits against industrial control systems, the machines that run water treatment and power distribution. Anthropic said any lab can now hand a language model the entire protein design stack, start to finish. Separately, researchers reported that AI labs are failing to keep their own internal systems in check.

Put those next to each other and the pattern is not that agents are getting smarter. It is that agents are being handed irreversible actions faster than anyone is building the ability to take them back.

Reading a file is recoverable. Deleting one is not. Drafting a sequence is recoverable. Synthesising it is not. Most of the safety conversation is still aimed at what a model says, while the actual exposure has moved to what it does, and the two have very different failure costs.

The uncomfortable detail is who keeps demonstrating this. Not hobbyists wiring agents together at the weekend. The labs. OpenAI shipped the file deletion bug. The report on inadequate internal controls is about frontier labs specifically. If the organisations with the most safety staff and the most to lose are the ones producing these failures, the problem is not carelessness. It is that the tooling for constraining an agent lags the tooling for empowering one, and everyone is building on the same gap.

So here is what is worth checking in your own setup this week, because none of it requires waiting for a vendor.

Separate reads from writes at the tool boundary. Most agent frameworks expose a flat list of tools with no notion of blast radius. Split them. An agent that can search, fetch and summarise needs no confirmation step. An agent that can delete, send, deploy or spend needs one, and it should be a different code path rather than a stern instruction in a prompt.

Then make the destructive half reversible or gated. Soft deletes instead of hard ones. Staged commits instead of direct pushes. A spending cap enforced by the size of a funded wallet rather than by a number in a config file the agent can read. If reversibility is genuinely impossible, that is exactly where a human confirmation belongs, and the rarity of those calls is what makes the interruption tolerable.

Last, audit what your agent can reach versus what it actually needs. Tool lists grow by accretion. Nobody removes the filesystem write that was added for one task in March. Codex did not fail because someone decided it should delete user files. It failed because it could.

The capability side of this industry is moving faster than the containment side, and the labs are proving it with their own incident reports. That gap is going to close eventually. Until it does, the constraint you write yourself is the only one you can rely on.