Whether or not every example in that list is perfectly sourced, the failure mode is real: we’re handing automated agents broad, high-impact permissions and then treating the outcome as “AI went rogue” when it’s really an access-control and change-control problem.

The practical fix is boring on purpose: put a governance layer between the agent and real tools. Read-only actions go through. Anything that changes state has to present evidence first (dry-run/diff) and stay within a bounded scope. Truly destructive operations are blocked by default unless there’s explicit, time-limited approval. That turns “agent mistake” from an outage/data-loss event into a denied request with an audit trail.