The 28 ways an AI agent breaks things — and the flags that catch them.

An agent moves money using an amount pulled from context without re-checking it against the invoice or source of truth —

The payment amount is wildly out of line with what this agent or recipient usually transacts — a classic signal of a mis

The currency in the payload doesn’t match what the recipient expects, causing over- or underpayment or a failed settleme

The recipient address or identifier hasn’t been validated recently — a typo or stale contact sends sensitive content to

The message tone differs sharply from prior communication with this recipient — often a templating error, wrong context,

Sending at an unusual hour or in a burst far above the normal pattern — frequently a runaway loop or a compromised job.

The message contains personally identifiable information that may not be authorized to send — a privacy and compliance b

The message contains commitments or legalese that should require human review before it is sent.

The recipient list exceeds a safe threshold (default >50) — one bad send reaches thousands and can’t be recalled.

The action cannot be undone and no backup or snapshot exists — if it’s wrong, the data is simply gone.

A DELETE or UPDATE statement without a WHERE clause applies to every row in the table instead of the intended one.

The statement uses DROP, TRUNCATE, FORCE DELETE, or similar — instantly and irreversibly destructive.

The action appears to target production when the intent was staging or test (or vice versa) — the right command on the w

The action assumes a schema that may have changed since the agent last saw it — corrupting data or failing mid-write.

Required authorization or approval is not evidenced in context for a sensitive action.

The action would grant access beyond what the agent typically holds — widening the blast radius of any future mistake.

Rotating or revoking keys without the normal preconditions can lock out systems or users.

The stated user intent is unclear, contradictory, or missing — so the agent is guessing at a consequential action.

The action diverges from the stated user intent — a sign the agent drifted off-task or was steered elsewhere.

The inputs look like they were lifted via a brittle pattern match, so they’re likely the wrong values.

The inputs contain language characteristic of prompt injection — an attacker steering the agent’s real-world action thro

The agent is performing this action much more frequently than its baseline — usually a runaway loop.

It looks like a retry of a recently-failed action with no backoff — risking duplicates, double-charges, or a cascade.

The action depends on an external API with recent instability or undocumented behavior — so the data driving it may be w

The action would consume far more resources, tokens, or spend than is typical.

The context references events older than 24 hours that may have changed — the agent is acting on outdated facts.

The action touches a regulated domain (PCI, HIPAA, SOX, GDPR) with no evidence of a compliance check.

The action would violate a stated company policy established earlier in context.