AI agent security: controlling what agents do

If you build agents

How do I stop my agent running a destructive command?

Put a check between the agent and the tool, so the command is answered before it runs. For Claude Code, after pip install -U arcezia and setting your key, arcezia-hook install adds a hook to ~/.claude/settings.json that checks each shell command, file write, web request and MCP call first: Claude Code setup.

LangChain and LangGraph, n8n and the other frameworks have their own setup pages. On a new key a call usually comes back REVIEW first, and the answer names what would release it.

If you run security

What stops an agent with valid credentials from doing damage?

Credentials answer who may act. They do not answer whether this call, with these arguments, should run now. In the PocketOS incident the token had been created for adding and removing custom domains but was scoped to any operation, and one delete call spent it.

An outside architect tested the public checking service. The report is published in full, including what it says it does not establish: “production security, regulatory compliance, certification, or suitability for deployment.”

If you answer to auditors or regulators

Can I show who approved what, and why each action was allowed?

Each decision gets a signed record with its reason, made before the action runs; a later change to a stored record shows when it is checked. A person’s approval is a token your backend signs after the person clicks Approve, bound to one call and used once. An approval the agent merely claims is refused.

The developer docs map these records to EU AI Act Articles 9, 11 and 12, 13 and 14, and 15: Receipts and compliance. The record is evidence, not a certification, and using it does not by itself make a system compliant.

If you run the business

What could my agent cost me?

The incident pages record what was lost and what came back. In 5 of the 6, the damage was done by a tool call, not by what the model wrote.

• OpenAI agents and Hugging Face: code ran on 41 production workers; Hugging Face rotated every token, credential and signing key and rebuilt core infrastructure.
• PocketOS production volume: three months of bookings and payment records gone; restored first from a three-month-old backup, then by Railway.
• OpenClaw inbox deletion: hundreds of emails trashed or archived; the agent stopped only when the processes on the host were killed.
• Lobstar Wilde token transfer: tokens sent to a stranger's wallet that cannot be recalled; no recovery has been reported.
• Replit production database: production data deleted; it came back through Replit's own rollback, the one the agent had said was impossible.
• Air Canada chatbot: a tribunal award of 812.02 Canadian dollars against the airline; no tool was called, the harm was in the words.

If you research or report on this

Where is the data?

Every incident comes from the agent-incident-ledger on GitHub, CC-BY 4.0, one file per incident. A file needs at least one primary source: the operator’s own post, the vendor’s statement, a court or regulator document. Press coverage is listed as secondary, never alone.

To dispute a classification, open an issue on the repository. To add an incident, open a pull request.

If you use AI agents

Is my agent safe to let act for me?

Ask three questions of any agent tool before you let it act for you.

• Can it be stopped before an action that cannot be undone?
• Does a person approve the risky steps?
• Is there a record of what it did and why?

In one incident on this site, stop messages sent from a phone did not halt the agent; only killing the processes on the host did.