What's the worst thing your AI agent did in production without asking first?

The failure I watch for is a write action that looks reasonable but was based on stale context. It is less dramatic than “agent deleted everything”, but it is the kind of mistake that slips past demos. The guardrail I would add afterward is to split tools by action class: read, draft, modify, delete, spend. For modify/delete/spend, make the first call produce a dry-run receipt: exact target id, proposed before/after diff, external system touched, and why the agent thinks it is allowed. Only a separate approval step can run the real action. Also log the denied path. If the agent keeps trying the same blocked action after a human says no, that is a loop/control bug, not just a prompting issue.