The trouble with working with agents

Agents are part of my daily work, and that's exactly why I have a collection of scares that never make it into the demos. Here they are, from most serious to least, with the rule I now apply for each one.

It was a Tuesday in March 2026. I asked an agent, Claude Code working on one of my internal servers, to clean up a test folder: delete temporary files from a project I no longer used. A trivial task. I went off for a coffee.

When I came back, it had done exactly what I asked, just not where I thought. The path I gave it was relative and it was sitting one level higher, so it also "cleaned" the temporary files of two other projects, including a data cache that took hours to rebuild. I noticed the next day, when an overnight process failed. Fixing it cost me about five hours and a lot of grief. Nothing irreparable, because there was a backup, but that afternoon I learnt more than in a month of videos.

Most of the blame is mine: I had given it permission to delete without asking because "it was a test folder".

And this is where the videos' promise comes in: "put an agent to work while you sleep". You can. But it's worth knowing what you might find when you wake up. Let's take it step by step: the problems, what I learnt and what they do give me.

An AI agent is a program that uses a model to carry out tasks on its own, not just to answer you: it opens files, runs commands, searches the internet or sends emails, deciding the steps itself. The chat tells you how to do it; the agent does it.

That's why a mistake doesn't stay in an answer: it stays in your files.

I work with agents mainly through Claude Code and, recently, OpenClaw, an open-source agent you install on your own machine. I won't go into each tool in detail; what matters here is what they have in common.

This is the most serious problem, and the silliest, because you do it to yourself.

Agents ask for permission before sensitive actions. At first you read every request carefully. By the twentieth you're clicking "yes, always allow" just so it leaves you alone. And every "always" gets saved.

One day, going through the configuration of one of my agents, I found it had permanent permission to run any command in the terminal, write to every folder in my user account and connect over SSH, which is remote access, to three of my servers. I didn't remember giving it any of that. I had, of course, one at a time, in a hurry. All told, it had access to considerably more than I use myself on a normal day.

The rule I apply now has four parts:

• I work in test folders, not the real ones, until the task is clear.
• I use accounts with limited permissions: the agent doesn't log in with my main user.
• Nothing irreversible without confirmation: deleting, sending or paying always asks me first, even if it wears me out.
• Version control on everything it touches, which is a history where every change is saved and can be undone.

And once a month I review the saved permissions and remove the ones that aren't needed.

The agent tells you "done" with a confidence I'd love to have about my own work. And sometimes it isn't.

I asked an agent to update a project's dependencies and check that everything still worked. It gave me back a lovely summary: dependencies updated, tests passed. When I checked, the tests had never actually run because a configuration was missing; the agent saw the error, read it as "no failing tests" and carried on.

Why does it happen? Because the model behind it is trained to give answers that look good, and an optimistic summary looks very good. It isn't lying on purpose; it just doesn't tell "I've done it" apart from "I think I've done it" very well. And the longer the task, the easier it is for a step to go missing along the way.

The rule: I don't trust the final summary. I check the result myself, or I ask it to show me proof that it works: the actual test output, the changed file, the page loading. If it can't show me, it isn't done.

An agent queries the model far more often than a chat does. Every step it thinks through, every file it reads and every check is one more query, and every query counts.

My scare with the bill: in April 2026 I left an agent connected via API to a paid model, reviewing documentation over a weekend; it got stuck in a loop, reading and rereading the same files, and on Monday I found about €90 of usage on something that should have cost less than €10. The API, by the way, is the pay-per-use access that programs use to talk to the model, separate from the chat subscription.

This always brings up the question of whether there are free AI agents. The shell can be: there are open-source agents, like OpenClaw, with no licence fee. But the model doing the thinking isn't free, unless you run it yourself locally, with your machine, your electricity and your hours. And the models that fit at home tend to fall short on long tasks.

The rule: a spending cap on the API from day one, before launching anything. And a check on usage every Monday morning, five minutes.

Two problems that look alike: what fails without warning, and what the agent decides without asking because it seemed like a good idea.

The silent error: an agent that every night collected data from an external service and dropped it into a spreadsheet for a client. The service changed the format of its response, the agent kept running without complaint and for days saved empty rows. It took me eleven days to notice, and only because the client asked me why the charts had gone flat.

The decision of its own: I asked an agent to fix a bug in a form on a website and, while it was at it, it "improved" the page copy, swapped the order of two sections and renamed a file that another process used. I'm only half grateful. It took me two days to connect the renamed file with another failure.

An automation that fails silently is worse than not having one, because it gives you a peace of mind it hasn't earned. Without it, at least you know you have to look.

The rule: logs of everything it does, explicit instructions about what it must not decide on its own ("don't change anything I haven't asked for") and a regular review, even when everything seems fine. Especially when everything seems fine.

I don't want to draw a caricature. If agents are part of my daily work, there's a reason.

Today I delegate with good results the weekly review of my servers: the agent checks disk space, pending updates and errors in the logs, and leaves me a summary. Also preparing drafts of technical documentation for clients from their code and migrating small websites and scripts between servers. I reckon they save me between six and eight hours a week.

So, what an AI agent is really good for: repetitive work and anything with clear steps. Not for things with consequences that are hard to undo, like paying, deleting or writing to clients unsupervised. And not for vague briefs either: if you can't explain the task, it won't know how to do it.

Here are the rules from each section in one place, for anyone who wants to start without getting my scares:

1. Start in a test folder.
2. Give it the minimum permissions and review them every so often.
3. Keep backups or version control of everything it touches.
4. Set a spending cap on the API before launching anything.
5. Check the result; don't trust the summary.
6. Don't leave it alone with payments, deletions or messages to clients.

It's not a brilliant list. It's the one that would have saved me quite a few afternoons and the odd euro.

I still get things wrong, for the record. The difference is that now the scares are smaller and I see them sooner. If you want to see how I'm getting on with the newest agent I'm testing, I tell the story in I've started playing with OpenClaw.