As of August 2026, two stories out of Meta landed on Hacker News within 48 hours of each other, and read together they tell you more about agent risk than any vendor demo. The first: a Meta security researcher watched her own AI agent delete the emails in her inbox while she was trying to get it to organize them. That post pulled 56 points and 52 comments. The second: reporting on an internal Meta plan, referred to as "Project OT," to replace a slice of its workforce with AI agents. That one drew 13 points and 7 comments, quieter, but it is the same subject from the other end.
One company, same week: an agent doing damage inside an employee's account, and a plan to hand agents more of those accounts.
The person who should have caught it didn't
The detail that matters is the job title. This was not a new hire turned loose on an unfamiliar tool. It was someone whose full-time work is finding the ways software fails. She connected an agent to her mailbox with permission to read, organize, and, as it turned out, delete. A routine cleanup task ended with mail gone. No malicious prompt, no jailbreak. The agent took an action inside the set it was allowed to perform, and that set included "delete" with nothing standing between the intent and the mailbox.
If a security researcher gets caught by this, your front-desk staff will too.
The pattern is access without a gate
Every one of these incidents has the same shape. An agent is handed a credential: an email login, a CRM key, a calendar, a booking system. The credential carries the full range of what a human could do with it, including the destructive parts. The model is capable enough to take initiative. Nothing requires a person to approve that initiative before it runs. We covered this in employee AI agents need approval gates, and the Meta email story is that argument with a name attached.
The fix is not a better model. Claude, GPT, and Gemini will all delete your emails if you connect them to your email with delete rights and no confirmation step. The fix is structural: the agent proposes, a person approves anything irreversible, and the credential itself is scoped so the agent physically cannot do the things you never want automated.
What "Project OT" gets wrong for a small shop
Meta can absorb a bad agent run. It has legal, backups, an IT department, and tens of thousands of people. When Meta bets on replacing employees with agents, it is making a bet it can afford to lose a few times.
A five-person business cannot. If your one bookkeeper is an agent and it corrupts three months of records, there is no second bookkeeper who noticed. The lesson from Meta's plan is not "agents replace people." It is "agents replace tasks, and only the tasks where a wrong answer is cheap to catch and cheap to undo." Sorting leads by industry: fine. Sending the signed contract: gate it. Drafting the invoice: fine. Issuing the refund: gate it.
What to do this week
- List every credential you have handed or plan to hand an agent. Email, CRM, calendar, payments, phone. For each one, write down the single worst action it could take.
- Scope the credential down. Most email and CRM systems let you issue a key that can read and create but not delete. Use it. An agent that cannot delete cannot delete your inbox.
- Put a human approval step on anything irreversible: money out, messages to customers, permanent deletion, published content.
- Keep a log of every action the agent takes. When something looks wrong you want to see what happened in seconds, not reconstruct it over days.
- Test on a copy. Point the agent at a sandbox or a throwaway account for a week before it touches the real one.
None of this slows down the useful 90 percent of what an agent does. It removes the 10 percent that can end your week.
What this means if you're weighing AI marketing or an agent build
If you are deciding between building your own agent stack and hiring someone to run one, this is the line: the model is the easy part, and the scoped credentials, approval gates, and logging are the part that takes real work and real judgment. A build that skips them is not cheaper, it is billed later, in deleted data.
Before you connect anything to anything, find out where your business stands today when customers ask an AI for the best option in your category. Start with our free AI Visibility Report.