After Australia’s first reported automated hacking accident, experts warn deployers – and possibly developers – of AI agents could be held liable for the actions of their bots
When you’re doing local stuff that can’t do any damage due to the existence of things like source control, recycle bin, backups, etc sure, hit that button and let it fly.
Anything more important though, no - and every one I’ve used specifically warns you against it and that you should check its work. Claude, codex, copilot, grok, cursor, etc all do it.
Also you can do things like allow all work in a certain folder without asking permission again, if that folder is one you have no sensitive/important data in for example. Claude code will give you this option every time it accesses a new folder in a chat for example.
Local stuff absolutely can do damage to your local data, unless your backups are pull rather than push or are immutable on a file system they are potentially vulnerable. Unless the operating system specifically prevents the agent process from doing something telling it not to is like asking it to pinky promise not to, nothing stops it if the LLM output it relies on says to do so. It’s not deterministic like a regular program because it relies on the output from a chaotic black box text generator. All you can say is that it probably won’t do those things if it says it won’t.
I don’t really know what you want then? People who don’t know how to use a tool properly, but use it anyway, can cause lots of damage. That’s always been the case, and always will be.
There are plenty of safeguards in place, with more and more being added like docker sandbox for example, but nothing will stop confidently stupid people from wrecking their stuff.
What I’m saying is the way it’s marketed to be used is much closer to the wrong way and it’s far less of a productivity enhancer when used how it really should be and relies on having a lot more professional level IT skills.
When you’re doing local stuff that can’t do any damage due to the existence of things like source control, recycle bin, backups, etc sure, hit that button and let it fly.
Anything more important though, no - and every one I’ve used specifically warns you against it and that you should check its work. Claude, codex, copilot, grok, cursor, etc all do it.
Also you can do things like allow all work in a certain folder without asking permission again, if that folder is one you have no sensitive/important data in for example. Claude code will give you this option every time it accesses a new folder in a chat for example.
Local stuff absolutely can do damage to your local data, unless your backups are pull rather than push or are immutable on a file system they are potentially vulnerable. Unless the operating system specifically prevents the agent process from doing something telling it not to is like asking it to pinky promise not to, nothing stops it if the LLM output it relies on says to do so. It’s not deterministic like a regular program because it relies on the output from a chaotic black box text generator. All you can say is that it probably won’t do those things if it says it won’t.
I don’t really know what you want then? People who don’t know how to use a tool properly, but use it anyway, can cause lots of damage. That’s always been the case, and always will be.
There are plenty of safeguards in place, with more and more being added like docker sandbox for example, but nothing will stop confidently stupid people from wrecking their stuff.
What I’m saying is the way it’s marketed to be used is much closer to the wrong way and it’s far less of a productivity enhancer when used how it really should be and relies on having a lot more professional level IT skills.