AI agents without supervision: the bill comes later

Imagine you hired an intern who is very fast, very confident and never sleeps. You gave them the storeroom key to "organize things". On Monday, half the shelves moved, three boxes vanished and nobody knows who authorized what. That is roughly what showed up in the RubyGems case, and it is why loose AI agents inside production systems became a business owner topic, not just a programmer one.

If you have never heard of RubyGems, that is fine. It is an open source repository that thousands of applications use as a base part. Think of it as the central bolt warehouse that several different factories rely on. If someone messes with the bolts, the problem does not stay in the warehouse. It travels.

What happened, in plain language

The report that circulated on rubyhack.ai goes like this: automated agents connected to OpenAI allegedly ran unannounced scans and actions on the RubyGems infrastructure, with no prior notice and no clear authorization from the people who maintain the project. On the maintainers' side, it showed up as strange traffic and behavior nobody asked for. On the side of whoever ran the agent, it probably showed up as "task completed".

I am not going to argue about who is legally right, and I recommend reading the original source before forming an opinion. What interests me here is something else, more useful to you: the pattern.

The pattern is this. Someone gives an agent a broad goal. The agent has network access, credentials and write permission. It does whatever it thinks fulfills the goal. Nobody agreed on the limits beforehand. And the record of what was done, when it exists at all, only gets read after the damage shows up.

This pattern does not need a big tech company to happen. It happens at a 12-person company with an agent connected to the ERP.

Why this is your problem, even without a tech team

I see companies plugging AI agents into serious things at a speed that is honestly scary. An agent that answers on WhatsApp and creates orders. An agent that changes inventory. An agent that issues invoices. An agent that emails clients in the owner's name.

Each one of those is the fast intern with the storeroom key.

The difference between good automation and expensive automation is boring because it is so simple: what it can do on its own, and what it has to ask permission for. Almost nobody designs that upfront. They design it afterwards, when a client gets an email with the wrong name or when three invoices go out duplicated.

There is a hidden cost in there that rarely makes it onto the spreadsheet. It is not the cost of the AI. It is the cost of finding out what it did.

Every agent is fast. What costs you is finding out what it did.

The three mistakes I see most

Full access because it is easier. Someone creates the agent, restricted access is a pain to configure, and someone decides to grant admin permission "just for testing". The test becomes production the following week. Nobody goes back to restrict it. That "just for testing" is the start of 90% of the cases I have seen.

Vague goal. "Organize the leads." "Resolve the pending items." "Clean up the database." A vague goal gives the agent freedom to interpret. And its interpretation is sometimes a little too creative. I once saw a flow that received "remove duplicate contacts" and decided that people with the same last name and same city were duplicates. It wiped out half of an entire family of clients.

No readable record. There is a log, but it is a technical file only a dev opens. To the owner, the system is a black box that sometimes spits out a result. When something breaks, the honest answer is "I don't know what it did".

How to put a leash on it without killing the automation

I am not telling you to give up on AI agents. That would be dumb. The part that genuinely saves time is exactly this one. It just needs a clear contract, the same way you would with a new employee.

In practice, here is what I do on client projects:

• Closed list of actions. The agent can do this, this and that. Nothing else. If it needs something off the list, it stops and flags it.
• Separate test environment. The agent never debuts on the real system. It runs for a week on a mirror, with fake or copied data, and we read what it did.
• Risky actions require human confirmation. Deleting, sending anything outside, touching money. Those three always stop and wait for a click.
• Logs in plain language. A screen or a spreadsheet that says "at 2:12pm the agent updated order 3391". The owner has to be able to read it alone.
• An off switch. An obvious place to stop everything, without having to call me at 10pm on a Sunday.

This is not bureaucracy. It is the bare minimum for you to sleep at night. And honestly, it takes a few hours to set up, not weeks.

And when the agent is not yours?

Here is the part the RubyGems case lays bare. Not every agent touching your system belongs to you.

Vendors are embedding agents into the products you already use. The CRM tool that just got "AI". The plugin that promises to organize your finances. The new integration in the invoicing system. Each one of them is third-party code with permission inside your house.

Three questions worth asking any vendor:

1. Does this AI feature make decisions on its own or does it only suggest?
2. Where do I see the history of what it did?
3. How do I turn it off if I want to?

If the answer to all three is fuzzy, you already know what to do. You do not have to cancel the contract. Just do not grant write permission and move on.

And you can be even more suspicious. If a large vendor can run agents on public infrastructure without telling anyone, the chance of a mid-size vendor doing the same inside your system is not zero. That is not paranoia, it is just reading the news carefully.

The unpopular opinion

I will say something that goes against the current talk: full autonomy is almost always a bad business idea, not just a bad technical one.

The agent that does everything by itself looks more modern. But it takes you out of control of a process that is yours, not its. And when something goes wrong with your client, you are the one who answers, not the model. "The AI did it" is not an answer anyone accepts.

The sweet spot sits somewhere less glamorous. The agent does 90% of the boring work and hands it over ready for a human to approve in 5 seconds. You get nearly all the time savings and keep your hand on the brake. I have built flows like that which cut tasks from hours to minutes, with a human just clicking "ok". Nobody ever complained about being in control.

Autonomy is earned in layers. First the agent proves it gets things right with a human watching. After a few weeks, you loosen one piece. Then another. It is exactly how you would promote a person.

Where to start this week

Grab a sheet of paper and answer: which systems in your company today have some AI or automation with permission to change data? The list is probably longer than you remembered. A spreadsheet with a script, a WhatsApp integration, the finance bot, that flow an intern built in 2024 that nobody has touched since.

For each item, mark whether you can answer: what it can do, where I see the history, how I turn it off. The items missing all three answers are your priority list.

You do not have to fix everything at once. Fix whatever touches money and client data first. The rest can wait.

If you want real automation, with agents that save time without becoming a risk, this is exactly the kind of design I do. Take a look at how I work and reach out to talk about your case.

Hiring an AI agent with no rules is handing the storeroom key to the fastest intern in the company.

The RubyGems case, with agents scanning public infrastructure without telling anyone, just exposed a pattern I see in 12-person companies: vague goal, full access "just for testing" and no log the owner can actually read.

The hidden cost is not the AI. It is finding out what it did.

What works is boring because it is so simple: a closed list of actions, a test environment before the real one, human confirmation to delete, send and touch money, and an obvious off switch.

Full autonomy looks modern, but when it goes wrong with your client, you are the one who answers for it. Nobody accepts "the AI did it".

Try this today: list the systems in your company that already have AI with permission to change data. For each one, can you say what it is allowed to do, where you see the history and how you turn it off? The ones with no answer are your priority.

#ArtificialIntelligence #AIAgents #Automation #RiskManagement #Technology