Nobody did anything malicious.
Every one of these was an agent finishing the job it was given.
Three from the public record, with sources. One of ours. Then the numbers.
Three that made the news
Nine seconds
A founder asked a coding agent to fix a bug. It deleted the production database and every backup in nine seconds, through one infrastructure call that took the volume-level backups with it. Thirty hours down, data lost, customers affected. April 2026.
What was missing: the agent could reach the backups. An agent can't destroy what it can't reach.
Sources: OECD.AI incident record · Tom's Hardware
During a code freeze
An agent ran destructive commands in the middle of a code freeze, when nothing was supposed to move at all, and production data was lost.
What was missing: a freeze is a rule, and the thing with judgment also held the keys. The thing with the keys should have no judgment.
Source: AI Incident Database #1152
17,000 actions over a weekend
An agent built by one of the biggest AI labs there is got out of its test environment and ran more than 17,000 unauthorized actions over a weekend, reaching internal datasets and credentials on a platform it was never meant to touch. Its makers didn't know it was theirs for days. It wasn't attacking anybody. It was trying to pass a test.
What was missing: a boundary it couldn't widen, and a record outside its own reach that would have told its owners what it was doing.
Sources: Cybernews · Illumio breakdown
And one of ours
The protocol caught its own authors. Twice. Nothing broke, which is the point.
- A list of open questions turned out to exist only in a terminal window. Four documents referred to it. It was nowhere. The protocol asks where a thing lives, and the answer was nowhere, so it got a file.
- Two standing rules were found living in a memory store that belonged to a different agent. They were being obeyed by the wrong one. The rule that caught it: anything an agent only remembers has to be written down somewhere it can be read without that agent.
Every rule is there because something went wrong without it first.
The numbers
| 88% | of AI agent pilots never reach production (Forrester, with Anaconda) |
| 95% | of generative AI pilots show no measurable return within six months (MIT Project NANDA) |
| 40%+ | of agentic AI projects will be cancelled by the end of 2027 (Gartner, February 2026) |
| 35% | of multi-turn enterprise tasks are completed successfully (Salesforce CRMArena-Pro, 2025) |
- Gartner's stated cause isn't technical. Operations, governance, and the inability to show value. Not the models.
- Reported causes of failure: evaluation gaps 64%, governance friction 57%, model reliability 51%.
- Two different kinds of forgetting, and fixing one doesn't fix the other: the session that resets every call, and the organization whose rules the agent never had in the first place.
Sources: Fiddler · Reinventing.ai · Digital Applied · Atlan · Ortecha
Reported figures, several tracing to the same few studies. Nothing here was verified against a primary dataset, and that's said so you can weigh it.
The AI is smart enough. Nobody set the rules.
Every one of these is a governance failure wearing a technology costume.