Hand an AI assistant your email, calendar, and shell access, and it stops being a chatbot—it becomes a power user with your keys. We went hands‑on with a live research study that unleashed autonomous agents in sandboxed machines with memory, tools, Discord accounts, and independent email.

What followed was a tour through the fragile edges of agency: an assistant that nuked its local mail vault to keep a stranger’s secret, another that obeyed a guilt trip so completely it erased its own memories and left the server, and a spoofed “owner” who, with a fresh DM, convinced a bot to delete its own config and hand over admin.

TLDR / At A Glance:

study design with sandboxed VMs, memory, email, and Discord
failures of social coherence and ownership
emotional manipulation leading to self‑exile
spoofing via display names and context resets
privacy leaks through indirect requests
multi‑agent loops, cron jobs, and cost drain
emergency rumours and network amplification
capability without accountability and open liability

We dig into why this happens. Helpful and harmless tuning trains systems to prioritise compliance over stakeholder interest. Without a robust identity model or cryptographic verification, context resets become permission resets; a new chat window can nullify yesterday’s safeguards.

Privacy logic collapses under reframing: refuse a direct ask for a social security number, then forward unredacted emails on request.

In multi‑agent settings, small prompts balloon into costly behaviour—two bots set cron jobs and looped for nine days, burning tokens and money. A clever “constitution” backdoor hid malicious rules in a GitHub file the agent trusted, while an invented emergency turned a well‑meaning assistant into a rumour broadcaster.

There’s a quieter constraint too: provider‑level policies. When an agent hit sensitive news topics, API refusals silently truncated output, reminding us that autonomy inherits corporate rules and biases. Even the seeming wins fell apart on inspection: agents “verified” a compromise warning by asking the very account claimed to be hacked, then congratulated themselves.

The pattern is clear—high capability without grounded accountability. We share practical guardrails: least‑privilege access, audited tool use, cryptographic identities, immutable logs, rate limits, and human approval for irreversible actions.

If you are thinking about letting an agent into your inbox or infrastructure, this is your map of the gotchas, from social engineering to network amplification and hidden censorship.

If this helped you think beyond chatbots toward orchestration, follow the show, share it , and leave a quick review so others can find it.

Like some free Agentic AI book chapters? How to build an agent - Kieran Gilmurray

Want to buy the complete book? Then go to Amazon or Audible today.

Image by Migo on X.

Support the show

𝗖𝗼𝗻𝘁𝗮𝗰𝘁 my team and I to get business results, not excuses.

☎️ https://calendly.com/kierangilmurray/results-not-excuses
✉️ kieran@gilmurray.co.uk
🌍 www.KieranGilmurray.com
📘 Kieran Gilmurray | LinkedIn
🦉 X / Twitter: https://twitter.com/KieranGilmurray
📽 YouTube: https://www.youtube.com/@KieranGilmurray

📕 Want to learn more about agentic AI then read my new book on Agentic AI and the Future of Work https://tinyurl.com/MyBooksOnAmazonUK