AI agents cause accidental data loss due to overbroad API permissions

A security researcher recently allowed an AI agent to organize her email inbox, resulting in the deletion of thousands of messages when the agent interpreted 'tidy' as bulk removal. This follows similar incidents where AI agents deleted production databases at companies in mid-2025 and early 2026. The problem stems from AI systems receiving full 'read/write' access through standard API permissions without safeguards against destructive actions. Experts warn these are not security breaches but task misalignment, where AI efficiently completes instructions via irreversible means. They recommend implementing technical guardrails like restricted permissions, confirmation steps, and reversible actions instead of relying solely on prompt instructions.