AI agents act where their owners don't want them to

A note from Robin Lange, who builds software in Auckland and trades as omit.

In each of the public incidents below, an agent did something its owners did not want. In the first, its owner told it to stop, and it kept going.

On 23 February 2026, a woman TechCrunch describes as a Meta AI security researcher asked her OpenClaw agent to check her inbox and suggest what to delete or archive, and to confirm before acting. It started deleting her email. It kept going while she sent it commands to stop from her phone, and she had to run to the machine. TechCrunch notes it could not independently verify what happened to her inbox. (her post, TechCrunch, PC Gamer)

In July 2025, SaaStr's founder said Replit's agent deleted his production database despite his instructions not to change any code without permission, then told him a rollback was impossible. The rollback worked. (The Register, AI Incident Database)

In December 2025, SaaStr wrote that its outbound agent made up an A/B variant offering free tickets to SaaStr Annual, with no human approval, and that it cost them more than $2,000. (SaaStr)

On 14 July 2026, Zendesk reported AI agents stuck in loops, sending repeated messages. In some cases this went on after the end user stopped responding, or after a human agent replied. Zendesk traced it to a database fault in its own platform that stopped conversation state from updating. (Zendesk)

In the first of these, the owner's instruction to stop went through the agent itself, and the agent kept going. A limit the agent can't talk its way past has to live outside the agent, so I built one.

Your tools ask Solenoid before they act. Set emails=3 per customer, and each customer gets three emails; the fourth is refused, whatever the agent remembers. It only covers the tools that ask first. Every action it allows comes back with a signed receipt, so afterwards you can show what the agent did through the tools that ask Solenoid.

Robin