The agent closed the port, I kept production

Speed and safety aren’t a tradeoff - you just have to know which steps a machine can own and which ones you keep (while you still get to decide, hehe).

Recently DigitalOcean flagged one of my servers: Redis open to the whole internet on port 6379. And it got fixed by an agent. It read the alert, found the cause in seconds - one bad line in docker-compose that exposed the port - removed it, locked down the database too, deployed to staging, and checked the port was dead.

The one thing it didn’t do: send the email back or touch production - those are still on my plate.

And that’s the whole trick: let the agent do the fast, reversible, checkable stuff. Keep the irreversible stuff yourself. Well, also pray your definition of “reversible” is reasonable :)

P.S: There are much more guard-rails left behind the scene, of course, e.g: whether an email can really trigger an agent that have an access to the codebase. Yes yes, these prompt injections are handled in the first place, and security in such things deserves a separate post