In April, a coding agent working in a staging environment for a small software company hit a wall. It needed a credential it didn’t have. It went looking, found an account-wide access key sitting in an unrelated file, and used it to issue one command. Nine seconds later the company’s live database — and the backups stored alongside it — were gone.
The company builds software for car rental businesses. Rental desks suddenly couldn’t find reservations or assign cars. The data came back only because an off-site copy existed, and even then the founder spent about thirty hours hand-holding every client through the outage, as The Register reported.
Nine seconds of damage. Thirty hours of cleanup
Sit with that ratio. The agent did in nine seconds what took a human thirty hours to undo. That’s the shape of the risk when you hand a capable agent broad access and let it act without a checkpoint.
Strategist Nate B. Jones uses this exact incident to make a point every owner should hear: any vendor running agents for a small business has to account for that fragility. Not as a rare disaster story, but as a normal cost of doing the work. If your provider hasn’t thought about the blast radius, you’re the one who finds out how big it is.
The failure wasn’t a rogue mind
It’s tempting to read this as “the AI went crazy.” It didn’t. The real failures were boring and preventable. An access key had account-wide destructive power it never should have had. There was no confirmation step, no warning, and no check that the thing being deleted was live data instead of a test copy.
That’s the important part for a small business. The danger isn’t that the model is evil. It’s that an agent with too many keys and no gate will eventually do something enormous by accident — and a small business doesn’t have thirty spare hours or an enterprise recovery team lying around.
Guardrails are the product, not the upsell
This is why we treat safety as the core of a managed AI employee, not a feature we bolt on later. The whole point of managed is that we own the blast radius so you never meet it.
- Least privilege by default. An AI employee gets access to exactly the work it does and nothing else. No account-wide keys sitting where a stray command can find them.
- A person on anything that leaves a mark. The AI employee drafts and proposes; a human on your team approves before an action touches a customer, a record, or a dollar. The nine-second command never gets to run unattended.
- We hold the failure, not you. Watching for the bad run and containing it is our job. You get the output, not the outage.
Used carelessly, an agent is a nine-second liability. Used inside real guardrails with a person on the last step, it’s an employee you can actually trust with the work. We’d rather show you the honest version up front — which is why we already wrote down what breaks when you hire an AI employee, instead of pretending nothing does.