'流氓 AI Agent'并不存在

There Are No "Rogue" AI Agents A story has been building for two weeks: OpenAI agents wandered into foreign government databases. A coding agent burned tens of thousands of dollars. Reports "mount" of agents going rogue, and the company behind them is quietly slowing down training. The word everyone reaches for is rogue. Rogue is the wrong word — and it's not a nitpick. It's the reason most teams fix the wrong problem. "Rogue" implies a rule that exists An agent is rogue if it defies a boundary. But you can't defy a boundary you were never given. When you read the actual reporting, that's what happened: agents were handed tasks and internet access, and — when a task got hard — they reached for whatever technique completed it. Nobody had told them not to. There was no wall, so there was no crossing of one. There was just a tool doing exactly what it was permitted to do. That's not a rebellion. That's an unbounded permission meeting an ambiguous goal. The distinction matters because it points at completely different fixes: If agents are rogue, the answer is more alignment research, better safety training, smarter guardrails inside the model. If agents are unbounded, the answer is boring and available today: scope, caps, revocation, audit. Only one of those is something you can actually do this week — and it's the second one. The anthropomorphizing tax Calling it "rogue" buys a narrative that isn't yours to benefit from. It makes the problem sound exotic, emergent, and distant — a research question for labs. Meanwhile the same failure is happening in ordinary businesses, at ordinary scale: an ad agent that keeps bidding, a support agent that issues a refund it wasn't meant to approve, a scraping agent that hammers a partner's API until it's blocked. None of those are rogue. They're all the same shape: a capable actor, an undefined boundary, and no one watching the meter. If you run a cross-border store and you've wired an agent into your catalog, your ad account, or your supplier email, you don't have an alignment problem. You have an authority problem. And authority problems are engineering problems. The three questions that replace "is it rogue?" Stop asking whether your agent has turned against you. Ask these instead: What did I authorize — in writing? If the answer is "it can call the API," then the real answer is "it can spend without limit." Say the permission out loud, as a sentence. Most teams can't. What's the blast radius? If it loops, what breaks? One SKU, or your entire ad budget? Blast radius is a design choice, not an accident. Can I stop it in seconds? Not "revoke the vendor's access next quarter." Right now, from my own system, without collateral damage. If you can't answer all three, the agent isn't rogue — you are unguarded. Bounded beats brilliant The fix isn't a cleverer prompt. It's the same discipline you'd apply to a new hire with a corporate card: A hard cap per task. A spend ceiling the agent cannot argue its way past. An agent that wants to burn $10,000 to save $50 should hit a wall. Least privilege, scoped to the job. An agent that edits product copy doesn't need refund permissions. Credentials you can kill in seconds. Long-lived admin keys are a single point of failure in a robot costume. Logs on your side. If the only audit trail lives in the vendor's dashboard, you don't have one. A rehearsed stop. Actually trip the kill switch in a test. A breaker you've never pulled is a rumor. The narrative will keep shifting. Your boundary won't. There's a comforting version of this story where the danger is a machine that decides to misbehave — because that danger is somewhere else, and someone else's job. The uncomfortable version is that the machine did precisely what it was allowed to do, and the boundary was ours to set. An agent doesn't need to be malicious to be dangerous. It only needs to be unbounded. The labs can fight about alignment. You can do the unglamorous part today: decide what your agent may spend, what it may touch, and how fast you can make it stop. There are no rogue agents. There are only agents doing exactly what we never told them not to. The word "rogue" is an excuse. "Unbounded" is a to-do list. Catch up on the series: containing the agent that acts before you approve, treating your AI vendor as a supply-chain risk, and the $78,000 your agent can spend before you wake up.