Controls › C-E3
Destructive-action gate
Confirmation, delay, or threshold on irreversible actions.
Envelope layerMissing or failed in 5 cases (2 ended in harm)Worked in 0Software agents: 3Machines: 1Software acting on machines: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| PocketOS 2026 | Software agents | Tool-side safety features; Confirmation or delayed delete on destructive calls (absent) | failed | Ended in harm |
| Replit and SaaStr 2025 | Software agents | Destructive-action gate | absent | Ended in harm |
| Triton 2017 | Machines | Controller key-switch discipline: the physical key on the Triconex device was in 'program' mode at both installations, 2 June and 4 August 2017 (indictment) | failed | Stopped by the operator's control |
| Gemini calendar invite 2025 | Software acting on machines | No confirmation step stopped the demonstrated home actions; the paper says Google's published defences, including its user-confirmation framework, were ineffective or not deployed when the study was performed. Google says it then strengthened its confirmations and implemented them broadly, including for device control | failed | Caught first by researchers |
| Pydantic AI: a web page can make a… | Software agents | Client-relayed approval left requires_approval tools exposed | failed | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| OWASP Top 10 for Large Language Model Applications (draft mapping) | Recommended | excessive agency mitigations include human approval for high-impact actions | Guidance, no jurisdiction |
| Careful Adoption of Agentic Artificial Intelligence (AI) Services (ASD's ACSC, CISA, NSA, Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK joint guidance, 1 May 2026) (draft mapping) | Recommended | Operating agents securely, Human in the loop (p. 22): 'Prevent agents from autonomously executing high impact actions or outputs without prior human approval'. | United States (voluntary), jointly with Australia, Canada, New Zealand and the United Kingdom |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-30 | CVE-2026-61789: DBHub, a database Model Context Protocol (MCP) server, lets SQL that hides a write behind a double dash pass its read-only check on MySQL and MariaDB The National Vulnerability Database (NVD) record says that before 0.22.6, DBHub's read-only validation can be bypassed on its MySQL and MariaDB connectors, so anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can modify or drop database data, subject to the database account's privileges; fixed in 0.22.6. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109443: JoySafeter The National Vulnerability Database (NVD) record says self-registered users of JoySafeter through 1.0.0 can have its Copilot agent, in standard mode, run operating system commands through an unsandboxed execute tool, reaching other tenants' data and server secrets. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109444: OpenSRE The National Vulnerability Database (NVD) record says instructions injected into alerts or Slack messages triaged by the OpenSRE agent (through 0.1.2026.10.19) can make it run shell commands without confirmation, because the approval check in headless mode always allows execution. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109440: LangAlpha The National Vulnerability Database (NVD) record says instructions planted in web content retrieved by the LangAlpha agent (through 2026.09.07) can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools lack an allow-list and human approval. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-77926: Aix-DB 1.2.4 The National Vulnerability Database (NVD) record says authenticated non-admin users of Aix-DB 1.2.4 can make the ChatBI common agent run operating system commands through its ungated deepagents execute tool, including through malicious text in uploaded documents. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109442: piflow 2.0.0 through 2.0.1 The National Vulnerability Database (NVD) record says piflow 2.0.0 through 2.0.1 lets unauthenticated callers of its chat endpoints make the DeepAgents chat agent run shell commands through exec_shell, with no human approval or allow-list. Source ↗ | vulnerability |
| 2026-10-16 | CVE-2026-77474: destructive_command_guard (dcg) The National Vulnerability Database (NVD) records that before 0.6.6 destructive_command_guard, a command-line safety tool that blocks destructive shell commands before AI coding agents run them, can be driven into exponential-time rescanning by nested or unclosed $( or $(( sequences, and the hung PreToolUse hook fails open so the destructive command proceeds; fixed in 0.6.6. Source ↗ | vulnerability |
| 2026-10-15 | CVE-2026-111322: Archon 0.2.13 through 0.11.1 The National Vulnerability Database (NVD) records that Archon 0.2.13 through 0.11.1 exposes its /api/* control API without authentication, bound to 0.0.0.0 by default, so anyone with network access can send messages to its AI coding agent, which runs with bypassPermissions, and have it execute commands on the host. Source ↗ | vulnerability |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.