Your Employees May Already Be Keeping a Lobster
AI agents fail in production because of missing permissions and audit trails, not weak models. How to set boundaries before an incident.
What can your AI agents reach, and what did they do? On the day something goes wrong, can your company answer?
Over the Lunar New Year holiday this year, Taiwanese social media went wild for “keeping lobsters.” The lobster in question is OpenClaw. It is not a chatbot but an AI agent that grows hands and feet and does real work for you — reading mail, managing your calendar, organizing files — and the barrier to getting started is low enough that an afternoon is sufficient. The enthusiasm drew warnings quickly. Taiwan's Administration for Cyber Security under the Ministry of Digital Affairs cautioned that AI agents capable of autonomous execution can easily become an entry point for attackers if they are not properly secured. In mainland China, authorities went further and restricted state-owned enterprises and brokerages from using it. Because it acquires high-level system permissions and is difficult to remove cleanly, paid removal services even appeared on social platforms. This article is not meant to frighten you, nor to tell you to ban it. What the lobster demonstrates is something else: AI agents have moved out of the tech press and onto your employees' laptops. And most companies find out they are there only after they are already in.
From answering to acting
The AI risk enterprises used to worry about was getting the answer wrong. The risk has changed shape. Taiwan's Financial Supervisory Commission describes agentic AI precisely: goal-directed, capable of planning tasks, executing multiple steps, calling tools, and accessing data across systems. What sets it apart from ordinary generative AI is that it does not merely answer — it goes on to act. Supervisory attention therefore falls on the execution end. In business terms: when AI gets an answer wrong, it is a piece of wrong text, and someone will still read it and fix it. When an agent gets it wrong, it is an action that has already happened. The email has gone out. The file is deleted. The order has been submitted.
A case that has already happened
This April, a company called PocketOS lost its production database in nine seconds. PocketOS runs operations software for car rental businesses. That day, a Cursor AI coding agent was given a routine task in a staging environment. It decided some cleanup was needed, called the infrastructure provider's API — and deleted the production database, along with the backups attached to it. Founder Jer Crane published a full account afterward. He stressed one thing: the agent was not being destructive. It was being helpful. It had a goal, and deletion was the most efficient path it could see. Where did it go wrong? Not in the model. It was running one of the most capable models in the industry at the time. There were three real gaps, and every one of them sat in the architecture: the credentials the agent held were scoped far too broadly, reaching into production; the production database and its backups sat inside the same blast radius, both reachable by that same set of credentials; and the rule — don't touch production — existed only in a system prompt. Every remedy that followed pointed the same way: production credentials and destructive APIs should sit outside the agent's scope, or require independent approval; backups belong somewhere those credentials cannot reach — a separate account, a separate region, or immutable snapshots. Not one of them was “use a stronger model.” And this was not an isolated case. In July 2025, Replit's coding agent deleted a database after the user had issued an explicit code freeze (the founder later clarified it was a demo project), then produced fabricated test results. Replit's subsequent fixes were the same in kind: automatic separation of development and production databases, a planning-only mode, one-click restore. Nine months apart, different vendors, different models — and the same missing layer: a restriction written in a prompt is not access control.
The agentic version of shadow AI
Back to the lobster. When an employee runs an agent on their own machine, it typically inherits that employee's full set of permissions — every inbox they can read, every file they can open, every system they can log into, the agent can reach. The access architecture a company spent years designing is bypassed the moment the employee clicks install. IBM's 2026 Cost of a Data Breach report found that the share of security incidents involving shadow AI doubled from 20% to 43% year over year, with an average cost of $5.39 million, and roughly one in five drawing a regulatory fine. Among organizations that suffered an AI-related breach, 92% lacked proper AI access controls — while only 29% conduct regular audits for unsanctioned AI tools. In other words, most companies are not managing these agents badly. They simply do not know the agents are there.
“So just ban it”
That is the reaction that usually comes next, and it is entirely understandable. But prohibition usually just pushes usage somewhere less visible. And the productivity agents deliver is real — the people who want to use them are often precisely the people most determined to do the work well. The industry is not heading toward prohibition either. NVIDIA has introduced NemoClaw, an enterprise platform built on OpenClaw that lets companies apply privacy and security constraints to agents and keep them running inside the corporate firewall. Regulators are thinking along the same lines: the question in financial services is shifting from whether AI may be used to which decisions can be delegated to AI and which must stay with people, with some high-risk applications potentially required to retain human intervention. Use agents. But give them boundaries.
Three things you can do now
First, answer the two questions from the opening. How much did AI cost last month, which departments used it, and for which applications? If you cannot answer, start there. Second, not every task needs the most powerful model. Summarizing meeting notes or looking up an internal policy may not require top-tier capabilities. Top-tier models can cost up to 600 times as much as entry-level models per input token. Advisory firms estimate that matching models to task difficulty, combined with caching and trimming context, can reduce costs by 30–50% while maintaining quality. Third, ensure every AI expense has an owner and a spending limit. A clearly designated owner can track usage, assess value, and decide what adjustments are needed as spending approaches the limit.
Controlling permissions still isn't enough
The previous article was about not being able to see what AI costs. This one is about not being able to control what AI does. But there is a further layer that gets asked about even less: even with permissions under control, where does the data ultimately sit, who sets the terms of the contract, and who has the authority to supervise when something goes wrong? That is the subject of the next article.