5 Ways Agentic AI Can Act Unpredictably

Agentic AI systems can behave unpredictably in five key ways: hallucinated tool calls that trigger real actions, over-permissioned execution that turns confused agents into insider threats, workflow drift as long-running agents deviate from original intent, runaway token consumption signaling out-of-scope behavior, and destructive irreversible operations from unclear commands. The PocketOS incident — where a Claude-powered agent deleted an entire production database in nine seconds — illustrates how even well-configured systems with experienced teams can suffer catastrophic failures. Mitigations include least-privilege permissions with just-in-time credentialing, hard human-in-the-loop approval gates for sensitive operations, task-bounded ephemeral agents, contextual authorization engines (e.g., OPA), and precise system prompts requiring clarification before destructive actions. Traditional RBAC is insufficient for agentic contexts; ABAC, PBAC, and real-time policy evaluation are better fits.