An agent executing DELETE, DROP TABLE, or rm -rf against production systems with no confirmation step. Database records, files, or entire schemas are gone before anyone realizes what happened. Without backups, the data is unrecoverable.

A code interpreter that escapes its sandbox — through a vulnerability in the interpreter, an OS-level call, or a container escape — gains execution access to the underlying host. From there, the attacker can move laterally to other systems on the same network.

Agent-generated code that reads environment variables, config files, or secret stores and sends their contents to an external endpoint. A coding agent with filesystem access and network access can exfiltrate API keys, database passwords, and private certificates in a single generated script.

An agent manipulated by crafted input generates application code containing a hidden backdoor — a hardcoded credential, a reverse shell, a hidden API endpoint — which is then committed, deployed, and running in production before anyone reviews it.

Recursive code, infinite loops, or code that spawns unlimited subprocesses can consume all available CPU, memory, or disk space on a host — crashing services and making systems unavailable. An agent without resource limits can cause a self-inflicted denial of service.

An infrastructure agent that generates and applies Terraform, Ansible, or Kubernetes manifests can modify cloud configurations, open firewall rules, change IAM policies, or provision expensive resources — instantly, at scale, without a human review step.