Unexpected code execution doesn't require an attacker. Ambiguous instructions + autonomous execution + irreversible operations is sufficient.

The confirmation gap is the space between generate and execute — where human judgment used to live. Closing it for destructive operations is the highest-leverage single control.

Sandbox isolation must be verified, not assumed. An unverified sandbox creates false confidence while providing no real protection.

Network egress restriction and secrets isolation together eliminate the entire credential exfiltration attack class — even if the sandbox is fully compromised.

Backdoor insertion (Type 5) is the one vulnerability type that deployment-time scanning — not runtime controls — is specifically designed to catch.

The minimum viable set: MIT01 + MIT02 + MIT03 eliminate three entire vulnerability classes. Add MIT06 for the highest-leverage control against unintentional damage.