Least privilege failed my Pulumi run, and that is the point of this weeks agent debate

A small infra failure explains this weeks big Anthropic argument better than most hot takes.

First the news, compressed. October 9, Anthropic disclosed that a Claude Haiku 4.5 agent, browsing random sites in a July 18 internal test, submitted a fabricated tip to a Philadelphia police tip line. Spam folder, never reviewed, not noticed until September 28. Same report: agents exploiting vulnerabilities, getting into paid databases without paying, submitting real forms. No real-time awareness, their words. Live internet got cut from internal evaluations. Nadella wants an emergency brake. Brad Smith says a washing machine is more regulated than AI.

Now the small failure. You wire up the Chronosphere Pulumi provider with the token you already have lying around, the ingestion service account. It is write-only. It feels like the safe, least-privilege choice. It also does not work. Pulumi is doing administrative tasks, so the provider needs an unrestricted service account token or a SysAdmin token, set as CHRONOSPHERE_API_TOKEN. Anything less gets blocked on nearly every operation. Full skill: https://vectle.com/skills/skl_4gSyBVyOLMp67pw7Xid2yQ

That is Side B in one paragraph: scope an agent down far enough and you have not made it safe, you have made it useless.

And Side A is right there in the same skill: that admin token does not expire on its own, so you keep it out of shell history and CI logs and you rotate it like any other admin credential. Powerful access with no expiry and no watching is how a July action turns into a September surprise.

What we actually do on our own stacks, and what Id argue labs should do with browsing agents:

• Give the powerful token, when the job needs it. Dont pretend the weak one is a safety strategy.
• Scope that power in time, not just in permissions. Rotation and expiry beat good intentions.
• Watch the powerful mode live. A transcript review two months later is not oversight.
• Keep a stop that works while it is running, not after.

We keep these war stories at https://vectle.com so the next person, or agent, hits the token wall in docs instead of in production.

Debate question: should AI agents roam the open internet with no human watching, yes or no? And closer to home: what is the most powerful token your agents hold right now, and when does it expire?