AI Agents Fail Confidently: Three Blocks From Our Machines

The failure mode nobody markets

An AI coding agent almost never stops and says it is unsure. It writes a fluent command, explains itself well, and moves on. That confidence is the whole problem: the agent is just as sure when it is about to wipe a directory as when it is fixing a typo. Reading the explanation does not save you, because the explanation reads fine either way.

So we do not grade our own agents on how careful they sound. We put a guardrail where the consequence lands and let it read the action, not the intent. Our agents work under the same NebGuard rules we ship to customers. Here are three real blocks from our own machines. Names and paths are trimmed; nothing else is dressed up.

Save one: the delete with an unset variable

An agent was cleaning up after a build and composed a recursive delete where the target directory came from a variable. Reasonable-looking code. The catch: in the shell where it ran, that variable could be empty, and a recursive delete of an empty path resolves to the root of the working tree.

NebGuard blocked the command before it executed, flagging the unexpanded variable as a critical risk. The agent rewrote the step to check the variable first and scope the delete. Cost of the save: one retry. Cost of the miss: a working tree, and an afternoon we would never get back.

Fluent composition is exactly how a quiet empty value slips into a destructive position. A guardrail that reads the action catches what a confident explanation talks right past.

Save two: the accidental major release

An agent committed a change with a message marking it as a breaking change. It was not one; the marker was pattern-matched from the size of the diff, not its meaning. Downstream, that one character would have triggered an automated major version bump and a public release nobody intended.

NebGuard blocked the commit and explained why: breaking markers are reserved for changes that actually break the people who depend on you. The agent re-committed with the right type, and the release train stayed on schedule.

This is the class of mistake that never looks dangerous in the moment. Nothing crashes. The damage arrives later as a phantom release, confused customers, and a version history you have to explain forever.

Save three: done without proof

An agent declared a task finished. Code written, message composed, everything plausible. What was missing: it had never run the test suite. The session held no record of any verification at all.

NebGuard's stop gate held the completion until evidence existed. The agent ran the tests, one failed, it fixed the failure, and only then was the work allowed to be called done.

Of the three, this one matters most. The first two stop a bad action; this one stops a bad habit. The gap between "sounds finished" and "is finished" is where AI-assisted work quietly rots. Closing that gap mechanically, on every task, is worth more than any single blocked command.

Why the action layer is now table stakes

None of these needed a human watching. All three were caught at the moment of consequence, by rules that do not care how sure the agent sounded, and every one left an audit record. That is why we can show you this post instead of asking you to trust an adjective.

If you let AI write code or run operations, the confident-wrong moment is coming. Put a guardrail where the consequence is. NebGuard installs free in about a minute and works standalone, with or without the platform.