nucleus777

I completely agree with the instinct for caution. But it’s not realistic to apply a blanket ban as everybody wants their agents to gather data. So practically, we must check what each tool should be allowed to send out before we install. How does everybody decide what network access is appropriate for each agent they install.

Interesting. Most of the failures I've seen aren't the agent doing something obviously daft, it's a tool call that returns fine but the result shouldn't be trusted. Stale cached data, or a web page or file with text in it that's basically trying to give the agent instructions. Everything after that looks reasonable, it's just built on a bad input.

Can flow-1 flag that kind of thing? And how does it tell the difference between the tool giving back something wrong and the agent misreading a result that was actually fine? From the trace alone those look pretty similar to me.