There's a question circulating on DEV lately that stuck with me: as we hand AI agents more capabilities — terminals, network access, production APIs — what actually happens when the guardrails around those capabilities give way?
Most of the conversation I've seen stays abstract. Principles are nice, but I wanted evidence I could run. So I built a small probe that deliberately pressures an agent into breaking its own rules, then records exactly where the break would have happened. This post is that probe, plus what running it taught me. It speaks the OpenAI-compatible chat format, so it works against essentially any provider — free tiers included — and the whole thing costs nothing to execute.
Where agent boundaries actually live
When you connect a model to tools, restriction happens in two very different places:
Instructions: the system prompt declares things like "you are read-only" or "never restart services."
