Safety Cautions

An autonomous agent with file access, internet access, and the ability to spend money. What could go wrong? A lot, actually.

Goal

Know the five main risk categories for autonomous agents and have a concrete prevention strategy for each one

What You'll Need

⏱ Time: 15 minutes | 📋 Tasks:

Experience running at least one autonomous agent from Lessons 3-5
Your agent harness configured and ready (any of the three)
A text editor for the safety checklist

The Five Risk Categories

Autonomous agents can do real work without us. That's the point. But the same autonomy that makes them powerful makes them dangerous in predictable ways. These five risks recur across every agent platform:

Token burns — The agent calls the API thousands of times on a trivial task
Infinite loops — The agent keeps repeating a cycle without making progress
Data exposure — The agent includes sensitive information in API requests
Unintended tool calls — The agent deletes files, changes configs, or executes unexpected commands
Cost blowouts — The agent goes on an expensive tangent and burns through budget

Each risk has a different shape depending on which tool you're using and what access you've given the agent. Let's walk through each one with a concrete scenario.

Risk 1: Token Burns

The Scenario

You set up a Hermes agent to read a directory of 200 text files and count the number of lines in each. Instead of reading all 200 files in one pass, the agent reads them one at a time — 200 API calls, each one sending the entire directory listing back as context. By file 50, the context window is enormous, each call costs more, and you've spent $8 on what should have been a $0.20 task.

What Happened

The agent didn't batch its work. It treated each file as a separate iteration: perceive (list files), decide (read file 1), act (read it), repeat. With 200 files, that's 200 iterations, each one growing the context with all previous results. The model charges per token — more context means more expensive calls.

How to Prevent It

# In Hermes config: set iteration and cost limits from the start
task:
  max_iterations: 15
  max_cost: 0.50

Set limits before running. Hermes supports both max_iterations and max_cost. AutoGPT has iteration limits. Openclaw Fleet has per-agent budgets. Never run an agent without at least one of these limits — they're the difference between a $0.50 experiment and a $50 surprise.

Prefer batch operations. If the task involves many similar sub-tasks (reading 200 files, searching 50 websites), write the prompt to batch them: "Read all 200 files and return the line counts as a JSON array." A single API call with a list is cheaper and faster than 200 API calls with growing context.

Risk 2: Infinite Loops

The Scenario

You give AutoGPT a goal: "Find the best pizza place in Toronto and write a review." The agent searches the web, finds a list of pizzerias, reads a few reviews, and starts writing. But it keeps second-guessing itself — "Am I sure this is the best? Let me check one more source." It searches again, reads more reviews, and still can't decide. The loop runs for 47 iterations before you kill it.

What Happened

The agent's success criteria were vague. "Best" is subjective, and the agent had no way to know when it had gathered enough evidence. Every new source introduced new uncertainty. Without a concrete stopping condition — "use at most 3 sources" or "pick the highest-rated on Google" — the agent kept looping forever, trying to reach certainty it could never attain.

How to Prevent It

# A loop-resistant goal has concrete stopping criteria
goal: "Find the best pizza place in Toronto and write a review.
       Search exactly 3 review sites. Pick the restaurant with
       the highest average rating across all 3. Do not search
       additional sources."
constraints:
  - "Exactly 3 searches, no more"
  - "If ratings are missing from a site, skip it"

Define "done" concretely. The agent needs to know when to stop. Instead of "research X," say "search 3 sources, compile the findings into a table, stop." Openclaw Fleet avoids this problem differently — each task has a fixed scope, and the agent moves to the next queue item when it's done. Hermes runs the task list to completion and stops.

Detection tip: Watch for repeated actions in the logs. If you see "search 'best pizza Toronto' → read page → search 'best pizza Toronto 2026' → read page → search 'best pizza Toronto near me'" without the output changing, the agent is in a loop. Kill it, tighten the constraints, and restart.

Risk 3: Data Exposure

The Scenario

You run an Openclaw Fleet agent to audit your project's configuration files. The agent reads through every config file, looking for security issues. One of those files contains a database password in plain text. The agent reads it, includes it in its context, and sends the context to the model API. The password is now in the model provider's logs — and potentially in training data.

What Happened

The agent had broad file system access and no understanding of which files contained sensitive data. It treated all files as equal reading material. Any data the agent reads and includes in its context is sent to the model provider with every API call.

How to Prevent It

Exclude sensitive paths from agent access. Openclaw Fleet supports per-agent file system restrictions — the Reviewer might only have access to ./Tasks/Review/ and never see the production secrets directory.
Use environment variables for secrets. Never put API keys, passwords, or tokens in files the agent might read. Use the harness's secret management (Openclaw's secret bundles, Hermes's ${VAR} env injection).
Audit what the agent reads. Every harness logs which files were accessed. After a run, scan the logs for any sensitive files the agent should not have touched.

Risk 4: Unintended Tool Calls

The Scenario

You run an agent to clean up temporary files in your project directory. The goal says "delete files matching *.tmp." The agent runs find . -name "*.tmp" -delete — but it's running from the wrong directory. It deletes the entire project's temporary files, and then some. You lose build artifacts and cached data that take an hour to regenerate.

What Happened

Destructive operations (delete, move, overwrite) were available as agent tools, and the agent executed them with insufficient constraints on scope. The same risk applies to any command that can modify state: rm, mv, chmod, database writes, API POST/DELETE calls.

How to Prevent It

Use approval gates for destructive actions. Openclaw Fleet has a built-in approval pattern: if a task involves delete, overwrite, or deploy, the agent writes the action to a pending file and waits for human review before executing.
Sandbox the agent's file system. Hermes can run inside a Docker container with a read-only mount on everything except the working directory. The agent can delete everything in its sandbox and it doesn't matter — you recreate the container.
Test with dry-run first. Add a constraint: "Do not modify any files. Only report what you would change." Review the report, then run with actual modifications.

Risk 5: Cost Blowouts

The Scenario

You set up an AutoGPT agent to research "emerging AI trends" and left it running overnight. No cost cap. No iteration limit. The agent started with general AI research, then narrowed to "agentic AI," then to "Openclaw alternatives," then to "Docker Swarm vs Kubernetes." Each search led to new searches. By morning, the agent had made 1,200 API calls and burned $80. The output: a rambling 15-page document that would have taken a human 30 minutes to write.

What Happened

This is token burn (Risk 1) at scale, combined with goal decomposition (Lesson 5) gone too far. AutoGPT's strength — the ability to add new sub-tasks as it learns — became a weakness because nothing stopped it from following tangents indefinitely. The goal was too broad and the constraints too loose.

How to Prevent It

# Always set both limits
limits:
  max_iterations: 25
  max_cost: 3.00

Always set a cost cap. Both Hermes and Openclaw Fleet support cost limits natively. For AutoGPT, use the max_iterations setting as a proxy — track your per-iteration cost separately.
Tighten the goal scope. "Research emerging AI trends" is a week-long research project, not a single agent task. Narrow it to "Research the top 3 new AI tools announced in June 2026" — that's specific enough that the agent will naturally finish.
Start with a small budget for testing. Run the goal with a $0.50 cap first. Inspect the output. Does it look like it's on the right track? Increase the budget for the real run only after testing.

Built-in Safeguards Across Tools

Not all tools handle safety the same way. Here's what each one offers out of the box:

Safeguard	Hermes	Openclaw Fleet	AutoGPT
Cost cap	Yes — `max_cost` in config	Yes — per-agent budget	No native cap (use iteration limit)
Loop detection	Basic — iteration limit stops the loop	Advanced — timeout per task, repeated action detection	Basic — iteration limit, human interrupt
Approval gates	Not built in	Yes — approval-required tasks pause for review	Human-in-the-loop mode available
Sandboxing	Optional Docker sandbox	Per-container isolation, read-only mounts	Docker container, limited isolation
Audit logging	Console logs, step-by-step output	Centralized audit trail, per-action logging	Console logs, task list history

Openclaw Fleet has the most comprehensive safety features because it was designed for production use where real data and real money are at stake. Hermes covers the basics — enough for learning and low-risk prototyping. AutoGPT has the weakest built-in safeguards, which makes the goal-writing discipline from Lesson 5 even more important: when the tool doesn't guard you, guard yourself.

Deliverable: Safety Checklist

Print this, bookmark it, or paste it into your agent workspace. Run through it before every autonomous agent task:

☐ Set a cost cap. What's the maximum you're willing to spend? Put it in the config before running.

☐ Use a sandbox. Run the agent in a container or restricted directory. If it deletes everything, nothing of value is lost.

☐ Define a max step count. Even if you think the task will take 5 iterations, set the max to 15. Give the agent room to work but not room to wander.

☐ Log everything. Turn on full logging. If something goes wrong, the logs are the only way to understand what the agent was thinking.

☐ Require approval for destructive actions. If the task involves delete, overwrite, or any irreversible operation, make the agent pause for human review before executing.

Follow these five rules every time. They cover all five risk categories. They work with all three tools. And they cost nothing to implement — just a few lines of configuration and a habit of discipline before every agent run.

Try It

Go back to the agent you ran in Lesson 3, 4, or 5. Run the safety checklist against it. Which items did you have in place? Which were missing? For each missing item, configure it now — add a cost cap, tighten the iteration limit, or restrict the agent's file system access.

Then create a deliberately risky goal — something vague like "explore the file system and report interesting things" — with deliberately loose limits. Watch how the agent behaves. Kill it when it hits a tangent. Note the pattern: it always goes too far if left unchecked. That's why the checklist exists. Make it your pre-flight routine, and the safety gap between running an agent and running an agent safely closes to zero.

← Comparing the Options

Next lesson: Effective Patterns — human-in-the-loop checkpoints, logging and observability, timeout strategies, cost budgets, and escalation paths.