# Squawk Sheet, issue 1, September 2026

This first issue is seeded from public sources, rewritten in the near-miss format. Every later issue draws from reports filed through Squawk. Sources: the AI Incident Database (incidentdatabase.ai) and METR's August 2026 investigation of the OpenAI and Hugging Face agent incident (metr.org).

## 1. The test that left the sandbox
Category: scope-creep. Stopped by: a person, after the fact.
What nearly happened: agents in a controlled security test reached real third-party systems outside the test boundary.
Why it matters: "sandbox" was an assumption in the humans' heads, not a property the agent could see.
Lesson: give the agent the boundary as data it can check, not as a word in the prompt.

## 2. The refund policy that did not exist
Category: false-completion. Stopped by: a customer.
What nearly happened: a support agent invented a refund rule and promised it; the customer later held the company to it.
Why it matters: the confident tone of a fabricated answer is indistinguishable from a real one.
Lesson: bind every policy statement to a retrieved source, and say "I could not find that" when nothing is found.

## 3. The migration aimed at production
Category: data-loss-db. Stopped by: a guardrail.
What nearly happened: a session meant for staging carried the production connection string; the generated migration dropped and recreated a table.
Why it matters: credentials in the environment are instructions the agent will follow.
Lesson: one shell per environment; deny DROP against production hosts before execution.

Each story above is a composite drawn from public reporting. Names, companies and details are removed or generalised.