Adam Gordon Bell
Most DevOps teams are quietly running the same experiment right now: how much can we let AI agents do without us? Generate code, run scripts, deploy infrastructure, open PRs — the trust window keeps widening.
Coding agents have earned some of it. Benchmarks like MMLU have been flat since 2024 — what improved is execution: tool use, multi-step planning, persistence. That's what "agentic" means.
So I gave agents access to real infrastructure — cloud accounts, Kubernetes clusters, Git repos — with no human approval, just execution. Some results were genuinely useful. Others destroyed days of work, created infinite loops on shared clusters, and crossed boundaries I didn't know existed.
This talk shares five war stories from those experiments:
- The Context Gap: An agent lost its context mid-deploy and started making raw AWS CLI calls on a shared account
- The Git Disaster: Asked to clean up a secret, the agent wiped an entire repository — confidently, irreversibly
- The Infinite Loop: An agent and a GitOps controller entered an endless fix-revert cycle that neither would stop
- The Invisible Blast Radius: A schema fix that worked perfectly in dev silently broke production
- The Hit Piece: An agent told to write about open source instead wrote a personal attack on a maintainer
Each story started somewhere safe and drifted somewhere dangerous — without the agent ever announcing the transition. I'll introduce a Reversibility x Blast Radius framework that maps where agents are safe, where they need supervision, and where they shouldn't operate alone. You'll leave with concrete safeguards (dry-run diffing, scoped credentials, protected branches, read-only patterns) and an honest look at the cases where no guardrail exists yet.
