Works until it has access to write to external systems and your agent is slopping up Linear or GitHub without you knowing, identified as you.