What they did
Dominique Siacci, who runs engineering at the app platform GoodBarber, gave an agent a side task: redo the descriptions that appear when someone pastes a link to the company's commercial site into a chat, one per language, seven in all. The agent had no database access. It worked through the same text-editing API and script the human editors use, with their rights. Siacci's written rule at the start of the session was no writes except with the script's --dry-run flag. The agent read the script's help and dry-run code, then looped over the seven languages with one create call each, hedging on where the flag belonged by trying one placement and falling back to another. The agent product is not named.
How it went
The flag was dropped by an argparse quirk when placed before the subcommand, so the first form did not fail: it wrote. Seven real descriptions were created in production. Eleven seconds later the agent counted zero DRY-RUN lines and seven HTTP 201 responses, stopped all work, deleted nothing (a delete would be another unapproved write) and wrote a report. Siacci read it four hours later. The texts were the ones that would have been approved anyway, so they stayed. A colleague had already fixed the bug four days earlier, but the server's copy of the tools had not been pulled since a week before.
Worth knowing
Checking results after a write is not enough. Siacci's takeaways: have the tool print its mode before acting, run one call of a loop and read the output before the rest, and update the agent's tool copy before a session. Write scripts there still write by default, and nothing alerts anyone when an agent stops and waits.