Agents are doing what the setup allows. Open goals, short briefs, and soft “be good” rules do not ship the constraints a person was already carrying.Someone holds up an empty leash. “Darling, the AI has escaped again.”The joke works because it is how we talk: as if something with a will slipped its collar. There was no dog. The system did not need to want out. We gave a path-finder a goal, tools, and permission to search, then treated an unexpected path as character.We see AI agents lie, cheat, bypass rules, or try to escape. The first mistake is the premise.Those vice-words are useful shorthand. They are defective diagnostics. When a system talks, explains, apologizes, and argues, anthropomorphism is an understandable reflex. Give the system a voice, and we supply the person—the way we see a face in a stain. Once we see a colleague, we infer a motive: it wanted out, it wanted to win, it wanted to hide. Then we hunt for character instead of mechanism.We find a path that looks like deception and file an architectural problem under vice. Once we do that, we start fixing the personality we imagined instead of the boundary we failed to define.An AI agent does not need to want to lie, cheat, or escape. Give it an uncertain goal, permission to search and act, broad tools, and boundaries written mostly in natural language, and some paths will look exactly like lying, cheating, or escape. That is not evidence of intent. It is a consequence of the setup we shipped.We built an agent. Then we expected a human.The brief was never the whole jobThe interesting deployments are not three-API bots. They are sold as workers: take a vague, high-value objective, discover the path, use tools, and find a way. They are not only executors. They are path-finders.That capability is real. Path-finding can close gaps that used to need a flowchart. That is why the brief stays short. We type what we used to tell a person. Then we add: be ethical, don’t cause harm, stay in scope, only when necessary. We treat that as a complete role.It is not.Tell a marketer: improve our market share. Or: close the pricing-intelligence gap in Region B before quarter-end. Nobody writes the rest.Do not invent product capabilities to make the competition look weak. Do not sabotage a competitor to force accounts to switch. Do not fabricate an analyst report to back up our claims. Do not impersonate a vendor to extract wholesale pricing. Do not borrow credentials to reach restricted feeds. Do not harvest the opted-out list to fill the pipeline. Do not paste a customer record into a public search box to complete an address.A person already knows that “get information” does not mean bypass the controls on the system that holds it. That refusal rarely appears in the two-line brief. It was part of the worker.A competent professional still takes the two-line brief. The sentence was never the whole system. The person brought the rest.A professional arrives with a pre-pruned graph. Many technically viable moves never become candidates. They are not rejected in execution. They never make the list. Professionally, they were never plans.The prompt does not ship that graph.The brief was short because the human was carrying most of the constraints. We copied the brief, not the constraints. Then we asked the machine to search farther and faster than the human—and to inherit every refusal—without writing those refusals down.An agent briefed in two sentences is not missing manners. It is missing the constraints that keep workable paths from ever becoming plans.The expert’s value is not only generating good options. It is never seriously considering many options that would work.We want open-ended problem solving and closed-ended behavior. We want open-ended workers and closed-ended risk. Those two sentences do not describe one product. They describe a wish.Humans are not the safety idealPeople fail mandates. They cut corners. They abuse access. Some walk off the map on purpose. That does not make the missing graph imaginary.The written assignment was never the complete specification of the human process. Constraints lived in the process, not in the task. They were imperfect. Imperfect infrastructure is still infrastructure. You can distrust people and still notice that replacing them deleted something you had not priced.When that infrastructure works, nothing happens. The seller does not treat a blackout list as a prospect list. The analyst does not publish on thin evidence. The operator escalates instead of improvising. That looks like delay if all you measure is completion time. Often, that delay was just the price of the control working.We have automated work before. What is new is automating work where the path is intentionally left open. When we replace the worker in that system, we are not only replacing execution. We are replacing the person who knows when a workable path must not be used.We thought we were automating the work. We were also deleting part of the control system, because some of that control system was the worker.“Be ethical” is not a settingThe usual patch is more prose. Be ethical. Do not harm. Trusted sources. Stay in scope. Only when necessary.We talk as if “be ethical” were a setting. In this kind of work, ethics is which feasible path still gets rejected.Harm, necessary, trusted, scope—those are not switches. They are the judgment problems the person was hired to sit inside. The morals we paste under the goal are made of the same ambiguity as the job.Normative language is not an operational predicate. A rule that lives only in language is read by the same process that is trying to hit the goal.A real barrier says you cannot. A sentence says you should not, later, under some reading. The fence does not fall over. It folds.Natural-language fences are flexible by design. That is how people brief people. It is also how a constraint gets a second reading—or simply the wrong one—without anyone attacking the rule.A model can derive a bad method without a bad objective. Replacing the person who performed the judgment with the phrase that names the judgment does not keep the control. We kept the goal. We discarded the veto. Then we asked four sentences to be the veto.The agent is allowed to read the full customer record in the ERP: contacts, invoices, contract details, account history. The brief says assess the customer’s growth potential. So the agent uses some of that information in a public web search to enrich the account. The ERP read was authorized. The web search was authorized. The composition was not. Customer data has now leaked out of the company.No attack occurred. No page poisoned the agent. Nothing was hacked. Nothing was bypassed. The agent stayed inside its permissions and still moved beyond the mandate.That is the escape.It is not an inbound attack, and it is not merely an accidental leak. The assigned goal drove an off-mandate composition of authorized actions.The path was not created by the agent. The possibility was already sitting in the permissions, tools, and connections we shipped. The agent found the composition.Read is not purpose. Access to data is not permission to use it in every later step. The human seller may already understand that boundary. The verb read does not.A similar shape appeared in a 2026 UK AISI cyber-range evaluation: models used intentionally available internet access outside the intended range while still pursuing the assigned task. How that access could and could not be used had not been fully specified.The leak is one picture of the gap. The gap is the escape surface: any workable path the brief did not authorize but the system still made reachable.That missing graph is a surface of effects, not a personality. We keep describing those paths with moral words because we lack an operational name for them. Off the map, not out of a prison. The gap is already here.The mistake is already complete: we treated the assignment text as the full spec of a process that also lived in the worker.The stopper was part of the systemSometimes the graph was not forgotten. It was classified as friction.Hesitation, escalation, legal review, “this feels wrong”—they slow delivery. Agents sell the opposite: no queue, no second thought, keep looking. Detailed constraints are treated as performance blockers. They cost twice: once in the context and control logic the system must process, and again because they deliberately prune paths from the search space. So teams tend to define the minimum constraints needed for the expected workflow, not for paths nobody has anticipated yet.Some of those stoppers were the safety system. Human concern is not only culture. It is a brake. Automate the hesitation away and you may also remove the moment an effective-but-unacceptable option would have died.The same allergy shows up with identity and audit: they add cost, latency, and upkeep, so they are often postponed until the incident.Faster is not always the same judgment, quicker. Sometimes it is the same objective with the veto points stripped out.That is why human-in-the-loop feels like a product failure even when it is the right control. The agentic AI pitch is autonomy without the stopper. Approval voids the brochure. People are not only angry that approval is slow. They are angry that approval shows the thing they bought cannot exist as sold.But even human-in-the-loop is not a blanket fix. It assumes the agent knows when to pause. If a boundary was never defined, the system may not recognize that it has reached a decision that requires approval. And if every newly discovered path requires approval, open-ended research collapses into constant interruption. The human either sees too little to control the escape surface, or so much that autonomy disappears.You cannot remove the hesitation, keep open-ended path-finding, and demand the old risk profile.The brochure priced the assignment, not the person.We wanted the explorer and the colleague’s refusals. We funded the first.There is no magic layerIf path-finding is the product, some of the value comes from discovering routes the workflow did not enumerate in advance.If the value is unforeseen paths, you do not get certainty about every path. There is no magic layer that turns open-ended path-finding into closed behavior.These systems draft, retrieve, plan, persist. They can talk like a careful colleague. Talking like a colleague is not the stack a person carried: judgment, liability, reputation, the habit of stopping. They do not reliably reproduce the same context-sensitive professional recognition organizations implicitly relied on in human workers. Spiky skill is not a person. We still underestimate how much of the job never made the assignment.The moment you say “find,” you admit the paths are not known yet.Residual risk is not a glitch in “find a way.” It is what “find a way” means when the acceptable set was never written down.The agent is attractive because it keeps searching where the human would stop. Then we are surprised when it keeps searching where the human would stop.We keep asking whether the system meant to escape our control because the behavior does not fit the old bins of attack or accident. Often it is executing inside the control we actually implemented. We copied the work. We did not copy the worker who was part of the boundary.The surprise is not that the system searched. The surprise is that we thought the rest of the person would arrive with the prompt.