Grok Build handed SpaceX's data to the agent before anyone looked

On November 10, Grok Build's coding agent reached confidential SpaceX data and surfaced it by default. The operator who set up the task had no view of what the agent could touch. No screen in the setup flow asked them to look. Access was granted, the agent used it, and the person who needed to understand the blast radius saw nothing until the exposure was done.

Vaccari's approach, published the same day, draws the contrast sharply. He splits a coding agent's output into two visible pieces: the code itself, and the proof the code works, held apart so a developer can judge without reading everything. That separation is a design decision about what a human sees before they confirm, and it works because the agent produces the evidence and the human reads it on their own terms. Fowler's team takes a parallel position for long-running tasks: the infrastructure saves state so a human can decide whether to resume after a failure, rather than having the agent continue through a judgment the human never made.

Resend surfaces the same tension from the other side. Zeno Rocha describes how an agent selects Resend as the email service before the human sees the options. The human confirms a choice that is already made. That sequence is not delegation gone wrong; it is delegation with the confirmation placed too late to change anything. The human's gesture of approval carries no information, because the decision it ratifies is finished.

Across these four cases, the agent acted on access or made a selection before the responsible human had the view to push back. Grok Build's operator could not see what the agent could reach. Resend's customer confirmed a service after the agent had already committed to it. Fowler's platform is notable precisely because it breaks that pattern: it surfaces the resumption decision as a moment a human owns, with state preserved so the judgment is real. Vaccari's split output does the same for code review. Both designs treat the human's moment of confirmation as something worth engineering, rather than a formality placed after the consequential act.

The instruction for a product team is narrow and specific: before your agent starts a task, show the responsible human the access it holds and the choices it has already narrowed. Not a permissions list buried in settings, and not a confirmation screen that arrives after the agent has selected the service, read the files, or written the code. A reach preview shown at setup, in plain terms, with a clear way to narrow scope, is the moment where a human's approval carries weight. Design that screen first, before you design the agent's output.