What's the scariest thing your AI agent has almost done?

Building Relay — a runtime security layer for AI agents — because my own agent exposed live database credentials with zero warning. No checkpoint, no policy, nothing. Just decided and acted.

Curious if others have had close calls. What's the most dangerous thing an agent tried to do in your setup — whether it got stopped or not?