> LLMs can operate any kind of software (check MCP).

But they can't be trusted to do so in a reliable and sane way. Until the issues with hallucination and prompt adherence are resolved, including the issues with context injection, LLMs aren't any more useful for general software operation than `/dev/urandom` is.

Every time we get a "Gemini deleted my production database!" story everyone goes "well obviously you shouldn't have trusted it with production access". I don't play russian roulette with my CLI, why would I add a layer of uncertainty on top?