Instead of throwing an LLM on top of it, just give me direct access to the levers that the agent is allowed to pull on my behalf. A sufficiently motivated attacker will be able to sweet talk the agent around whatever natural language "guardrails" were put in place, anyway.

Maybe the LLM doomsday won’t be self aware AI but instead everyone will be able to alter anything in any customer service backend in any way they want to the point we bankrupt all the banks and insurance agencies and governments. Yikes