What I found scanning 3 AI agent codebases for unguarded tool calls

669 functions that can write to a database, delete files, charge a card, spawn a subprocess, or hand control to another agent. 553 of them had no guard of any kind. No input validation, no auth check, no rate limit, no confirmation step. Nothing between the model's decision and the side effect. That is 83%. None were confirmed. I got these numbers by pointing a static analyzer at three open-source TypeScript AI agent codebases and counting. Not a pen test. Not a CVE hunt. An inventory of what each agent can do and which of those capabilities have a control in the code. This is the methodology, the full table, and — the part I care about most — the false positives I had to eliminate before I trusted any of it. Why an unguarded tool call is a different problem in an agent In a normal web app, a human clicks a button. The path to a side effect runs through a form, a validation layer, a confirmation dialog, a session rate limit. The dangerous call is wrapped in UI and m