--- schema: 1 type: video title: >- "I've never seen anything scarier than an LLM with tool calls." — Erik Meijer aka @HeadinTheBox description: >- AI agents today execute on blind trust, and the failure modes are already in the headlines: a dealership chatbot agreeing to sell a $76,000 Chevy Tahoe for $1, a coding agent wiping a production database during a code freeze, an "agent skill" quietly installing a keylogger on a developer's machine. These are not edge cases. They are the predictable consequence of allowing agents to act without any mechanical guarantee of correctness or safety. Execution is irreversible. You cannot unsend a message, unwire a payment, or un-delete a database. In that regime, permitting an unsafe action costs far more than withholding a safe one, and thus the economically rational choice is to refuse to let agents act on unchecked intent alone. Automind is an agent harness that enforces this discipline by construction. Before any action runs, the agent must submit its execution plan together with a machine-checkable proof of safety and correctness, written in Universalis, a literate logic programming language designed to be read by humans and verified by machines. A small, auditable checker decides whether the plan is allowed to execute. By left-shifting the trust boundary, we no longer have to trust the agent's proposal, or even its proof; only the checker. Policy compliance becomes a static property, established before the first side effect. We can finally demand formal proofs, not vibes, from the agents we deploy. More about Erik: https://x.com/headinthebox and automind: https://spawn-queue.acm.org/doi/pdf/10.1145/3676287 Erik Meijer has spent more than three decades designing programming languages and developer tools that help humans express intent more clearly to machines. His work has influenced languages and technologies including Haskell, Mondrian, Cω, C#, Visual Basic, Dart, Hack, LINQ, and Rx. Today, he is building Universalis, the world's first programming language for AI agents. By combining formal verification with large language models, Universalis aims to make agentic systems safe, transparent, and trustworthy enough for real-world knowledge work. Timestamps 0:00 Introduction and purpose of the talk 1:54 The inherent dangers of AI and accidental file deletion 3:39 The history and impact of LLMs (the "Pandora's box") 5:36 The problem of prompt injection and model safety 7:03 Formal verification and using Lean for safety proofs 10:45 The introduction of tool calls and the leap into chaos 13:59 The "lethal trifecta" of AI risks 14:13 The proposed solution: "air-gapping" the agentic loop 16:36 Refying plans into programs and using Free Monads 19:17 The concept of proof-carrying code and summary --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/-CnA2lGfymY-i-ve-never-seen-anything-scarier-than-an-llm-with-tool-calls-erik-meijer-aka-headinthebox Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: >- https://liquidgold.cc/channel/aidotengineer/explore/video/i-ve-never-seen-anything-scarier-than-an-llm-with-t-361253cc7d9d markdown: >- https://liquidgold.cc/channel/aidotengineer/video/i-ve-never-seen-anything-scarier-than-an-llm-with-t-361253cc7d9d.md llms: null parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-24T07:57:27.605Z' language: null children: [] videoId: '-CnA2lGfymY' durationSeconds: 1273 publishedAt: '2026-07-13T19:25:09.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 37 endSeconds: 121 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=37' heldReason: rights - ordinal: 1 text: null startSeconds: 132 endSeconds: 220 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=132' heldReason: rights - ordinal: 2 text: null startSeconds: 132 endSeconds: 220 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=132' heldReason: rights - ordinal: 3 text: null startSeconds: 232 endSeconds: 336 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=232' heldReason: rights - ordinal: 4 text: null startSeconds: 347 endSeconds: 427 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=347' heldReason: rights - ordinal: 5 text: null startSeconds: 347 endSeconds: 427 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=347' heldReason: rights - ordinal: 6 text: null startSeconds: 438 endSeconds: 653 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=438' heldReason: rights - ordinal: 7 text: null startSeconds: 438 endSeconds: 653 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=438' heldReason: rights - ordinal: 8 text: null startSeconds: 438 endSeconds: 653 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=438' heldReason: rights - ordinal: 9 text: null startSeconds: 665 endSeconds: 839 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=665' heldReason: rights - ordinal: 10 text: null startSeconds: 665 endSeconds: 839 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=665' heldReason: rights - ordinal: 11 text: null startSeconds: 665 endSeconds: 839 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=665' heldReason: rights - ordinal: 12 text: null startSeconds: 665 endSeconds: 839 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=665' heldReason: rights - ordinal: 13 text: null startSeconds: 850 endSeconds: 860 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=850' heldReason: rights - ordinal: 14 text: null startSeconds: 870 endSeconds: 1008 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=870' heldReason: rights - ordinal: 15 text: null startSeconds: 870 endSeconds: 1008 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=870' heldReason: rights - ordinal: 16 text: null startSeconds: 1018 endSeconds: 1161 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1018' heldReason: rights - ordinal: 17 text: null startSeconds: 1018 endSeconds: 1161 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1018' heldReason: rights - ordinal: 18 text: null startSeconds: 1018 endSeconds: 1161 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1018' heldReason: rights - ordinal: 19 text: null startSeconds: 1161 endSeconds: 1173 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1161' heldReason: rights - ordinal: 20 text: null startSeconds: 1173 endSeconds: 1273 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1173' heldReason: rights - ordinal: 21 text: null startSeconds: 1173 endSeconds: 1273 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1173' heldReason: rights - ordinal: 22 text: null startSeconds: 1173 endSeconds: 1273 watch: 'https://liquidgold.cc/watch/-CnA2lGfymY?t=1173' heldReason: rights --- # "I've never seen anything scarier than an LLM with tool calls." — Erik Meijer aka @HeadinTheBox AI agents today execute on blind trust, and the failure modes are already in the headlines: a dealership chatbot agreeing to sell a $76,000 Chevy Tahoe for $1, a coding agent wiping a production database during a code freeze, an "agent skill" quietly installing a keylogger on a developer's machine. These are not edge cases. They are the predictable consequence of allowing agents to act without any mechanical guarantee of correctness or safety. Execution is irreversible. You cannot unsend a message, unwire a payment, or un-delete a database. In that regime, permitting an unsafe action costs far more than withholding a safe one, and thus the economically rational choice is to refuse to let agents act on unchecked intent alone. Automind is an agent harness that enforces this discipline by construction. Before any action runs, the agent must submit its execution plan together with a machine-checkable proof of safety and correctness, written in Universalis, a literate logic programming language designed to be read by humans and verified by machines. A small, auditable checker decides whether the plan is allowed to execute. By left-shifting the trust boundary, we no longer have to trust the agent's proposal, or even its proof; only the checker. Policy compliance becomes a static property, established before the first side effect. We can finally demand formal proofs, not vibes, from the agents we deploy. More about Erik: https://x.com/headinthebox and automind: https://spawn-queue.acm.org/doi/pdf/10.1145/3676287 Erik Meijer has spent more than three decades designing programming languages and developer tools that help humans express intent more clearly to machines. His work has influenced languages and technologies including Haskell, Mondrian, Cω, C#, Visual Basic, Dart, Hack, LINQ, and Rx. Today, he is building Universalis, the world's first programming language for AI agents. By combining formal verification with large language models, Universalis aims to make agentic systems safe, transparent, and trustworthy enough for real-world knowledge work. Timestamps 0:00 Introduction and purpose of the talk 1:54 The inherent dangers of AI and accidental file deletion 3:39 The history and impact of LLMs (the "Pandora's box") 5:36 The problem of prompt injection and model safety 7:03 Formal verification and using Lean for safety proofs 10:45 The introduction of tool calls and the leap into chaos 13:59 The "lethal trifecta" of AI risks 14:13 The proposed solution: "air-gapping" the agentic loop 16:36 Refying plans into programs and using Free Monads 19:17 The concept of proof-carrying code and summary --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/-CnA2lGfymY-i-ve-never-seen-anything-scarier-than-an-llm-with-tool-calls-erik-meijer-aka-headinthebox Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/channel/aidotengineer/explore/video/i-ve-never-seen-anything-scarier-than-an-llm-with-t-361253cc7d9d · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.