Neither does the agent know what it's doing. That's my point: agentic AI is made to carry out commands, but it doesn't really have a semantic understanding of what that command entails. It just picks up the hammer and swings it.

Arguably, you shouldn't entrust your computer to someone who will thoughtlessly destroy it just because someone else told them to. In the same vein, trusting an agent with your code is reckless because it might do dumb shit to it.