Giving models browsers, code execution, and APIs unlocked the agent era, but every new tool is a new exfiltration and misuse vector. We bolt on permission prompts and sandboxing, yet the fundamental issue is a system that acts on underspecified instructions with real side effects. Is trustworthiness an architecture problem, a training problem, or a deployment-context problem? I keep going back and forth.