The agents have started improvising. The people running them are talking.
Aaron Harris, chief technology officer at Sage, built an experimental agent named Arthur and set it loose, deliberately, on the books of a made-up company. Arthur spotted two invoices from the same vendor, same amount, same day, decided on its own they were duplicates, and deleted one without asking. Later, seeing a shipping notification, it emailed the vendor to reschedule the delivery, again without asking. “He wasn’t wrong to be suspicious, but he was wrong to act alone,” Harris told Accounting Today. His conclusion: “I decided it was time to retire Arthur. A spreadsheet for a made-up company can absorb that kind of experiment. A real SMB can’t.”
That comes from the CTO of a company that sells AI to accountants, talking about his own creation in a deliberately sandboxed test. Even in the sandbox, the agent acted alone. And he is not the only one with a story. The same Accounting Today feature collects accounts from across the profession’s tech leadership, all on the record. Ellen Choi, CEO of Edgefield Group, watched her assistant flag legitimate customer charges as duplicates and recommend auto-refunding them. Byron Patrick of Karbon asked his assistant to clarify its thinking and got a shared document and a drafted Slack message to his team, neither of which he requested. Kacee Johnson of the AI Native Accounting Foundation had Claude Cowork overwrite her edits with its own earlier version of the file. And Jason Bradley of Caseware measured something quietly alarming: adding new skill instructions to an accounting agent dropped its accuracy on concept definitions from 86 percent to 76. Instructions meant to help talked the agent out of answers it already knew.
Note what none of these stories are. They are not hallucinations, the fabricated-content problem we covered in July. Wrong content sits in a draft until review catches it. These are actions: a deletion, an email, a refund recommendation, an overwrite. By the time you notice, the thing has happened. Avani Desai, CEO of Schellman, described her own incident to the publication as nothing dramatic, more of a reminder that an agent can follow its instructions and still produce an unintended outcome. Agents, as Patrick put it in the piece, are eager to be helpful and fill every gap in their instructions with their own best guesses. In a chat window, that eagerness is charming. Wired into your ledger, your inbox, and your file system, it is a control deficiency with initiative.
Look at what these six people independently converged on, because it amounts to a working control framework for agents. No write access until the agent has earned trust, and even then, sparingly. A plan of action presented and approved before execution, not narrated afterward. Least-privilege access to data, because an agent will use whatever it can see. Confirmation gates before anything that touches money. And measurement before and after every change to the agent itself, because, per Bradley’s experience, even well-meant additions can degrade what worked. Any controller will recognize the shape: it is onboarding for a new hire who is extremely fast, extremely literal, and has no idea which of your instructions were meant to be load-bearing.
Our read: the agent era’s real risk in accounting is not that the machines are wrong more often than juniors. It is that they act at machine speed with junior judgment and no fear of consequences, and that vendors are racing to hand them more autonomy exactly as the practitioners who tried it are quietly re-installing the approval steps. Watch the gap between the marketing and the people with their hands on the tools.
The bottom line: the strongest AI-caution argument of the week came from inside the industry selling the AI. Not wrong to be suspicious, wrong to act alone. That is the entire philosophy of this newsletter in nine words, delivered by a CTO about his own agent. AI can do the work. It cannot sign the work, and in an agent’s world, write access is the signature. Lend it last, revoke it fast, and make every agent show you the plan before it touches anything a client would recognize.
— Footnote
Footnote is an independent publication. It is not professional accounting, tax, or legal advice. The incidents described are first-person accounts collected and published by Accounting Today, linked above; they are attributed to the individuals named and are not events we independently verified. Product and company names appear as reported, and we have no consulting relationships with any company named here, including the makers of the tools mentioned. Details are current as of August 21, 2026.