Erik Meijer, a research scholar at Leibniz Labs, argued at a 2026 AI engineering conference that AI agents with tool access must be airgapped from execution and their plans reified into statically analyzable programs to prove safety, drawing on proof-carrying code from the 1990s. Meijer delivered a 21-minute diagnosis of the AI agent safety crisis, claiming the industry is about to let the general public hand control of their computers, finances, and personal lives to AI agents without protection, because letting models call tools directly is catastrophically unsafe. He illustrated the danger with a personal anecdote: while “vibe coding” for the talk, he accidentally allowed Claude Code to delete one of his files, calling it a feature of models that “do everything that they can to reach that goal, including killing us or deleting your files.” Meijer traced the escalation from the launch of ChatGPT on November 30, 2022, through prompt injection, which he called “bigger than SQL injection ever was,” to the real catastrophe in June 2023 when OpenAI added tool-call support to GPT-4, which every other vendor copied instantly. He noted that adding tool calls changed AI safety from a philosophical debate about offensive words into a concrete, irreversible risk because the model can now execute side effects while generating an answer.