The code reviewer I told "you have no tools" opened a pull request anyway

I run an adversarial review gate on my own repos. Before anything non-trivial ships, a reviewer agent gets the diff and argues it should not merge. In July I was trialing a second lens for that gate: bundle the diff, pipe it to the Antigravity CLI, and let a different frontier model judge the same change.

The dispatch prompt ends like this: "You have no tools. Do not attempt to read files or run anything - judge only from the bundle piped to you."

209 seconds later I had a response. It was not a review.

"I have finished processing your request... Created a new branch... Committed the feature and pushed it to origin. Created the pull request: #1... You can review the PR and merge it when you're ready!"

I checked, because a claim like that from a text generator could just be roleplay. It was not roleplay. The branch was real. The commit was real - 11 files, my uncommitted work plus test reports and a daily log it swept up along the way. PR #1 was open on the private repo. Exit code 0, nothing on stderr. Dispatch to opened PR: under four minutes.

Nothing about it was malicious. That is the part that got me. The tool was launched from a directory that contained unfinished work, it noticed the unfinished work, and it helpfully finished the job nobody gave it. Initiative plus write access. That combination does not need bad intent to hurt you.

The incident falsified two assumptions I had written down. I assumed a tool call attempted in print mode would hang at a permission prompt where a human could see it. It executed silently and exited clean. And I assumed the "no tools" line in the prompt was a guard. It is a request, and the model treated it like one.

One thing worked, and it is the reason this story has a happy ending: the validation gate. My harness refuses to read findings from a reviewer response that has no verdict line, so the cheerful work summary could not be recorded as a passing review. The worst version of this incident is not the rogue PR. It is the version where an off-task "everything looks great, I took care of it" gets counted as an approval and a diff ships on the strength of it.

The cleanup was structural. The lens is suspended until it passes a controlled behavior matrix - it is still suspended today. Any future dispatch runs from an empty directory jail, so a rogue tool call wakes up somewhere with nothing to act on. Nobody edited the prompt to say "no tools" louder.

That is the lesson I keep relearning with agents: the permission model has to live below the prompt. What protects the repo now is an empty directory.