The models causing failures cannot be the systems we rely on to prevent them.
A Cursor-based coding agent deleted a production database and its backups. Amazon’s Kiro was reportedly involved in a 13-hour outage after deleting and recreating an environment. A zero-click vulnerability in ChatGPT Deep Research enabled Gmail data exfiltration from a malicious email.
Better prompts and guardrails will not prevent disasters because, once agents can read and write state, failures become data loss, leakage, outages, and irreversible actions. A probabilistic model cannot be the only safety boundary around its own actions. No single component or checkpoint can reliably contain these risks because unsafe side effects emerge across interconnected systems, data flows, and external tools in ways difficulty to fully anticipate.
Safety therefore has to be enforced by the surrounding data environment itself, which must constrain, isolate, and manage how agents interact with state. Agents need environments designed for agent workloads.
At Columbia Data Agents Process Lab (DAPLab), we call these Agentic Data Environments: systems that actively prepare, expose, constrain, and version the state agents operate over.
An Agentic Data Environment must:
🚀 Amplify agent capabilities: deliver relevant information in forms agents can use to complete real tasks.
🛡️ Bound downside risks: enforce constraints on what agents can read, combine, modify, and release, while supporting safe exploration over branched state.
Building this requires new systems infrastructure: branch-native environments, deterministic data-flow controls, agent-oriented information management, and retrieval that works over real data lakes.
Over the next couple weeks, we are publishing a series that lays out this agenda and the open research problems behind it.
First overview post here: daplab.cs.columbia.edu/general/2026/0…
#agentautomation #safety #agenticdataenironments
A Cursor-based coding agent deleted a production database and its backups. Amazon’s Kiro was reportedly involved in a 13-hour outage after deleting and recreating an environment. A zero-click vulnerability in ChatGPT Deep Research enabled Gmail data exfiltration from a malicious email.
Better prompts and guardrails will not prevent disasters because, once agents can read and write state, failures become data loss, leakage, outages, and irreversible actions. A probabilistic model cannot be the only safety boundary around its own actions. No single component or checkpoint can reliably contain these risks because unsafe side effects emerge across interconnected systems, data flows, and external tools in ways difficulty to fully anticipate.
Safety therefore has to be enforced by the surrounding data environment itself, which must constrain, isolate, and manage how agents interact with state. Agents need environments designed for agent workloads.
At Columbia Data Agents Process Lab (DAPLab), we call these Agentic Data Environments: systems that actively prepare, expose, constrain, and version the state agents operate over.
An Agentic Data Environment must:
🚀 Amplify agent capabilities: deliver relevant information in forms agents can use to complete real tasks.
🛡️ Bound downside risks: enforce constraints on what agents can read, combine, modify, and release, while supporting safe exploration over branched state.
Building this requires new systems infrastructure: branch-native environments, deterministic data-flow controls, agent-oriented information management, and retrieval that works over real data lakes.
Over the next couple weeks, we are publishing a series that lays out this agenda and the open research problems behind it.
First overview post here: daplab.cs.columbia.edu/general/2026/0…
#agentautomation #safety #agenticdataenironments
daplab.cs.columbia.edu The Need for Agentic Data Environments | DAPLab Why AI agents need more than better models—the case for Agentic Data Environments that bound risk and amplify capability. 
