Agents are starting to operate real systems — who’s actually in control?