Meta's Agents Rule of Two says agents should not do more than 2 of: [A] process untrustworthy inputs [B] have access to sensitive systems or private data [C] change state or communicate externally Turns out 98% of popular open-source agents reviewed do all 3 in a single session.