AI security is going to speedrun every web2 mistake unless agents are boxed in by keys, budgets, and blast-radius limits. Prompting is cute. Spending limits are survival.