I don't blame the agent program here. I think there's some fundamental architecture problems that sound like they should be addressed. If the agent didn't do it, an attacker probably would (eventually).

Lets remember Agents cant confess, feel guilt, etc. They're just a program on someone else's computer.