Both can be true at once: (1) AI agents are going rogue (2) And labs are skipping security basics