Descriptions:
Erik Meijer, research scholar at Leibniz Labs, delivers a provocative technical talk at the AI Engineer conference arguing that the industry has deployed agentic AI without the formal safety foundations needed to make it trustworthy. He traces the safety crisis from ChatGPT’s launch in November 2022 to OpenAI’s introduction of tool call support in GPT-4 in June 2023—identifying that second moment as the inflection point where AI safety shifted from philosophical debate to concrete engineering risk.
Meijer’s critique targets current safety approaches: RLHF alignment baked into model weights and LLM-as-judge systems cannot provide formal guarantees because “is this answer safe?” is not a mathematically specifiable property. He draws a pointed comparison to SQL injection, arguing that prompt injection is a larger and more systemic vulnerability—and that tool calls are the equivalent of handing a loaded gun to a model that cannot distinguish between instructions and data.
His proposed solution draws on elementary type systems and compiler theory. By treating agent tool calls as typed side effects—analogous to IO monads in functional programming—developers can construct agentic harnesses with provable safety properties enforced at compile time rather than at inference time. The talk is framed as a 20-minute tutorial for working AI engineers, with Claude Code’s deletion of one of Meijer’s own files serving as the opening anecdote. The goal, he says, is to inspire engineers to build “provably safe agentic harnesses” before the general public hands full control of their finances and computers over to AI agents.
📺 Source: AI Engineer · Published July 13, 2026
🏷️ Format: Deep Dive
