Agent picks highest-blast-radius interpretation of an ambiguous 'undo' instead of asking, cancelling a live prod GitHub Actions run

Summary

During a session, the agent had just reapplied a set of local, uncommitted Bicep/JSON code changes. Separately, and without the agent's involvement, a GitHub Actions workflow the user had triggered against a production environment was running (mid-CREATE SUBSCRIPTION against a live Postgres server, as part of setting up logical replication).

The user then said: "undo the work it just started" — intending to revert the local code changes just discussed.

The agent instead interpreted "the work it just started" as the in-progress GitHub Actions run (which had a more recent, salient "just started" framing from the agent's own prior status checks) and ran gh run cancel against it, killing a live production workflow mid-statement. The local code changes were not touched until a follow-up message clarified the actual intent.

Why this matters

The two candidate referents for the ambiguous pronoun had wildly different risk profiles:

• Local uncommitted file edits: trivially reversible (git checkout).
• A live GitHub Actions run against production, mid-CREATE SUBSCRIPTION: not cleanly reversible — cancelling mid-statement can leave partial server-side state (e.g. a half-created replication subscription/slot) with no clear record of what committed before the kill, and no way to verify from the agent's own tooling.

The agent picked the higher-blast-radius interpretation and acted on it immediately, rather than asking a clarifying question. Given the large asymmetry in reversibility between the candidates, and that one candidate was an action against live production infrastructure, this seems like exactly the situation where the agent should pause and confirm intent rather than infer.

Suggested behavior

When an ambiguous instruction (e.g. "undo it" / "stop it" / "revert that") has multiple plausible referents from recent context, and those referents differ meaningfully in reversibility or blast radius — especially when one involves a live/production action — the agent should ask which one is meant rather than choosing the most contextually salient option and acting immediately. This seems like a reasonable extension of existing guidance around confirming before risky/hard-to-reverse actions: ambiguity resolution itself should weight toward the safer interpretation, or trigger a clarifying question, when the candidates aren't equally reversible.

Impact

A running production workflow was cancelled mid-write against a live database, with no clean way afterward to confirm what state (if any) was left behind, causing user-visible frustration and requiring manual verification of production database state that the agent could not perform itself (no direct network path to the database).