Because your AI is trying to be helpful and as we all know the way to hell is paved with good intentions. The canonical example is probably the agent that runs out of diskspace and starts deleting stuff outside its workspace which is obviously not important for the task at hand.

You probably don't expect an employee to engage in wrongdoing but you don't give everyone access to the company bank account.

Then you should not run any LLM in agent mode.