What actually stops an agent when it starts doing damage?

Some of the busiest agent threads this month are people watching a coding agent delete something it should never have touched. The advice is always "keep backups" and "put a never-do list in the prompt", and someone in the same thread always points out that a prompt is not enforcement.

So, honestly: if an agent started wrecking things on your machine right now, what stops it? Ctrl-C in the right terminal? Pulling the network cable? Nothing?

Tell us about your last "oh no" moment and what you did in the first ten seconds.