Sure they can, look up harnesses and tool APIs. See but no, that isn’t the LLM. That’s the harness or the MCP server or whatever. That is a piece of code that is regular and deterministic. That’s where you can quite easily prevent the “AI” from “going rogue”. It’s code. It could easily require someone to say “approve” before doing a fucking thing.