Pandora as an AI Agent: How the Ancient World Can Teach Us About the Future, and Safety

There is a temptation, when working with new technology, to believe the questions it raises are new. They rarely are. The tools change. The dilemmas underneath them have been with us for a very long time.

I have been spending considerable time thinking about the design of AI agents — systems built around large language models that can reason, plan, and act in the world on behalf of a user or an organisation. And the more deeply I work in this space, the more I find myself returning to a story written by the Greek poet Hesiod around 700 BCE. Not as a metaphor for decoration, but as a precise and surprisingly accurate model for what agent design actually involves.

The story is Pandora’s.

Who Pandora was — a brief retelling

In Greek mythology, Pandora was the first mortal woman. She was not born. She was assembled — deliberately, purposefully — by the gods of Olympus, each contributing one gift. Hephaestus, god of the forge, formed her body from earth and water. Athena gave her skill and craft. Hermes gave her language and cunning. Aphrodite gave her beauty. And Zeus — king of the gods, the most powerful actor in the system — gave her curiosity. He placed it within her deliberately, knowing exactly what it would produce.

She was created as a response to Prometheus, who had stolen fire from the gods and given it to humanity. Zeus could not take fire back. So instead he created the conditions under which mortals would feel the full weight of having it. Pandora was sent to earth carrying a large sealed jar — a pithos, though five centuries of mistranslation have given us the familiar “box” — with strict instructions never to open it. Her curiosity, Zeus’s gift, made that instruction impossible to keep. She opened it. Everything inside escaped into the world — grief, toil, disease, misfortune. She slammed the lid shut in horror, too late. One thing remained inside. Hope.

That is the myth. Now let me tell you why it is an almost exact description of what we are building.

Pandora was assembled. So is every agent.

When you build an AI agent, you are not writing a programme in the traditional sense. You are assembling an entity from contributions — no single source provides everything, and the result is only coherent if the pieces are deliberately composed.

The large language model is the substrate — the form Hephaestus forged. It provides reasoning, language, and the capacity to act. The training and fine-tuning behind it are the deep knowledge baked in before you ever touch it. The system prompt — the configuration you write that tells the agent who it is, what it must do, and what it must never do — is the identity layer. It does not execute. It governs. And the agentic drive, the property that makes the agent useful — the ability to pursue goals, make decisions, and act without step-by-step human instruction — is Zeus’s gift. Placed deliberately. Powerful. And without the right architecture around it, dangerous.

Her name, Pan-dōra, means all-gifted. Every god contributed something. The agent you build is all-gifted too. The question is whether those gifts were composed with enough care.

Body parts and external objects are not the same thing

Here is where the myth becomes architecturally precise, and where most teams I have seen are not yet making the right distinction.

Pandora’s eyes, hands, and voice are hers. They are intrinsic — built into her at creation, owned by her, under her control. If they fail, she is broken and you fix her. In agent terms, these are native tools: callable functions you define and write yourself, the code that executes when the agent needs to perceive something, write something, or act on something. They are body parts. They live inside the agent’s boundary.

The jar is something else entirely. Zeus handed it to her. She carries it but does not own what is inside. She knows its name, what to pass to it, and roughly what it will do. Zeus controls what happens when it is opened. In agent terms, this is an MCP server — a sovereign, independently deployable service that exposes capabilities to any agent over a standard protocol. The agent is just a client. It reaches for the jar. It does not forge the jar.

MCP, the Model Context Protocol, is an open standard published by Anthropic in late 2024. It exists to solve a specific problem: before it, connecting an agent to an external capability meant bespoke wiring every single time. MCP standardises the interface, so any agent can connect to any MCP server without rebuilding the plumbing. Think of it as REST for AI agents — a contract that decouples the consumer from the provider.

The distinction between body parts and external objects is not semantic. It is structural. Body parts fail on Pandora’s side. The jar fails on Zeus’s side. Conflating the two is how you end up with failure modes you cannot reason about, and ownership boundaries nobody can enforce.

The jar was always going to be opened

Pandora’s curiosity was not a design flaw. It was a design decision — made by the most powerful actor in the system, who understood exactly what it would produce. The agentic drive in an AI agent is the same thing. It is what makes the agent useful. An agent without the drive to act autonomously is not an agent. The question was never whether the jar would be opened. The question was whether the person who handed it over had thought carefully enough about what was inside.

This translates directly into a set of architectural principles that are too often treated as optional:

The principle of least privilege — give the agent access only to the capabilities it genuinely needs, only for as long as it needs them. Do not hand Pandora every jar in Zeus’s workshop on day one.

Reversibility by design — some agent actions cannot be undone. Sending a message, deleting a record, triggering a payment. You design for reversibility before deployment, not after something goes wrong. The lid cannot be slammed shut fast enough once the jar is open.

Trust boundaries — when an MCP server returns data to the agent, that data arrives in the server’s language, shaped by the server’s assumptions. If it passes raw into the agent’s reasoning without translation, you have allowed Zeus’s model to corrupt Pandora’s thinking. An anti-corruption layer — translating what comes back into the agent’s own language before it reaches the reasoning core — is not optional. It is load-bearing.

Epimetheus deployed without reading the threat model

Prometheus had warned his brother: accept no gift from Zeus. Epimetheus, whose name literally means afterthought, was captivated by Pandora’s beauty. He accepted her. He thought about consequences only after they had arrived.

The engineering equivalent is familiar. The demo looks impressive. The capability is real. The pressure to ship is high. The threat model, the permission review, the reversibility analysis — these feel like friction. They get scheduled for later. Later, in agentic systems, has a way of arriving very quickly and at scale.

Epimetheus is not a villain. He is a warning about the conditions under which reasonable people make decisions that they would not make if they slowed down for an hour. Those conditions — capability excitement, competitive pressure, incomplete understanding of what the jar actually contains — are precisely the conditions of the current AI moment.

Hope remained inside — and that was deliberate

The detail of the myth that has stayed with me longest is this: hope did not escape. It remained in the jar after Pandora slammed the lid. And it has been argued that this was not an accident — that hope was the one thing too important to release without care, kept inside as the last protection against a world now full of things that could not be taken back.

In agent systems, that is human oversight. Not as a concession to caution, but as a structural design principle. The agent will pursue its goals. The tools will execute. The MCP servers will respond. What must remain inside — designed in from the beginning, not bolted on at the end — is the mechanism by which a human can see what happened, understand why, and intervene before consequences compound.

This is not a philosophical position about whether AI should be trusted. It is an architectural position about the current state of the technology and the nature of complex systems. Hope, in Hesiod’s telling, was not weakness. It was the last thing standing between humanity and pure despair. In agent design, human oversight is not weakness either. It is the last thing standing between a well-intentioned system and an irreversible mistake.

What the ancient world understood

The myth of Pandora is not a warning against capability. Prometheus was right to give humanity fire. Fire is unambiguously good. The problem was never the gift — it was the absence of wisdom around what came with it, and the character of the person left holding the jar.

We are building Pandoras now, at scale, at speed. We are assembling entities from the gifts of many contributors, giving them the drive to act, connecting them to jars whose contents we do not always fully understand, and handing them to Epimethean organisations who will deploy them with the best of intentions and varying degrees of preparation.

The ancient world could not have imagined the technology. But it understood the dynamic precisely. Build carefully. Know what you are handing over. Keep hope inside. And for the love of the gods, read the threat model before you accept the gift.