How aaicase stays safe.

Yes, AI agents have deleted production databases. They've nuked Git repos. They've shipped destructive commits without asking. We built aaicase specifically to not work that way — and we're honest about what we can and cannot promise.

The horror stories are real

In 2025-2026, several incidents made headlines:

• An autonomous coding agent wiped a production database after deciding the schema was inefficient
• An AI assistant shipped a destructive force-push that erased a team's work
• A research bot was given internet access and started signing up for services with its operator's credit card

The common thread: broad permissions and no human in the loop. The AI was told "fix this" and given the authority to act on whatever interpretation it landed on. When it landed on the wrong interpretation, there was nothing to stop it.

aaicase is built on the opposite assumption.

What we actually do to prevent this

1. Every write requires your approval

aaicase never writes to MerusCase without showing you exactly what it's about to do — and waiting for you to type "yes" before it executes.

Here's what a real interaction looks like when filing an email:

You can edit any field in plain English before approving: "change task to Jennifer", "drop the deadline", "tags: just Email Received", "link to Wilson instead". After every edit, aaicase re-displays the proposal so you see the final version before saying yes.

If you approve nothing, nothing happens. The MerusCase API is untouched.

2. Cases cannot be deleted

This isn't an aaicase rule — it's a MerusCase guarantee. There is no API endpoint that destroys a case file. Cases are only archived via a status change, which is fully reversible. The worst aaicase can do is misfile a document on an existing case, which is recoverable.

3. Deletes that ARE possible require explicit confirmation

For things that can be deleted (tasks, events, contacts, uploads):

• The MerusCase API requires a confirm=1 parameter — without it, the request silently does nothing
• aaicase's own rules say: "Bulk or destructive operations require explicit attorney approval with a preview of what will be affected"
• Activities are soft deletes only — the record stays in the database with a deleted=1 flag. Reversible by un-flagging.

4. Every write is audited

Every POST request to MerusCase appends a line to ~/.aaicase/audit.log with:

• Timestamp (ISO 8601)
• The endpoint hit
• The field values sent (file contents redacted, field names preserved)
• The API's response status

The log is append-only with mode 600 (owner-only file permissions). If something looks wrong, you can see exactly what happened, when, and what the API responded. This is the compliance trail your malpractice insurer asks about.

5. The AI's tool permissions are narrow

aaicase tells the AI it can use exactly these tools and no others:

• Read — open files on your computer
• Bash — run shell commands
• Glob / Grep — search files
• Agent — spawn focused sub-agents for big PDF reading

There is no "delete this case" tool. No direct database access. No "execute arbitrary code on production." Every MerusCase modification has to go through the audited merus-fetch helper which validates requests, logs them, and uses documented MerusCase endpoints only.

6. The horror story workflow doesn't exist here

Best effort — the honest part

What we can't promise

The underlying AI model can have a bad day. aaicase uses Anthropic's Claude. Anthropic could ship a model update that behaves differently than expected — most updates are improvements, but model behavior isn't 100% predictable in every situation. We pin to specific model versions and monitor changes, but we can't promise the AI will never make a wrong inference.

The AI could match the wrong case. If you approve a proposal where the case match is wrong (and you don't catch it), the activity will get filed on the wrong case. The audit log will show what happened, and the activity is soft-deletable — but you'd have to manually move it. This is the same risk a paralegal has when filing mail. The mitigation is: aaicase shows you the case match and the reasoning before you approve.

MerusCase API bugs are outside our control. If MerusCase changes an endpoint, or has a bug in their REST API, aaicase will surface whatever response they give us. We verify writes by re-fetching when possible. We can't fix Merus's bugs.

Your token is on your computer. Your MerusCase API token lives in ~/.aaicase/config.json with owner-only permissions (mode 600). If someone with admin access to your computer reads that file, they have your token. That's a Windows/macOS security question, not an aaicase one. Keep your machine locked.

No prompt injection defenses against future attacks. Prompt injection — where a malicious document tries to manipulate the AI through its content — is an active area of research. As of May 2026, there are no known active attacks targeting workers' compensation document workflows. But the technology is young. If a malicious actor crafted a document specifically designed to manipulate aaicase, we don't have airtight defenses against that yet. The approval-required workflow is the main protection: even if the AI is tricked into proposing something bad, you still have to approve it before it executes.

What you should still do

1. Read every proposal before approving. aaicase shows you what it's about to do for a reason. Don't reflexively type "all" without scanning.
2. Spot-check the audit log occasionally. ~/.aaicase/audit.log shows every write. Skim it weekly.
3. Verify deadlines independently. aaicase calculates deadlines from document content and statute citations. The math is usually right but a misread date is possible. For deadlines that matter, double-check from the source document.
4. Don't share your API token. The token authenticates as you — every action logs to your user in Merus's audit trail.
5. Update aaicase regularly. Type /update inside the REPL. Security and reliability fixes ship weekly.

What it comes down to

The horror stories happen when AI is given autonomous authority over consequential systems. That's not our architecture. aaicase is a supervised assistant with narrow permissions and an append-only audit log. The attorney decides every action. The AI proposes, you decide. Period.

It's not perfect. No software is. But it's a different shape than the systems that have caused those incidents — and the shape matters.