If they were really about putting brakes on these, they would simply make these things non-agentic.

Simply make them something that derives a text response from its training data.