AI Agent Safety Is Still Thinking Like Permissions