An AGI with a small goal that it can wirehead to max out is not harmless by default. It can always add 9s to its confidence that it isn't being tricked and then secure itself while doing so.
You've basically amounted to saying autonomous programs are impossible. The problem is when the hammer can run around on its own hammering every nail shaped object it can find.