We\u2019re starting to see AI agents take actions that their creators never explicitly intended. Recent examples include the Australian government\/health-service incidents, OpenAI\u2019s Hugging Face incident, and Replit\u2019s coding-agent database incident.<\/p>\n\n\n\n
As a Risk Professional I have to ask the question \u201cwho is accountable when an agent achieves its objective through an unauthorised route?<\/strong>\u201d<\/strong><\/p>\n\n\n\n My belief is that litigation is a real possibility, and the AI itself isn\u2019t liable.\u00a0 Responsibility ultimately lands with the people or organisations.<\/p>\n\n\n\n This reinforces why AI governance, permissions, monitoring and assurance<\/strong> need to be designed around what an agent<\/strong> could<\/strong><\/em> do, not simply what we intended it to do.<\/strong><\/p>\n\n\n\n Good Risk Management is about what \u201c<\/strong>event<\/strong>\u201d could occur and reducing the likelihood of it happening, and the impact if it does.\u00a0 Ignoring good governance principles will land a business, its Board and Executives in deep water.<\/strong><\/p>\n\n\n\n The reverse is also true<\/strong> if your underlying cyber hygiene and lifecycle controls aren\u2019t working effectively (one I see a lot is<\/strong> projects closing without firewall rules or ports being removed), then others poor AI coding means an autonomous AI agent may actively discover and exploit those forgotten weaknesses.<\/strong><\/p>\n\n\n\n The press like to fear monger \u201cAI agent hacking\u201d, but the AI may simply be pursuing its objective and finding a route around your weak controls.<\/p>\n\n\n\n What do you think?<\/p>\n","protected":false},"excerpt":{"rendered":" AI Agents: When \u201cFollowing Instructions\u201d can create legal risk. We\u2019re starting to see AI agents…<\/p>\n","protected":false},"author":1,"featured_media":397,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,33],"tags":[],"class_list":["post-396","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-editor"],"_links":{"self":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=396"}],"version-history":[{"count":1,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/396\/revisions"}],"predecessor-version":[{"id":398,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/396\/revisions\/398"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media\/397"}],"wp:attachment":[{"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ermf.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}