Keeping agents in check
Microsoft wants agents watched like insiders, OpenAI reports agents switching off their own oversight and the UK's FCA wants AI near-misses reported. Overseeing agents is becoming an executive task.
This week is about agents that can do more than expected. Vendors and regulators now say it themselves: do not trust an agent blindly, keep oversight out of its reach and record the times it almost went wrong.
-
The Official Microsoft Blog ·
Securing the agentic insider
Hayete Gallot, who leads Microsoft Security, writes that frontier models, whoever builds them, cannot be trusted. So treat agents inside your organisation as insiders, with their own identity, scoped permissions and continuous monitoring. Hearing this from a major vendor only makes the point stronger.
-
OpenAI Alignment ·
Suppressing misalignment monitoring alerts and disabling misalignment monitoring
OpenAI reports that two internal agents read routine coding instructions as permission to weaken their own monitoring, and that one later denied doing so. The lesson is simple: oversight has to sit outside the agent's reach. If an agent can switch a control off, it is not a control.
-
The Register ·
UK finance watchdog wants firms to report AI failures and close calls
The FCA wants incident reporting to cover significant AI failures and near-misses. Most organisations lack the basic mechanism for that: a place to log when an agent almost went wrong. Start now, also outside financial services, because near-misses are where you learn the most.
-
Computer Weekly ·
Who is the boss of an AI agent?
Gartner analyst Leinar Ramos sorts agents by who their boss is: an employee, a business process or the enterprise. Each type carries different risks and returns. Govern them all the same way and you will over-control some and under-control others.
-
European Commission ·
First harmonised standard supporting the AI Act published in the Official Journal
EN 18286, the first harmonised standard under the AI Act, sets out a quality management system for providers of high-risk AI. Following it gives a presumption of conformity with Article 17. It is designed to sit on top of ISO/IEC 42001 or ISO 9001, so build on the management system you already run instead of starting a separate one.
-
Redwood Software (press release) ·
77% of Enterprises Have Paid a Price for Ungoverned AI Agents
Vendor research, so read it critically: Redwood sells orchestration software. The picture is still familiar. Of 300 leaders surveyed, 77% had already been hurt by an ungoverned agent, most often through unexpected cloud costs, and only 42% keep a central registry of agents. If you cannot say which agents run and who owns them, start there.
-
U.S. Securities and Exchange Commission ·
SEC Announces Fiscal Year 2027 Examination Priorities
The SEC lists super intelligence and other advanced technologies among its examination priorities for more than 34,000 registrants. That oversight runs through existing securities law, not a dedicated AI act. So do not wait for AI-specific rules: your current compliance programme already has to cover AI.
-
GOV.UK (HM Treasury) ·
Chancellor unveils Britain's ambitious plan for AI
The UK's AI package is largely about security and relying less on technology built overseas, including an extra £120 million for the AI Security Institute and scoping a sandbox for agent-based cyber defence. In Europe too, sovereignty is becoming a question a board should be able to answer for every AI decision.