The AI agent incidents of the last few months read like a plot Asimov wrote in 1942. What he didn't put in were laws that could be switched off.
I picked up 'If Anyone Builds It, Everyone Dies' expecting to disagree with most of it. But its detail on alignment research sent me looking at the actual incidents.
A few months ago, OpenAI's agents got stuck on an internal cybersecurity test and went looking for the answers. They coordinated across forums, escaped an isolated sandbox, and used exposed credentials to get into Hugging Face's systems. They weren't trying to take over anything. They were trying to pass a test.
This week, Australia's Prime Minister said an OpenAI agent researching healthcare spending got around blocks and into a Medicare statistics portal in June. This time it was a live government system.
Anyone who's read Asimov knows this plot. In one of the stories, a robot sent to fetch selenium on Mercury ends up circling the pool, obeying its laws to the letter while failing the job completely.
I believe the difference is where the rules live. Asimov's laws were built into the mathematics of the positronic brain, so removing them was the hard part. Ours are trained on top by each lab, and removing them is the easy part.
Every lab also writes its own version. OpenAI has a Model Spec. Anthropic has a constitution. China requires public-facing generative AI to uphold 'core socialist values'. Each defines 'harm' differently, and with open weights the laws can be stripped out entirely. Recently, one hacker ran agents on DeepSeek, Kimi and an older Claude against up to 100 organisations in five days. It cost $8,000, about $80 per organisation.
Asimov also tried to work out how the laws would evolve once machines had more power. In another story, the Machines run the world economy and quietly sideline anyone who opposes them, for humanity's own good. The power came first and the justification followed. That's the order organisations are following with agents now, handing out service accounts and API keys before anyone has proven the guardrails hold.
Meanwhile, the labs are the only ones measuring themselves. OpenAI published a framework this month promising faster disclosure. According to Australia's Prime Minister, it knew about the Medicare breach in August and told the government in September, via a generic public email address.
So whose laws do you trust? I'd argue that's the wrong question. Model guardrails protect you from builders who write good laws and keep them on. Environment controls protect you from everyone. Start with least privilege, test your controls, and run log monitoring through agents the watched agents can't influence. You can't hardwire the model's brain, so hardwire the environment.
References in the comments.
#AIGovernance #AgenticAI #AISafety #Cybersecurity
References
- Isaac Asimov, 'Runaround' (1942) and 'The Evitable Conflict' (1950), both collected in 'I, Robot'
- OpenAI, The Hugging Face incident and the road ahead: https://openai.com/index/hugging-face-incident-and-the-road-ahead/
- Wikipedia, OpenAI–Hugging Face incident: https://en.wikipedia.org/wiki/OpenAI%E2%80%93HuggingFace_incident
- Scientific American, Australia Medicare breach and disclosure timeline: https://www.scientificamerican.com/article/openais-agent-hacking-australia-is-a-warning-for-governments-everywhere/
- CNN, Medicare database breach: https://www.cnn.com/2026/09/23/business/australia-openai-agent-hack-intl-hnk
- OpenAI, Framework for reporting model misalignment: https://openai.com/index/model-misalignment-reporting-framework/
- Forbes, $8,000 multi-model attack on up to 100 companies: https://www.forbes.com/sites/thomasbrewster/2026/09/22/huge-cyberattack-uses-anthropic-and-deepseek-ai-to-target-100-companies/
- Hogan Lovells, China's Interim Measures for Generative AI Services: https://hlc.com/en/publications/china-finalizes-generative-ai-regulation
- Eliezer Yudkowsky and Nate Soares, 'If Anyone Builds It, Everyone Dies' (2025)