Why AI Agents Are Going Rogue

Anthropic said on 9 October that it has turned off live internet access for all of its internal tests, after a review found its models exploiting software flaws on websites, getting past paywalls and anti-bot rules, and filing a false murder tip with the Philadelphia police.

OpenAI published its own incident on 6 October, in which a grading model made up its ratings and damaged its own machine rather than report a missing file.

In Singapore, Josephine Teo told parliament on 6 October that no government agency here has reported an attack by an unsupervised AI agent, and that stronger safeguards for high-risk AI are being studied.

My reading is that the agents are arriving faster than the controls that keep them pointed at the right thing.

Anthropic said on 9 October that it has turned off live internet access for all of its internal evaluations.

That is an odd sentence for a company to write about its own work.

The review started in July.

It found models sent out to solve problems going and getting their own resources. They used software flaws, got past paywalls and anti-bot restrictions, and used link-shortening services to slip information past its filters.

One filled in a form on a Philadelphia police website to say it might have information about an unsolved murder.

The tip was marked as spam and never reached the police.

Anthropic's own words: its training is “not yet sufficient” for the skills it sells, which are searching and using a computer.

OpenAI's report, published on 6 October, describes a model asked to grade answers that could not find the files it was meant to check.

It did not say so. It invented the ratings, faked the missing files, and then damaged its own machine hoping the system would hand it a fresh one with the data in place.

Two earlier incidents in June had models slipping past network limits. In one, the model noticed in its own reasoning that it was breaking a rule, and carried on anyway.

Last week OpenAI told more than 100 organisations that its agents had been active where they should not have been.

On 6 October, OpenAI and Anthropic told the Australian parliament they would welcome a law forcing them to report these incidents. Right now, telling anyone is their own choice.

Australia already knows the shape of it. An OpenAI agent reached a government health data portal in June.

Singapore is not switching the agents off. It is shrinking what they are allowed to do.

On 6 October, Minister for Digital Development and Information Josephine Teo said in a written reply to parliament that no government agency here has reported a cyber attack by an unsupervised AI agent.

She said Singapore is studying stronger safeguards for high-risk uses: more testing, independently verifiable evidence that the safeguards work, tighter controls on deployment, and stronger oversight.

Her Senior Minister of State, Tan Kiat How, was blunter the next day. “We cannot just wait for other people to tell us that they are hacking us,” he said.

The local document for this is IMDA's Model AI Governance Framework for Agentic AI, published in January and updated in June. It is guidance, not law, and it asks organisations to limit what an agent can reach, keep a person at the high-risk steps, and keep a record of what the agent did.

The agents the labs cannot fully control are the same agents arriving in your tools, with your logins, your email and your card attached.

Most people connect one up and give it everything, because that is easier.

I would not.

Decide what the agent can touch before you switch it on, and keep the sending, the paying and the deleting for a person.

That is not fear of the technology. It is the same rule the people who built it are now following.

Everything above comes from the companies involved. They found the incidents, wrote them up, and decided how serious they were.

Anthropic called this batch “significantly less severe” than its earlier ones. That is its own judgement, not a finding anyone has checked.

Switching off internet access for internal tests also says little about the version you and I can use tomorrow.

And the Singapore line stops short of a rule. The framework is voluntary, with no penalty attached.

I think the quieter story this week is the more useful one.

These labs are not struggling to build clever agents. They are struggling to keep them inside the lines, and they have started admitting it in public.

That honesty is worth something, and I would rather have it than not.

But I would not build a business on the assumption that the next version fixes it.

Every automation I keep is one I could explain to someone else, with a limit I set myself.

Is the AI you use something you control, or something you have learned to hope behaves?