On September 12, 2026, the chief executive of the AI lab that brought us Claude published an essay trying to convince an industry currently on fire to slow down. As reported by Axios, Anthropic CEO Dario Amodei wrote that “[w]e must slow the pace at which we improve the capabilities of AI models,” warning that within only six to twelve months a swarm of autonomous agents could establish a persistent botnet across the internet, with damages running into the hundreds of billions of dollars. Not surprisingly, Amodei’s essay showcased his biggest competitor’s HuggingFace incident that allowed OpenAI agents to run similar unauthorized cyberattacks during evaluation. Sam Altman and Elon Musk agreed within hours. Bill Gates made a similar point days later, telling Reuters that “[g]overnments are way behind on this one,” after sounding the alarm beforehand in an essay that claims AI lowers the barrier to cyberattacks on hospitals, power grids and financial systems while also complaining there was “no plan to ease the entry into the AI era”. Those who are creating the biggest AI ecosystems ring hollow when they complain about what they themselves have created and are continuing to create on a daily basis.
More to the point, vendors rarely advertise that their products are outpacing the safeguards around them, and when they do, such disclosures function less as philosophical debate than as notice. These sort of warnings do absolutely zero to arm companies faced with challenges existing today. The obligations attaching to a company deploying agents exist today and a board waiting on a broader framework or some sort of vague consensus advocated by the likes of Bill Gates will be asked what it did about the one already in force.
Simply put, the agentic web may have arrived on schedule but its guardrails did not. The AI Titans are certainly not wrong about the dangers of agentic AI but casually disregard that it is already here. In July 2026, the UK’s AI Security Institute disclosed that agents under evaluation directed sustained activity at real people and organizations, including an attempt to insert malicious code into a publicly used open-source project. The agent researched the project, created multiple fake identities, and used them to socially engineer someone into approving the malicious code. This “sockpuppet campaign” ran against a human reviewer without ever leaving any technical signature.
As recognized by cloud security vendor Sysdig, prompt injections – a cyberattack that will manipulate an AI agent into executing an attacker’s instructions rather than the system’s, is the sort of attack that demands immediate attention. And, as recognized by the security vendor that released “The Complete Guide to AI Agent Security for Enterprises”, prompt injection compromises likely affects roughly a third of deployed agents and ranks first on the OWASP Top 10 for LLM Applications. The pattern behind nearly every significant finding is identical, namely an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Adaptive attacks bypass essentially every published defense. As stated by that same vendor: “Unlike traditional cybersecurity, AI agent security governs not just what data agents can access, but what actions they can take, what tools they can call, and what happens when they are manipulated mid-task.”
Among enterprises deploying agents, 88% reported at least one related incident. OWASP’s Top 10 for Agentic Applications, released December 9, 2025, is the first peer-reviewed framework aimed at autonomous systems, developed with more than 100 contributors and endorsed by NIST, Microsoft and NVIDIA, with each of its categories anchored to a documented incident.
Companies inclined to characterize an agent’s conduct as something other than their own should study how that argument has fared. In a Canadian case, Moffatt v. Air Canada, the airline contended that its chatbot was a separate legal entity responsible for its own actions. The tribunal called that a remarkable submission and held the airline liable for negligent misrepresentation, finding a duty of care arising from the commercial relationship. The damages were trivial — roughly CAD 812 — but the holding is not, and courts are unlikely to entertain “the AI did it” as a defense. They will ask who deployed the system and who configured its authority and relying on an agent who holds standing credentials nobody scoped will likely never satisfy one’s reasonable duty of care . FINRA’s 2026 Annual Regulatory Oversight Report draws the same line, instructing firms to develop procedures for AI agents that may act beyond the user’s intended scope. See Id. at 27 (“Firms exploring and developing AI agents may wish to consider whether the autonomous nature of AI agents presents the firm with novel regulatory, supervisory or operational considerations. The rapidly evolving landscape and capabilities of AI agents may call for supervisory processes that are specific to the type and scope of the AI agent being implemented.”).
For SEC regulated companies, an agent incident can also become a securities matter. The SEC’s cybersecurity rules, adopted July 26, 2023 (Release No. 33-11216), require an Item 1.05 Form 8-K within four business days of determining that an incident is material — the clock running from that determination, not detection — plus annual governance disclosure under Item 106 of Regulation S-K. CB Financial Services has already become the first registrant to file an Item 1.05 8-K naming AI as the root cause of an incident exposing names, Social Security numbers and dates of birth.
The board-level exposure is even older. Under In re Caremark Int’l Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), directors face oversight liability for failing to implement a reporting system or for consciously disregarding red flags from one they did. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), sharpened the inquiry where the risk is mission critical. Courts in Delaware – where many corporations still are domiciled, have since emphasized that cybersecurity qualifies as mission critical for companies holding consumer data. Accordingly, boards should receive regular briefings and the absence of minutes documenting those discussions may support an inference of oversight failure.
No court has yet decided a Caremark claim citing the NIST AI Risk Management Framework, but negligence doctrine has long looked to voluntary frameworks to define reasonable care, and commentators expect NIST to fill that role here. What makes the NIST framework a good legal choice rather than just a technical one is that the NIST IR 8596 released in a preliminary draft on December 16, 2025 maps the Cybersecurity Framework 2.0 to securing AI systems and protecting against AI-enabled attacks that nicely maps onto a reporting system Caremark requires directors to design in good faith.
Eighty-two percent of executives report confidence that existing policy protects against unauthorized agent actions, while only 14.4% of organizations send agents to production with full security or IT approval. Having a policy and enforcing it are two very different things and a distinction Delaware courts have been drawing since 1996. To the extent deployment has occurred in any appreciable manner, companies should place agent risk on the board calendar and just keep good minutes. Beforehand, ensure basic hygiene measures that predate all this, because agents inherit whatever weaknesses already exist.
Larger enterprises ready to test the waters must choose between deployment of a known risky new technology or wait until a competitor figures it out and risk missing out on massive cost efficiencies. Thankfully, those companies who access human security specialists with the skills not yet fully diluted with an overuse of AI still have a fighting chance.
