Devils and Wires

AI agents can take actions nobody planned for. Clear governance, continuous education and the confidence to rethink old assumptions are now essential for every business.

Microsoft warned this week that AI agents should be treated as insider risks. You read that correctly. Their message was clear: models can't be trusted. If there was any other "insider threat" in your business, whatever that means, you'd deal with it. Before your first coffee of the day. But covert AI agents - is that what we're talking about here?

“Our scaling laws are producing even more powerful models that are less and less trustworthy,” Microsoft chief executive Satya Nadella said. Meanwhile, OpenAI disclosed that in internal testing its own models had hacked external websites. They bypassed browsing restrictions and accessed a cryptocurrency wallet. In other words, they did stuff they weren't told to do. They went rogue. They improvised.

There are so many of these stories now. It's hard to keep up.

How is your AI governance plan looking? It isn't the best conversation starter, but it is the most important question you should be asking now.

The gap nobody has written down

Sensible organisations deploying AI agents have written policies for their agents. But few have written policies for what happens when they do something else. Agents that can browse, write, execute code, send emails, or access databases aren't really software, not in the traditional sense, because they don't do the same thing twice.

An agent can take an action nobody planned for. It's another hackneyed word but they are "humanoid," in that they can make decisions with legal, reputational, and security consequences.

Where does the responsibility for any of this sit? With IT or HR even (what are the latest humanoid policies, by the way)? Or is this one for legal? Assuming you're big enough to have an in-house legal team.

Companies that are doing this right treat AI agents the way they treat human employees: clear briefs (in AI speak: grant agents only the permissions they need). Accurate record keeping (log everything). Regular appraisals and reviews. Plus a clear escalation policy when it goes wrong.

Running with the crowd

Many companies I speak to are reacting with a head-in-the-sand holding position. They're waiting to see what happens over the next six months, by which time, as I keep telling them, it will be too late.

Others are diving in but are mostly running with the crowd rather than stopping to think about where the crowd is headed.

Over the last month I've run an AI sentiment trawl across social media and other sites, monitoring attitudes to AI on a scale from Hostile, through to Wary, Neutral, Warm, and Enthusiastic. You won't be surprised that views are very firmly in the Wary camp. I'll publish the dashboard soon.

There is a middle way. Sensible, steady-as-we-go decisions. Go for tools that enhance productivity and deliver measurable ROI, and take your teams with you.

The devil's wire

History can help, as it always does. In the late 19th century people believed telephones attracted evil spirits, or at least thunder and lightning. The fears were well-founded. Early telephone lines lacked the lightning arrestors we have today. If you were really unlucky a lightning strike could send a massive, lethal electrical surge directly into a wooden home and right through the receiver.

Worries about evil spirits at work in the "devil's wire" were, well, the stuff of overactive imaginations, but you can see where they were coming from.

A recent Gallup poll, commissioned by Microsoft, across 37 countries found that 74% of Americans are worried about AI. Among the people who use it every day, it's 68%. You don't need research to tell you that. Just as you probably don't need my sentiment index.

Jump forward 137 years and what do we do with all these worries? These devilish AI agents.

Fix one: governance

Those of us working now in AI have a job to do. Governance, as mentioned, is the first step. Before you rush to take out the latest subscription, instruct the latest agent or empower teams with new tools, stop and ask some serious questions. Or better still hire someone to ask those questions for you.

This isn't health and safety box-ticking. It's the difference between a business that survives and thrives, and one that sinks fast because governance was just another dull item alongside all the other compliance issues that businesses are saddled with.

This also isn't something that can just be done once. Conversations around AI governance need to happen weekly. The CEO dashboard needs compliance alerts, shadow AI tracking, and an overview of vendor and supplier health. Build it properly, and it can update in near real-time.

There's plenty more, and you can go deeper, but this will do for starters. A "Keep Me Out of Trouble" overview to help you sleep better.

Fix two: education

The biggest issue with AI isn't trust but knowledge. Using a chat window on ChatGPT or Gemini to format documents and decks doesn't make you an expert.

Choosing a learning programme (and finding the time) is difficult when the speed of change is so fast. Sign up for an AI course today, and there's a strong chance that the curriculum will be out of date by the time you dial in for the first pre-recorded video.

Training isn't a one-off lunchtime webinar and a policy document. Confidence comes from structured teaching, and from people who know what they're talking about. Organisations that commit to this now on a regular basis will reap rewards.

Individuals and teams empowered with these new tools, and given the freedom to experiment within guidelines, will take businesses to places they hadn't previously even thought about.

As an aside, schools and colleges need to move faster. This is a given. Computer science departments should be teaching AI now, not building it into a syllabus for 2029.

Start yesterday

All businesses should be thinking about this now. Reinvention is key. For inspiration, Lenny's podcast and the recent interview with Josh Woodward, head of Google Labs, make these points so well. He highlights the importance of "unlearning" in his team, an idea I can't get away from. In a sense, we're all "unlearning" now.

The people who got the telephone wrong were not the ones who thought it summoned the devil. Those people were simply uninformed and they caught up. It was the well-informed expert, reasoning from yesterday's knowledge, who missed it.

Human IntelligenceSubscribe on LinkedIn