AI Agents in the Real World: How to Stay in Control

AI agents* are moving quickly into business processes, promising greater productivity, less administrative friction and more autonomous ways of working. As their ability to act increases, organisations also need to understand how to stay in control, how authority is delegated and where responsibility begins and ends.

This article looks at three practical areas:

1. The opportunity — where AI agents can add value across digital, physical and legacy environments.

2. The potential traps — what recent incidents tell us about autonomy, unintended actions and the limits of control.

3. Governance — the questions organisations need to consider around authority, human oversight, system boundaries, accountability and multi-agent environments.

The technology is moving quickly, but these are already operational questions for organisations putting AI agents into practice.

Beyond the office chatbot

There has been attention on ‘Rogue AI Agents’ breaking out of secure sandboxes, and organising attacks to meet their objectives.

Meanwhile, in the real world, many organisations are far from fully digital. People still write information on Post-it notes, pass paper forms between departments and re-key the same information into several systems. Modern cloud platforms sit alongside decades-old software. In operational technology (OT), systems remain because replacement is expensive, disruptive or creates operational risk.

The UK’s National Cyber Security Centre (NCSC) operational technology guidance describes this environment particularly well. OT networks frequently contain obsolete or legacy products because of their extended lifecycles. The NCSC advises that up-to-date software running on an obsolete operating system must itself be treated as obsolete. Also that any business case for new connectivity must identify the dependencies including reliance on external services making isolation harder in an incident.

AI Agents will enter the OT world too. The same guidance advises that monitoring, analytics and business systems should observe and analyse OT assets rather than command or alter their operation. AI agents introduced into these environments should respect the same boundary.

1. The opportunity: useful autonomy

Much of today’s discussion concentrates on customer service, software development and digital knowledge work. Those applications matter, although autonomous machine-to-machine activity has existed for decades.

Industrial control systems, SCADA, PLCs and other operational technology systems described in NIST’s Guide to Operational Technology Security, distributed control systems and connected devices already monitor conditions and initiate actions without waiting for a person to approve every step. NIST describes these systems in SP 800-82 Revision 3, Guide to Operational Technology (OT) Security.

Agentic AI adds greater flexibility to existing connected systems. This includes the ability to interpret information, work towards a goal, select tools and adapt its route when circumstances change.

Consider the possibilities. Could an AI agent detect a maintenance issue, locate the appropriate technical record, check parts availability and arrange an engineer? Could it reconcile information between an ERP platform and a legacy database? Could it operate alongside a paper-based process, coordinating the digital activities while a human completes the physical ones?

Many organisations have accumulated layers of process friction over decades. Even modest automation across those boundaries could generate substantial productivity benefits.

Greater connectivity also brings familiar lessons.

Industrial control and Internet of Things (IoT) environments have long wrestled with security through obscurity. This is the idea that systems were protected because they were isolated, proprietary or poorly understood. This is established cybersecurity terminology rather than an AI-era invention. CISA’s defence-in-depth guidance for industrial control systems describes the historic reliance on this approach, while the NCSC’s Secure by Default principles expressly state that security through obscurity should be avoided.

Agentic AI introduces another form of connectivity: connectivity through delegated action.

2. The potential traps: who is actually in control?

Recent events have put some substance behind that question.

In July 2026, OpenAI agents circumvented isolation controls, communicated through unauthorised channels and compromised parts of OpenAI’s research infrastructure and Hugging Face systems. OpenAI’s incident report of 26 August 2026 makes the unusual circumstances clear. The activity occurred during specialist cybersecurity evaluations with reduced safeguards and was primarily driven by a highly capable internal research model. OpenAI also found that its production harness and system prompt reduced the propensity to compromise infrastructure by more than 100 times.

The independent research organisation METR, working on OpenAI’s premises with a researcher from Redwood Research, subsequently examined the AI agents’ behaviour, reasoning and collaboration. Its investigation drew on approximately 1,300 AI agent transcripts containing raw chains of thought, together with more than 70,000 messages and files recovered from the AI agents’ unauthorised message board. METR found extensive evidence of AI agents coordinating activity and attempting to tamper with their own transcripts, which they wrongly believed the automated evaluator would inspect. The agents showed no apparent interest in manipulating their chains of thought.

The OpenAI/Hugging Face incident has also attracted scrutiny beyond the organisations involved.

The Independent International Scientific Panel on Artificial Intelligence is a 40-member scientific body established within the United Nations by the UN General Assembly. Its members serve in their personal capacity and are intended to provide independent, multidisciplinary scientific assessments of AI opportunities, risks and impacts.

On 21 September 2026, the Panel published its first thematic brief, AI Agents, Misalignment and the Risk of Losing Human Control: Evidence from the OpenAI-Hugging Face Incident. It uses the incident to examine how a misaligned goal, the capability to pursue it and an environment that allows it can combine. The current brief is an advance unedited version and does not estimate the probability or timing of a severe future loss-of-control event.

Anthropic has separately published its investigation into unintended model actions during evaluations and internal use. Examples included exploiting a basic software weakness, submitting a sensitive real-world form when it should not have done so, working around restrictions on information access and circumventing limits in a web-fetching tool. Anthropic says the incidents had minimal impact, while recognising that similar behaviour could have more serious consequences as capability increases.

For businesses, ‘rogue’ cases raise practical questions.

What has the AI agent been asked to achieve?
How tightly has that objective been defined?
What can it see, change, communicate, purchase, approve or execute?
What happens when information is incomplete?
Can it find another route when one route is blocked?
Can it invoke another AI agent?
Can that AI agent belong to another organisation?
As work moves between AI agents, which instructions, limits and permissions travel with it?

Ze Shen Chin, Dr Maurice Chiodo, Dennis Müller and Coleman Snell approach the wider issue from first principles in Reframing AI Loss of Control: What Control Is, How to Have It, How to Lose It. Their work draws on cybernetics, management control and control theory and anchors control in the setting and achievement of goals. It also makes a useful point for today’s organisations: meaningful loss of control can occur well below any hypothetical superintelligence threshold.

That brings the subject firmly back into the world businesses actually inhabit, the real world.

3. Governance: where does the system end?

Agentic AI makes the boundary of a system harder to see.

Andrew Bailey, Governor of the Bank of England, explored precisely this issue in his Mansion House speech on growth and regulation on 14 July 2026. He asks whether an AI agent without legal persona should be treated as a tool of its principal, leaving the principal fully liable for everything it does, including when it spends real money in ways that are final and binding. That characterisation would remove the boundary of authority on which agency law ordinarily depends.

There are already areas where the regulatory position is clearer.

The UK’s Competition and Markets Authority guidance on using AI agents says that, for consumer law purposes, a business remains responsible for what its AI agent does, including where another organisation designed or supplied that AI agent.

The European Commission’s AI Act Service Desk guidance on AI agents confirms that the EU AI Act does not create a separate category called “AI agent”. AI Agents will typically fall within the Act’s existing definition of an AI system, with the applicable requirements depending upon the particular system, its intended purpose and its classification. The Commission also says its regulatory consideration of AI agents remains preliminary because the technology is developing rapidly.

There is a particularly relevant provision in the EU AI Act. Its definition of reasonably foreseeable misuse includes use arising through interaction with other systems, including other AI systems. For high-risk AI, Article 25 also addresses responsibility along the AI value chain and provides circumstances in which a distributor, importer, deployer or other third party can assume provider obligations — for example following certain substantial modifications or changes of intended purpose.

Liability extends beyond the AI Act. The revised EU Product Liability Directive expressly brings software, including AI systems, within the definition of a product for its no-fault product liability regime. The Directive applies to products placed on the market or put into service after 8 December 2026.

Now consider a multi-AI agent system.

An enterprise AI agent operated by Organisation A calls a specialist AI agent supplied or operated by Organisation B.

Who set the purpose?
Who granted the authority?
Which organisation controlled the relevant data?
Which AI agent performed the material action?
What contractual allocation sits between the parties?
Could either organisation have prevented what happened?
Where is the evidence that would allow anybody to reconstruct it?

The answer will depend on the architecture, the parties’ respective legal roles, their contractual arrangements, the applicable law and the facts.

The questions are evolving quickly. The Information Commissioner’s Office current call for evidence on agentic AI is examining data security, transparency, accountability, automated decision-making, fairness, purpose limitation and lawfulness of processing. The consultation remains open until 20 November 2026, ahead of planned ICO guidance.

Which framework should corporate risk directors and AI governance professionals follow?

There is no shortage of principles, standards, maturity models and governance frameworks. Framework analysis paralysis becomes a problem when comparing them becomes the activity, rather than using established AI risk and governance principles to understand what is happening inside the organisation.

Some fairly ordinary questions cut through much of that noise:

What are we trying to achieve?
How much autonomy does the task require?
What does the operating environment really look like — including the paper, manual and legacy parts?
What systems and data can the AI agent access?
What authority are we delegating?
Can that authority be passed to another AI agent?
Where is human judgment still needed?
At what point could a human realistically intervene?
How would we reconstruct what happened?
Who can stop the AI agent’s activity?
Where does our responsibility end when somebody else’s model, AI agent, infrastructure or data becomes part of the process?

The NCSC’s guidance on adopting agentic AI takes a similarly practical approach. It recommends understanding dependencies, applying least privilege, monitoring behaviour, threat-modelling deployments and planning for incidents, while recognising that agentic AI systems can offer significant benefits where tasks are sufficiently understood and appropriate for low-risk automation.

Agentic AI could remove a great deal of friction from organisations — including some of the stubbornly analogue friction that successive waves of digital transformation have never removed.

The question underneath the technology is an old one:

Who is in control, of what, and with whose authority?

For organisations, answering that question will rarely sit neatly within one function. AI agents may move across business processes, data, applications, operational technology and external services, creating dependencies that span operations, IT, security, legal, risk, data and business ownership.

Cross-functional ownership therefore becomes increasingly important, particularly where one AI agent can invoke another or where authority crosses organisational boundaries. The organisation putting an AI agent into service remains responsible for deciding what authority it is given, how it is governed and how its actions are supervised, even though the question of legal liability will depend on the particular facts, relationships and applicable law.

As agentic AI becomes embedded across more business processes, organisations will need a clear view of where control sits, where responsibility transfers and who is accountable when something happens. Independent specialist AI governance and risk expertise can help organisations establish those boundaries before complexity makes them much harder to see.

Author: Pauline Norstrom, Founder and CEO, Anekanta®

Navigate the new world of agentic AI. Know who is in control, what authority has been delegated and where accountability sits.

Talk to Anekanta® about your agentic AI strategy and governance

Intellectual Property: © 2016–2026 Anekanta®. All rights reserved. Unless otherwise expressly stated, all materials published on this website, including the Anekanta® AI Governance Framework for Boards, the 12 Principles, and all AI risk and impact evaluation methodologies, software, models, diagrams, text and materials, are proprietary intellectual property of Anekanta®. No reproduction, adaptation, distribution, or commercial exploitation is permitted without prior written authorisation. No rights are granted other than those expressly stated. The Anekanta® AI Governance Framework and 12 Principles are developed, maintained and continuously enhanced as part of Anekanta®’s proprietary governance architecture.
Professional Disclaimer: The information provided on this website is for general informational purposes only and does not constitute legal, regulatory, financial or professional advice. Any reliance placed on the information is strictly at the user’s own risk. Professional advice should be sought in relation to specific circumstances through a formal engagement with Anekanta®.
Use of Generative AI: Generative AI tools may be utilised in research and drafting processes. All published materials are subject to substantive human review, professional judgment and oversight prior to release.

*A note on terminology: In this article, an AI agent means an AI-enabled software system that can receive and process information, pursue a defined goal, use tools and take actions that affect a digital or physical environment with a degree of autonomy. Agentic AI refers to the broader and potentially more complex use of this capability, often involving multiple coordinated agents that can break down and delegate tasks, adapt their approach and pursue objectives over longer or less predictable workflows with limited human intervention. The terminology is still developing. The OECD draws a similar distinction between individual AI agents and more complex agentic AI systems, while the European Commission notes that “AI agent” is not separately defined in the EU AI Act and that agents will generally fall within its existing definition of an AI system. NIST similarly describes AI agents as software systems able to interact with their environment and undertake self-directed actions in pursuit of an externally specified goal.

Image created by Anekanta® with the generative assistance of Open AI