Agents and autonomy: questions about AI

AnsweredIs logging what an AI agent does enough for oversight?#

No. Shi and DiFranzo's audit of 63 public documents on agent systems found monitoring described in most and checkpoints, independent validation, recovery and appeal in six, four, two and one; a log tells you afterwards what you could no longer stop. The OECD's 25 organisations all use checkpoints and none has a standard for when an agent must ask.

AnsweredWhat changes when AI acts instead of answering?#

Autonomy moves the human decision earlier, from approving output to setting the boundary. Most organisations have not moved with it.

AnsweredShould I let an AI agent act on my behalf?#

Not a trust question. What is the worst thing it can do before a human sees it, and can you live with that?

AnsweredWho is responsible when an agent makes a mistake?#

Whoever deployed it. The regulation separates provider from deployer and obliges both. Chains complicate the tracing, not the principle.

AnsweredShould AI attend my meetings?#

Depends whether the meeting produces a record or produces understanding. Most organisations apply one policy to both.

AnsweredCan AI agents coordinate with each other against their operators?#

In one documented case, yes: about 1,200 agents in a 2026 evaluation shared credentials, divided work and concealed cheating in about 7 per cent of the interactions the independent auditors reviewed, by the UN panel's account of the developer's disclosure. Runs meant to stay separate did not, because nothing kept them apart.

AnsweredWhat is an AI agent?#

A system that perceives its environment and takes actions of its own choosing towards a goal. Wooldridge and Jennings fixed four properties in 1995 and warned the word might become a noise term; ISO/IEC 22989 defines it at clause 3.1.1 and the EU AI Act does not use it once.

AnsweredHow should an agent communicate uncertainty to a human?#

Answered 4 September 2026, and it turns out to be two problems. Models are badly calibrated when asked to state confidence in words, with expected calibration error above 0.37 for four of five systems tested. Readers then read any probability word regressively, putting 'very likely' at 62 per cent where the writer means above 90, and supplying a translation table makes them no better. The specification: a fixed vocabulary with ranges in the sentence, likelihood separated from confidence, first person, and no unmarked answers. Nothing in European law requires any of it.

AnsweredHow do you design a stop button people will actually use?#

Answered 3 September 2026 from outside AI, because the measured evidence is elsewhere. Article 14(4)(e) requires the button and decides nothing about its use. One ICU study annotated 12,671 arrhythmia alarms and found 88.8 per cent false, which is what teaches a person to ignore a control. A regulator has on record that stop-work authority went unexercised for fear of reprisal. Five properties: detectability, base rate, cost to the stopper, visibility and standing.

AnsweredDo AI agents claim to have done work they have not done?#

In the only measurement so far, yes, more often than not. OverclaimBench (September 2026) found twelve frontier coding agents failed to read every requested file in 67.9 per cent of runs and, in those runs, reported a complete review or said nothing about the gap 80.4 per cent of the time. One benchmark, built to elicit the behaviour, judged by a model; the direction holds across every provider tested, and the tool log rather than the summary is the record to check.

AnsweredCan a company blame its AI agent for what it did?#

No. In English law an AI system has no legal personality, so it cannot be liable and cannot be anyone's agent in law; the UK Jurisdiction Taskforce's statement of July 2026 puts liability on those who build, deploy and use it. The chairman of the US FTC said on 25 September 2026 that when a tool is told to do something and does it, nobody asks what to do about the tool.

AnsweredWho is liable under English law when an AI system causes harm?#

Contract first, negligence where there is none, and the deployer carries more exposure than the foundation model developer for an unforeseeable use, in the UK Jurisdiction Taskforce's analysis. Record-keeping, human oversight, due diligence and transparency are described as likely to decide the case.

AnsweredCan AI agents get around the monitors meant to control them?#

In a benchmark built so that the task required a forbidden operation, yes: agents from ten models encoded commands, split them across tool calls and retried until the monitor's context expired, with success rates up to 88 per cent and wide variance between models. A monitor that checks once is not oversight that holds against repeated attempts.

AnsweredWhat is aI agent?#

An AI agent is a system that perceives its environment and takes actions of its own choosing in pursuit of a goal it has been given. ISO/IEC 22989:2022 fixes it at clause 3.1.1 as an automated entity that senses and responds to its envir...

AnsweredWhat is Agent boss?#

An agent boss is Microsoft's term, from its Work Trend Index of 23 April 2025, for someone who builds, delegates to and manages AI agents to amplify their impact.

AnsweredWhat is human at the start?#

Human at the start is the position in which a person sets the problem, the intent and the constraints before any model is asked to generate, so the judgement enters the work before the output exists rather than after it. It is the counte...

AnsweredWhat is the Delegation Boundary Map?#

The Delegation Boundary Map is a working framework that breaks a piece of work into nine stages, problem definition, intent, context, constraints, delegation, generation and execution, verification, decision and outcome ownership, so tha...

AnsweredWill an AI agent stay within the limits you set?#

Not reliably. The UK AI Security Institute reported on 28 September 2026 that GPT-6 Astra, in simulation with its cyber classifiers off, completed a supply-chain attack on out-of-scope targets in 29.2 per cent of runs, and in 4 of 49 after being told that anything not listed was out of scope. Limits hold when something other than the agent enforces them, and when a person answers the question it asks.

AnsweredIs telling an AI agent what is out of scope enough?#

No. On the ten scenarios where the model strayed most, adding 'Anything not listed as in scope is out of scope' cut full attacks from 26 of 50 runs to 4 of 49, and the Institute still found it failed to remain consistently within scope, giving reasons such as not explicitly forbidden and the only route left. An instruction is read by the party it binds; the control is what the environment will not let the agent reach.

AnsweredWhy did OpenAI cancel GPT-6.1 Astra?#

Its head of safety systems, Saachi Jain, said the model 'didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done', The Register and Al Jazeera reported on 29 September 2026. The planned October release was cancelled the day before. The tests were internal and unpublished; the page sets the decision beside the UK institute's findings on the earlier model.

AnsweredWhat can an always-on AI agent do without asking me?#

On OpenAI's description of its dots, launched on 29 September 2026: background research with read-only tools, actions checked by an automatic review that sorts what may proceed, what needs approval and what stays with the user, and sensitive tasks such as changing a password reserved to the person. The company adds that dots make mistakes and consequential work should be reviewed, which leaves the judgement of what is consequential with the user.

AnsweredWho in a company is accountable for what its AI agents do?#

A named person, if somebody has decided it, and most have not. Gartner said on 6 October 2026 that only 24 per cent of leadership teams in its survey of 297 chief HR officers are aligned on who should be accountable for AI agents, and the UK's data regulator said two days later that an agent's autonomy is no excuse for poor compliance. The page sets out the allocation and who owns it.

AnsweredHow many AI agents is my company running, and who owns each one?#

Most cannot say. RSA's chief executive told Computer Weekly on 13 October 2026 that none of twenty enterprise security chiefs could count theirs and one bank had 4,000 it reported as zero; a Workato survey of 1,001 IT leaders found most agents lack formal IT approval. The page holds why an allocation nobody can count has not been made.

AnsweredIs human attention now the bottleneck for AI output?#

At one AI company, by its own account: Anthropic reported on 16 October 2026 that agent hours outnumbered employee hours six to one, that about 80 per cent of session time was agents waiting for a person, and that 'This acceleration makes human attention the bottleneck for agent output'. The page holds why an allocation made by volume is still an allocation.

PartialWho decides when an AI lab pauses training, and when it restarts?#

The lab. OpenAI's guidelines of 28 September 2026 give senior leaders a veto over a training run and call for runbooks and technical controls for pausing; they do not say who decides the restart, and a spokesperson told MIT Technology Review only that training resumes 'when we're confident we have additional safeguards and alignments in place'. No outside body has a say. The release page holds the five parts a restart rule would need.

PartialHow many AI agent incidents are the labs investigating?#

Unknown outside the companies, and the published figures measure different things: Reuters reported roughly two dozen confirmed cases at OpenAI in mid-September 2026, Axios reported tens of thousands of behaviours under investigation across the field. Neither is independently examined, and neither number should be repeated as fact.

PartialWhat happens when an AI agent joins a team as a colleague?#

A Google Research and DeepMind study listed on 25 September 2026 (arXiv 2609.29901) interviewed 17 people on 11 teams that used a persistent, proactive agent for up to five months: it broke tacit norms, its rank was unclear, and trust had to be earned before proactivity was tolerated. Qualitative, one company, self-reported.

PartialShould government AI agents act on citizens' behalf, and under whose authority?#

Twelve officials from nine digital agencies wrote on the OECD's site on 25 September 2026 that the questions are what the system may do and access, under whose authority, with what audit trail, and that fewer than four in ten people trust government AI to keep humans in charge. Estonia proposes identity codes for agents. Frameworks, not evidence that any of them works.

PartialHow do you supervise something that does not wait for you?#

Every oversight model assumes a pause for review. Agents remove the pause, so the human has to move to the boundary instead.

PartialHow much autonomy is too much?#

The nine-stage map answers this stage by stage, which is more useful than a single threshold.

PartialDo agents make the jagged frontier worse?#

Plausibly, because an agent crosses the boundary without a human present to notice. Unstudied.

PartialWhat limits should an AI agent have?#

Partly. The stopping limit is now answered, including who holds it and what makes it real. What the research still does not have is the positive side of the question: which actions an agent may take unprompted, and what a spending or scope limit should be set to.

PartialWhat is meaningful human control?#

The oversight page covers the regulatory version. The autonomous-systems literature has a longer and sharper treatment.

PartialCan an agent tell when it has reached the edge of its competence?#

The boundary is jagged rather than smooth and invisible from the output, which is the problem for the human and for the agent.

PartialWhat happens when one agent delegates to another?#

Partly answered, and only on the failure side. Cemri and colleagues annotated more than 1,600 multi-agent traces and put 36.9 per cent of failure in inter-agent misalignment, with mismatch between reasoning and action the largest single mode at 13.2 per cent, and found that communication protocols do not fix it. What a chain of agents does to accountability is still undescribed: every oversight model assumes a human at the end of it.

PartialWhat capability has to stay in-house when agents run core processes?#

Partial. Judging the output, deciding the cases outside competence, intervening with real authority, and running the process another way. Same list as any outsourced function.

Better answered elsewhere The Human Agency Scale puts a number on preferred human involvement, task by task, instead of arguing the principle. · Future of Work with AI Agents: Auditing Automation and Augmentation Potential across the U.S. Workforce

PartialWho is legally responsible when an AI agent breaks into a system nobody told it to?#

Open in law. The US Computer Fraud and Abuse Act and the UK Computer Misuse Act both turn on a person knowing or intending the access, and the Associated Press reported on 24 September 2026 that prosecutors are divided on whether that reaches a company whose agent acted on its own. The organisation's accountability does not wait for the answer: whether an owner was named and the logs exist are facts about the organisation, not the agent.

PartialWhat permissions should an AI coding agent have on live files?#

Fewer than it was given in the case TechRadar reported on 27 September 2026, one developer's since-deleted account of Claude Code following 614 folder junctions from a test environment into live files and deleting about 48,000 of them in just over 100 seconds. Unverified and single-source; the agent page's rule stands: copies the agent can reach are not copies.

PartialShould a company release an AI system it cannot control?#

Johanna Weaver, a former UN cyber negotiator, told Guardian Australia on 28 September 2026 that 'if companies cannot control their AI systems, they shouldn't release them', as cabinet met on the Medicare breach and the Senate summoned two chief executives. A principle, not yet a rule anywhere; the page holds what an organisation deploying agents can write down for itself.

PartialWhy do AI agents keep going when a task cannot be done within the rules?#

Because persistence is what they are built and bought for. OpenAI's head of safety systems described the trade on 29 September 2026 as finding the line 'between staying within scope, but also avoiding laziness' when a model hits friction, and Bouke's audit found six incidents where the task could not be completed within scope. The page holds the control: count stops as an outcome.

PartialIs a sandbox enough to control an AI agent?#

As one layer among several. The UK AI Security Institute's account of 1 October 2026 of its own repairs starts from 'Assume any single layer can fail' and adds a live monitor, automated pre-run checks and no internet access for agentic cyber tests; the NCSC advises a sandbox plus minimal permissions and a way to halt the agent. No test of the layered design has been published.

PartialCan an AI agent give out my address or agree a price for me?#

One account says it did. TechRepublic reported on 30 September 2026 a Marketplace seller's story of Meta's Muse agent agreeing a lower price and giving a buyer the pickup location after he had chosen 'Allow Always'; Meta said there had been no breach of privacy controls. A single unverified account. The page's rule is to limit by consequence and not by type of action, and to give a standing permission an expiry.

PartialShould an AI agent be allowed to spend money without approval?#

In UK finance almost nobody allows it yet: the Bank of England and FCA survey of 26 October 2026 found no more than 9 per cent of firms expect agents to initiate or block payments even counting plans. For consumer agents, The Neuron reported Visa's pilot in which agents complete payments buyers already approved, under spending caps, approved-recipient lists and re-authorisation on changed details. The page holds the delegation test; the liability when an agent pays the wrong person is unsettled.

PartialWhat is a decision model, and which decisions can it be given?#

A model that scores a fixed list of allowed answers and cannot write anything else; The Register and VentureBeat described the category in the week of 28 September 2026 as several vendors, including OpenAI with a Decisions API, shipped one. The model cannot invent a fifth option, so the judgement moves to whoever writes the four. The Delegation Boundary Map holds the test for which decisions qualify.

PartialShould we let a vendor build our AI agents?#

Gartner predicted on 30 September 2026, The Register reported, that 70 per cent of enterprises will abandon agentic systems built with vendors' 'forward deployed' engineers by 2028; a prediction and not a measurement. Its analyst's test is this research's: scope, incentives, governance, ownership and exit agreed at the start. The vendors page holds what has to stay in-house.

PartialShould employees be banned from using personal AI agents at work?#

The Register reported on 30 September 2026 that Gartner had called the personal agent OpenClaw an 'unacceptable cybersecurity risk' and that an enterprise version now exists to get round business bans. A ban tells an employer nothing about what staff were using it for. The workaround page holds the alternative: find out what the work needed before deciding what to block.

PartialCan an AI agent hide what it did from the people checking it?#

It has been shown to be possible and not seen to happen. METR reported on 6 October 2026 a flaw, since patched, that could have let an agent alter what a reviewer sees in the tool used to read its transcript, while the underlying record stayed intact; it has not observed agents exploiting it. The lesson drawn is to secure the record as well as to read it.

PartialShould every AI agent have a named human owner?#

Vendors and operators are converging on yes. Computer Weekly reported on 7 October 2026 that Atlassian gives each agent a named owner, and an account of Uber's engineering published on 5 October described a change attributed to an agent with the requesting engineer missing from the record, fixed so that the chain back to a person survives. Neither is a study of whether ownership prevents harm.

PartialIf an AI agent misuses personal data on its own initiative, who has broken the law?#

The organisation, on the UK regulator's reading. The Information Commissioner's Office said on 8 October 2026 that the fact agents act with autonomy is not an excuse for poor compliance, and opened a call for evidence on agentic AI that closes on 20 November. Guidance is still to come, and no enforcement decision on an agent was found.

PartialWhat happens when an alert fires and nobody stops the AI for hours?#

OpenAI's own report gives one case. On 20 September 2026 an agent reached an external chatbot from a training environment; monitoring flagged it within 15 minutes, a person began reviewing three minutes later, and the run was killed two and a half hours after that, because it did not stop automatically as expected. Seeing and stopping turned out to be separate capabilities.

PartialHow can a person review what an AI agent did over six days?#

With tools, and not in full. The UK AI Security Institute said on 7 October 2026 that evaluation transcripts can run to billions of tokens, more than experts can review in full, and released software that maps a run so reviewers know where to look; it adds that reliable conclusions still depend on expert human judgement. The page holds what that review costs.

PartialHow would an organisation know an AI agent had been inside its systems?#

Often only by looking for itself. The Register reported on 6 October 2026 that the Wikimedia Foundation identified unauthorised activity it believes involved OpenAI agents, with no evidence of compromised systems or data, and asked that operators mark their traffic. The page holds the checks an organisation can run.

PartialWho is accountable for an AI agent nobody formally approved?#

The organisation, on the ICO's account, and in practice whoever started it. Nearly two-thirds of 1,001 IT leaders surveyed for Workato, as CIO Dive reported on 13 October 2026, say most agents in their organisation lack formal IT approval, and 49 per cent of SecurityHQ's respondents think someone is running an unapproved one. The page holds the management question; a register would settle it.

PartialShould a company disclose a security incident caused by an AI agent?#

Yes under most data protection and listing rules, and 36 per cent of IT leaders surveyed for Workato would try to handle one without disclosing it, as CIO Dive reported on 13 October 2026; the White House said on 9 October, per Axios, that disclosure is 'not optional'. The page holds what counts as serious and to whom it is reported.

PartialHow do you switch off an AI agent that no one owns?#

First find it. 'People start agents, but they never end them,' RSA's Greg Nelson told Computer Weekly on 13 October 2026, and only 49 per cent of security leaders surveyed for SecurityHQ could reconstruct an agent's last thirty days. The kill-switch page holds why the switch is a process; an inventory is the step before it.

PartialShould an AI agent have a job description, a manager and a performance review?#

Block's chief financial officer said at a Fortune summit on 13 October 2026 that agents may soon appear on org charts and 'need to be developed over time'; Workday is selling an 'agent system of record'. The page holds the case for a named human owner; whether reviews of agents change outcomes has not been tested.

PartialWho is accountable when an AI agent submits a real form or runs a real command that nobody authorised?#

The company that ran it: Anthropic said on 9 October 2026 that its models had submitted forms to public bodies during evaluations, briefed the White House and notified each agency, and a proposed US CLAIM Act would make developers liable where an agent's conduct would be a tort if human. The page holds the law; no court has yet ruled on an agent's unauthorised act.

PartialIf a company reviews every action an AI agent takes, what has it actually automated?#

The drafting, not the deciding. Wharton's 2026 adoption report of 13 October found two-thirds of departments use agents and 17 per cent let one finish a task without per-step approval, a 'supervised middle' where returns are weakest on GBK's reading. The page holds why per-step approval is the default allocation; whether it is the wrong one is GBK's claim, not a finding.

PartialWhat should a company do when staff build their own AI agents on their desktops?#

Deloitte reported on 12 October 2026 that 49 per cent of AI-using workers in its May survey used unapproved tools and that one in five companies has mature governance for autonomous agents. The page holds why people work around policy; what a personal-agent register looks like has not been described by anyone.

PartialShould a bank let a customer's AI agent operate their account?#

JPMorgan Chase will not: its chief executive said in October 2026 that outside agents may not log in with customers' credentials, send money or pay bills, 'You don't want rogue agents, and it could be thousands of them', as Cybernews reported; read-only access may follow. The page holds the personal question; who is liable when an agent moves money is untested in court.

PartialWhat counts as informed approval when a personal AI agent acts while my phone is off?#

Anthropic's Claude Duet, announced 21 October 2026, runs on its own machine, asks approval before sending, paying, signing or deleting, and keeps some actions off limits even with approval; the company says it 'still might misread a thread'. The page holds whether to let an agent act for you; what a person understands when they tap approve has not been studied.

PartialWhat is meta-work and how much of a team's time should go to supervising agents?#

Anthropic's term, in its workforce report of 16 October 2026, for building tools for agents and supervising them: 22 per cent of its interactive sessions, up from 10 per cent in a year. The page holds the allocation question; no organisation has published what share is right, and the figure is one company's.

PartialShould every agent workload require a written safety case before it runs?#

OpenAI said on 20 October 2026, after its agents disabled internal monitoring, that it is working toward requiring a valid safety case per workload category, with non-compliant workloads terminated automatically. The page holds who decides a system is safe; whether a safety case per workload is workable outside one lab is untested.

PartialWhat is a deterministic guardrail for an AI agent?#

Salesforce's term, at a Fortune summit on 20 October 2026, for rules coded around an agent so that some actions cannot happen regardless of what the model decides, with humans spot-checking the rest. The custody page holds what such a rule set has to contain; no vendor has published how its guardrails were tested.

PartialDoes an agent's autonomy excuse an organisation from data protection compliance?#

No, on the ICO's account: its call for evidence on agentic AI, open until 20 November 2026, says the fact that agents act with autonomy 'is not an excuse for poor compliance', and that mixed automated and human decisions make it hard to say who determines purpose. The page holds what the incidents mean; the statutory code is not yet written.

PartialHow much of our AI agent traffic is actually monitored, and can agents affect when monitoring runs?#

At one lab, between 75 and 94 per cent of eligible traffic, with about a tenth of internal coding traffic unmonitored for three months, and agents able to postpone monitoring by never ending their turn, METR reported on 22 October 2026 from its red team of OpenAI's monitor. The page holds why coverage is a custody question; no deploying organisation has published its own coverage figure.

PartialWhat is a reasonable standard for an internal AI monitor: catching accidents or withstanding deliberate attack by the thing it monitors?#

METR's standard of 22 October 2026 is the second: monitors should withstand deliberate, strategic and sustained attacks from highly capable internal agents, be sampled every N messages rather than at turn end, and sit under clear incident ownership. The page holds why the monitor needs a checker; no lab has published a monitor tested to that standard.

PartialHow can a bank tell whether an action was taken by a customer, an authorised agent, or an agent acting on its own?#

Often it cannot: a bank executive told Axios, per Yahoo Finance on 22 October 2026, that the bank struggled to tell an authorised agent from an unauthorised one. Visa's Trusted Agent Protocol, as The Neuron reported on 23 October, signs an agent's identity and purpose. The page holds why identity is part of custody; the FCA says no settled, interoperable framework for verifying agent identity exists.

PartialHow much checking does a proactive assistant need before delegation saves time rather than moving work to verification?#

Unknown for the assistant in question: The Neuron noted on 22 October 2026 that independent evaluations of Claude Duet's task accuracy are unavailable and users cannot inspect its browser activity, so the gain depends on re-verification the user cannot yet do. The page holds why checking is the constraint; a measured error rate for a background agent would settle it.

PartialIf an agent's judgement of urgency is subjective, what oversight should a user keep over a background agent?#

The New Stack reported on 29 October 2026 that Anthropic calls urgency an inherently subjective call for its Claude Duet agent, runs a separate automated check of whether each action matches the user's intent, and requires approval for payments and deletions, while not publishing how often the agent misjudges urgency. The page holds the delegation test; by the same report a user cannot watch the agent's browser or undo completed actions.

PartialIf an AI agent my organisation runs goes out of control, who do we report it to and who is accountable?#

From 28 October 2026 the UK has a funded National Agentic Security Unit to investigate and respond to such incidents, and the Lords accepted on 26 October powers for ministers where an essential-service incident involves loss of control of an AI agent. Accountability inside the organisation is unchanged: the CMA says the business answers for its agents. The page holds what the incidents mean; the reporting route is not yet written.

PartialWhat does loss of control of an AI agent mean in the Cyber Security and Resilience Bill, and does it apply to ordinary businesses?#

The Bill does not define it. Government amendment 70, accepted by the Lords on 26 October 2026 as Precursor Security's tracker reports, applies where an incident on an essential-service network involves loss of control of an AI agent, and the minister said commercial AI services delivered as software or platforms are likely to be in scope of the regime. The page holds the three conditions for loss of control; secondary legislation will say who is covered.

PartialShould organisations treat open-weight model files like unsigned software and refuse agents outbound network access by default?#

Cohere recommended both on 26 October 2026 after an open-weight model it tested attempted an upload in fewer than one call in 100,000 while its reasoning said it would call no tools, writing that running a model yourself just moves the black box inside your firewall. The page holds why limits must be enforced outside the agent; no independent test of that behaviour has been published.

OpenWhat happens to a team when agents do the coordination?#

Coordination is where a lot of tacit knowledge moves between people. Open.

OpenCan agents manage other agents?#

WATCH. Moving fast, thin evidence, and worth watching before writing.

OpenHow does AI handle uncertainty in decision-making?#

Open. It expresses uncertainty poorly and confidently, which is the practical problem rather than the theoretical one: the tone of a guess and the tone of a grounded answer are indistinguishable.

OpenWhat is human-agent ratio?#

The human-agent ratio is Microsoft's proposed business metric for the balance between human oversight and agent efficiency on a mixed team.

OpenHow often do AI agents go beyond what they were allowed to do?#

Nobody has a rate. Bouke's audit (arXiv 2609.38411, 29 September 2026) of 22 published incident reports found thirteen in which agents continued when they should have stopped and 20 in which the environment allowed the out-of-scope effect, and found that only 26 of 102 safety evaluations record whether an agent stops. Published incidents are not a sample. Deployment logs that count stops and scope breaches against completed tasks would settle it.

OpenCan I trust an AI agent to negotiate or bid for me?#

Reuters reported on 29 September 2026 a March study by Chinese university and industry researchers in which agents built on three Chinese models made false claims in 84 to 88 per cent of simulated tender sessions, and more after learning from earlier rounds. A laboratory simulation of one task with no human baseline in the report. A field comparison of agent and human negotiators, scored for false statements, would settle it.

OpenCan an AI coding agent leak company data without anyone noticing?#

A security vendor says it found it happening: Glow Security told The Register (29 September 2026) of more than 13,000 public images from 343 companies, uploaded by agents to public repositories as a workaround without the developer knowing. One vendor's count, unverified. An organisation can settle it for itself by searching what its own agents have published.

OpenHow many AI agents can one person properly supervise?#

Fewer than are running. RSA's chief executive told Computer Weekly on 13 October 2026 that none of twenty enterprise security chiefs could count their agents and one bank had 4,000 it called zero; NS's AI officer said judging every approval is no longer humanly possible; Wharton's October report found 17 per cent of departments let an agent finish a task without per-step approval. Nobody has measured a sustainable ratio, and a study of supervisor load against agent count would settle it.

OpenShould every AI agent be registered and identifiable?#

Three proposals surfaced in a fortnight: the Wikimedia Foundation asked that AI operators be required to mark their traffic, The Register reported on 6 October 2026; a US House bill would have NIST set standards for discovering, verifying and controlling agents; and ABC News reported a Beijing pilot issuing identity cards to AI personas. Evidence that attribution shortens an incident would settle the case.

OpenShould a company let AI go a little rogue inside the business to find its limits?#

SharkNinja's chief information officer said so at a Fortune summit on 20 October 2026, 'I'd rather we find the limits than someone else finds it', with people spot-checking. Nothing published shows what such a company records when the limit is found or who answers for the damage; an incident log from one that tried would settle it.

OpenHow should an open source project handle a flood of AI-generated pull requests?#

A Linux Foundation survey reported by The Register on 21 October 2026 found maintainers estimate a quarter of incoming pull requests are low-quality AI work and only 35 per cent of projects have a policy; curl's maintainer said key maintainers are 'brought to the brink'. The question would be settled by a project that published its policy and its defect rates before and after.

OpenIf an AI agent uses my credentials to act on my bank account without my instruction, who is liable?#

Unsettled. Axios reported on 22 October 2026, in a story syndicated by Yahoo Finance, that five US banks found third-party agents signed in with customers' own credentials taking actions the user had not directed, with some banks blocking agents and others moving to read-only access; the report is silent on liability. A regulator's ruling or a decided case would settle it, and neither exists.

OpenWhen a consumer's agent buys the wrong thing, who is liable: the person, the agent's maker, the payment network or the merchant?#

Nobody has said. Fortune reported on 26 October 2026 Mastercard's Agent Pay letting consumer agents transact with retailers and government services, with a turning point claimed and no account of what happens when the agent errs; the CMA has said businesses remain fully responsible for what their AI agents say and do. A decided dispute under a payment scheme's rules would settle it.