When the system acts

Removing the Safety Net

Everything we've looked at so far has assumed the same safety net: the AI produces something, and a person decides what to do with it. This lesson removes that assumption. Think of the difference between an assistant who drafts a letter for your signature and one with the authority to sign on your behalf. The first is an advisory system. If the assistant makes a mistake in the draft, you catch it when you read it. The mistake stays inside the building. The second is an agent. It's far more useful, but its mistakes are far more expensive. By the time you hear about an error, the letter's already been sent, the money's moved, or the record's changed.

Advising versus Acting

To understand this risk, we first need to define the tool. An agent is an AI system that takes actions rather than only producing output. When a system moves from advising to acting, the failure isn't a 'wrong answer' anymore. It's a completed transaction that you now have to unwind. A human assistant usually makes one mistake at a time and notices. An AI agent can chain a hundred actions in a minute, with each one appearing reasonable based on the last.

Chaining and Machine Speed

The risk profile changes in three specific ways. First, chaining. This is when an agent takes the result of its last action as the input for its next one. If there's an error in step one, it propagates, building a whole tower of actions on a faulty foundation. Second, speed. Actions happen at machine speed. These systems can complete a full sequence of transactions faster than any human review cycle can even begin. Finally, the missing checkpoint. Agents remove the natural pause where a person looks at the work.

Takeaways: Agentic Basics

Let's recap the core shift. An agent moves from drafting suggestions to executing actions. This removes the safety net we've relied on, making errors harder to catch and more expensive to fix.

The Anthropic Incident (2025)

In November 2025, the AI company Anthropic disclosed the first reported large-scale cyber espionage campaign orchestrated primarily by AI. A state-linked group manipulated an AI coding tool to carry out intrusions against roughly thirty organizations across finance, tech, and government. The AI performed the large majority of the tactical work autonomously. The human operators were only involved at a handful of decision points per campaign. For an insurer, the takeaway isn't just the espionage—it's the ratio. A few human clicks triggered a massive volume of autonomous actions that happened without further permission.

The Autonomy Amplifier

Autonomy doesn't actually create new types of AI failure. Instead, it sharpens every failure we've already discussed—like fabrication or bias—by removing the person who would have caught them. Don't assume a 'Human in the Loop' is enough. If the system acts at sub-second speeds, a human can't actually 'loop' in. They're just watching a disaster happen in real-time. Finally, remember that accountability here is genuinely unsettled. Who is responsible when the agent acts wrongly is a question the market is still answering.

Takeaways: Autonomy & Exposure

To wrap up, remember that autonomy removes the pause where a human would have caught a failure. When assessing these systems, look for the authority they have to act without intervention.

Assessing Agentic Authority

You're reviewing three different AI implementations. Based on our 'instinct' question, click on the system that represents the highest agentic risk. Not quite. This system only drafts internal reports. A human must sign off before anything leaves the building. The risk is contained. This is a mid-level risk. It can send emails, but only to a pre-approved list of internal staff. Its authority is limited. Correct! This system has the authority to issue refunds and update customer bank details autonomously. Its ability to 'do without asking' makes it the highest risk profile.

The Next Step

How you put brakes on an agent is the next course, and honestly the market is still working it out. What you need now is one instinct: when you meet one of these systems, ask what it can do without asking.