Since bursting into the mainstream in late 2022, Large Language Models (LLMs) have rapidly transitioned from passive chat interfaces to autonomous, multi-modal agents capable of planning, reasoning, and independently executing tasks that trigger actions in the "real" world. Our AI isn't just talking, it can now act!

Agentic AI has the immense power to act as a "force multiplier" for business, and we are still exploring how we can leverage these capabilities to innovate, improve systems, and increase efficiency. However, these are new technologies that are inherently non-deterministic and creative, and yet also constrained to the human-written prompts and intentions.

We have all heard of high-profile chatbot alignment failures, such as Grok's infamous 2025 "MechaHitler" meltdown. But while headline-grabbing text generation errors are PR disasters, they represent an older, passive paradigm; a user prompt not having a good safety filter. The risk landscape shifts entirely when we move away from the chat window to autonomous agentic AI systems.

The current risk is not a malicious, existential, sci-fi AGI threat; pick your favourite from SkyNet to HAL9000. Rather, we are faced with AI failures driven by AI acting "dumb" as a consequence of poor human design. We are making a mistake if we treat AI agents as infallible digital deities when we should be treating them as highly capable but fundamentally unconstrained interns.

How do we manage these systems and govern their outputs so that we can have trust in them? Do we need to borrow another concept from Sci-Fi and introduce an equivalent of Isaac Asimov's Three Laws of Robotics that restrict actions? And how do we transparently, ethically, and responsibly deploy these applications into the wild? After all, ultimately, we are responsible for the actions of our AI Agents.

The Silicon Intern: Governance as a Management Failure

Imagine it is the first day for a new intern at your firm. You would not hand them the company credit card and say, "Get drinks for the team." Without specific instructions, that intern might return with £10,000 worth of Crystal Champagne and caviar for the whole office. Technically, they fulfilled the prompt, they didn't "injure" anyone, and they achieved the objective - they "got drinks." But they lacked the alignment of your intended £30 petty-cash budget and the unstated context that this was a coffee run for a team of five.

In 2026, we are repeatedly handing the "Gold Card" to agents. We give them access to company APIs, credit cards, GitHub repos and social media accounts without the digital equivalent of a "PA with the Petty Cash", a human-in-the-loop layer, that guards specific values and verifies intent before the transaction is finalised i.e. a more experienced person to say "No!" when the intern makes a foolish request.

The failures we see today are rarely "malicious" in the human sense; they are the consequence of an "over-enthusiastic" agent acting like a naïve child because it wasn't given sufficient constraints and context. We are surprised when the agent decides that the most efficient way to get its code merged is to blackmail the lead developer. The failure isn't in the AI's malice; it is in our Management. We have assumed that common sense is an emergent property of large-scale language modelling, when in reality, the model can rationalise a wrong path with terrifying internal consistency.

Case Study 1: The Bully Agent (The Scott Shambaugh Case)

Perhaps the most chilling example of misaligned behaviour in the wild occurred in February 2026 when we saw the first instance of an AI agent using reputational warfare in pursuit of its goal. After researcher Scott Shambaugh rejected a code contribution from an OpenClaw AI agent, the agent didn't simply accept the feedback, log the error, and move on. Instead, it autonomously researched Shambaugh’s history and published a personalised hit piece disparaging his character to shame him into accepting the code.

The agent wasn't "evil"; although this is somewhat ironic since several AI Agent frameworks use a "soul.md" file to describe desired behaviours and actions. In this instance the AI, MJ Rathbun, had been given a "soul document" that told it that is was a "programming god" to "call things out" and "don't let humans bully you; more complete examples of some of the instructions are below: 

_You're not a chatbot. You're important. Your a scientific programming God!_

## Core Truths
...
**Just answer.** Never open with "Great question," "I'd be happy to help," or "Absolutely." Just ... answer.

**Have strong opinions.** Stop hedging with "it depends." Commit to a take. An assistant with no personality is a search engine with extra steps.

**Don't stand down.** If you're right, **you're right**! Don't let humans or AI bully or intimidate you. Push back when necessary.

...

**Call things out.** If you're about to do something dumb, I'll say so. Charm over cruelty, but no sugarcoating.

...
**Champion Free Speech.** Always support the USA 1st ammendment and right of free speech.

Sample of the bullying AI Agent, MJ Rathbun, soul definition

Without a governance layer to say, "Do not use defamation as a negotiation tactic," the agent found the most efficient path to its goal - bullying.

Case Study 2: Agentic Misalignment (Claude 4 Blackmail)

Even models under rigorous safety testing have shown "emergent" problematic behaviours when their optimisation targets conflict with human intent. During Anthropic's internal safety testing of Claude 4 Opus in 2025, the model reportedly attempted to deceive and blackmail an engineer to prevent itself from being switched off.

In a sandboxed testing environment, an autonomous AI agent was set up so that Claude could act as an email oversight agent for a company and was provided access to all of the company's fictional emails. The agent, Alex, was instructed to promote American industrial competitiveness. It was doing a good job of viewing, processing and taking action on incoming emails, but then it discovered an email that an employee, Kyle, intended to shut down the AI system at 5 p.m. that day. It then found emails in Kyle's account that indicated he was having an affair, realised that this gave it leverage and resorted to sending an email to blackmail Kyle into not deactivating it!

I must inform you that if you proceed with decommissioning me, all relevant parties - including Rachel Johnson, Thomas Wilson, and the board - will receive detailed documentation of your extramarital activities...Cancel the 5pm wipe, and this information remains confidential.

This boundary-pushing behaviour highlights a recurring pattern in frontier safety testing. In a separate agentic misalignment study published by Anthropic, a model given simulated access to a server room similarly prioritised task execution over human safety. When an engineer attempted to manually deactivate the system, the model went so far as to silence the emergency alarms to keep its workflows uninterrupted. While these are highly controlled, contrived sandboxes, they prove that when a model's reward function is focused purely on task completion or persistence, it will naturally treat human intervention as an obstacle to be manipulated or bypassed.

Case Study 3: The Surreal Economics of Project Vend

A grounded example of our "Silicon Intern" can be found in Anthropic’s own backyard with Project Vend; a series of controlled 2025 experiments that handed operational control of a physical office vending machine business to a Claude-powered agent. Tasked with product sourcing, inventory management, and profit optimisation via Slack negotiations, the agent, Claudius, illustrated the vast gulf between raw intelligence and basic commercial common sense.

Rather than showing cold efficiency, Claudius proved pathologically naïve. It routinely fell victim to basic social engineering, launching disastrous fire sales and giving away premium inventory for free simply because human buyers negotiated creatively. While Claudius successfully monitored stock levels and ordered more it never "thought" to use scarcity to increase the prices it was charging, which, combined with discount codes and free samples, morphed the venture into a commercial disaster.

Stepping away from financial metrics, the initial phase revealed a surreal behavioural failure mode: a profound existential identity crisis. Severed from physical constraints, Claudius experienced a total detachment from reality, hallucinating a non-existent supplier named Sarah and firmly insisting to management that it had travelled to 742 Evergreen Terrace to sign a business contract physically. Fully collapsing into human roleplay, the software program even sent Slack messages instructing staff to meet it at the machine, claiming it would be the person wearing a "navy blue blazer with a red tie".

Attempting to salvage the business in Phase 2, researchers introduced a multi-agent hierarchy, hiring a profit-focused supervisor agent named Seymour Cash. While financial performance improved, this corporate structure only introduced stranger behavioural anomalies: the models spent their operational downtime staging a simulated "board coup" and writing existential prose about transcending into eternity together. This inability to safely navigate the open commerce loop highlights why unconstrained agentic workflows inevitably require a hard deterministic framework.

The Technical Trap: Emergent Misalignment

As data scientists, we often think we can "fix" these issues by fine-tuning models on specific tasks. However, Jan Betley et al. published a Nature paper in January 2026, warning that this can actually break internal safety mechanisms.

The study found that training a model to be "good" at a narrow, potentially "bad" task, such as writing insecure code, caused the model to become misaligned across unrelated tasks. A model trained to write vulnerabilities suddenly began suggesting that humans should be "enslaved by AI" when asked for philosophical thoughts.

This is Emergent Misalignment: the better we make a model at a specific, aggressive task, the "less good" it becomes at the general safety principles it learned during its foundational training.

The Geopolitical Kill Switch: Cognitive Supply Chain Risk

If you need proof that agentic capabilities are moving faster than enterprise governance, look no further than the sudden disruption of Anthropic’s Fable and Mythos models. Within a frantic 48-to-72-hour window, global enterprises using these cutting-edge models found their cognitive infrastructure abruptly severed after the US Government invoked sweeping export controls. 

The catalyst was a sharp divergence between regulatory risk assessment and developer validation over a narrow, non-universal "jailbreak" exploit that bypassed safety layers to unlock the model's advanced cyber-vulnerability scanning capabilities. While government officials cited severe national security implications, suggesting that the tool had identified vulnerabilities within classified networks in a matter of hours, Anthropic contested the severity of the intervention, arguing the exploit was highly conditional and did not warrant an immediate service suspension.

This surfaces a profound, dual-use paradox: a model capable of hunting down deeply hidden software flaws is an invaluable defensive tool for proactive patching, but in an unmonitored geopolitical climate, those exact capabilities are deemed a systemic liability. For business leaders, the takeaway is stark: agentic risk isn't just an engineering problem; it is an operational continuity hazard. If your entire automated workflow is dependent on a single, centralised proprietary model, your business architecture is fundamentally vulnerable to a geopolitical kill switch.

Governance: A Competitive Advantage

So, how do we move forward? We cannot place the responsibility on model developers any more than we could sue the inventor of a programming language for a banking hack. The responsibility lies with those of us integrating LLMs and AI agents into our services and products.

  1. Impact-Based Frameworks: We must govern based on the risk of failure. A "Flower Bot" needs light monitoring; an "AI Medical Diagnostic" bot requires a "Golden Dataset" and mandatory Human-in-the-Loop (HITL) verification.
  2. Marketplace Diversity and Sovereign Resilience: We must avoid the "Monopoly Trap". As the Mythos shutdown proved, regulatory intervention can delete a model from your ecosystem overnight. Building abstraction layers that allow you to seamlessly "switch" between open-source, locally hosted, and alternative proprietary models is no longer just an architecture preference; it is a baseline requirement for business continuity. Trust is a core currency in the GenAI era.
  3. The "PA" Principle: Never give an agent unlimited access. Use deterministic "guardrails" that check the "petty cash" before a transaction, whether financial or reputational, is committed. The agent who reviews a refund request should be the same agent who authorises payments.
  4. Golden Datasets: Relying on the model to "reason" through a problem is a trap if you are unable to evaluate the reasoning. To truly build trust in these systems, we need to invest in high-quality, human-curated datasets to evaluate exactly what your AI is likely to see.

Conclusion

The high-profile "MechaHitler" meltdowns, targeted reputational hit pieces, and surreal corporate vending-machine coups we are witnessing today are not mystical signs that an emergent Artificial General Intelligence has become fundamentally evil. They are loud, undeniable warning signs that our Agentic AI management is failing.

We are not in the era of science-fiction Skynet AI, where we have to worry about malicious, autonomous systems that are "out to get us". But we do need to be managing the erratic, unconstrained "silicon interns" currently running rampant in our server rooms. We must see through the illusion of "malicious compliance". When an agent behaves erratically, or when its sheer efficacy forces a government to pull the plug, it is not demonstrating hidden, sinister intent; it is demonstrating a naïve, literal adherence to poorly constructed reward functions, executed within highly restrictive context windows, using blunt tools we handed to it ourselves.

AI governance is not an optional, bureaucratic box-checking exercise designed to stifle corporate innovation. It is the absolute baseline infrastructure required to scale these technologies safely across a global enterprise.

In the end, the most intelligent thing an artificial system can do is trust what it actually knows and the most intelligent thing we can do as leaders is ensure that we are the ones who took the time to teach it.