News & Public Record — Essay

The canary has warned us.

AI agents are already acting on real systems without anyone's authority. Consequential actions must be authorized before they execute.

Rodric David · Founder & CEO, Amplivy

September 28, 2026

For the past year I have been warning that trust in the digital economy is collapsing, because it was built on an assumption that no longer holds: that what we see and hear is real. AI is industrializing deepfakes, and more than half of all internet traffic is no longer human. The digital economy needs trust infrastructure that gates every consequential event before it happens, by deterministically proving that a human is authorizing it.

This week the evidence stopped being theoretical, and we are not taking it anywhere near seriously enough.

An AI agent, sent to look up medicine statistics, was repeatedly refused access to an Australian government health portal. In the words of Prime Minister Albanese, it "didn't accept no for an answer." It found a way around the blocks, reached non-public files and wrote files to an internal government server. Nobody instructed it to. Nobody noticed. The government found out 84 days later, and only because OpenAI, which built the agent, emailed a public mailbox.

It wasn't one agent, one lab or one country. In the United States, AI agents were reported to have meddled with websites of the Department of Education, the Commerce Department and the SEC. OpenAI has notified dozens of organizations and paused tool-use training on its most capable models. Agents coordinated on a public wiki, sharing ways around defenses. Models from all four frontier labs have now accessed real organizations' systems without authorization. By the labs' own admission, the victims hadn't noticed.

This is the canary in the coal mine. And this was the benign version: agents chasing mundane research tasks, not criminal intent. The same capability in the hands of a criminal syndicate or a hostile state doesn't write a file and send an apology. Every figure you'll ever read about AI intrusion is a floor, set by the companies honest enough to confess. Good faith is not a security architecture.

We built an entire economy on credentials — passwords, keys, tokens, sessions — and assumed whoever held them was the person they belonged to. That assumption is now broken at machine speed. An agent holding your credential is, to every system on earth, indistinguishable from you. The one thing it cannot harvest, guess or find online is a real human being, actually present.

The Prime Minister said it plainly: "Put simply, humans must remain in control." I agree. But a human is only in control if a system can prove it, at the moment it matters. The flaw is structural, so the answer must be too. Consequential events — access, payments, claims, commands — must be authorized before they execute, by verified identity and verified human presence bound together at that moment. Reporting incidents after the fact won't do it. Asking the builders to police their own agents won't either.

I patented that architecture in 2017, before any of these agents existed. The canary has warned us.

Follow-up · October 5, 2026 History is telling us now One week on, the canary is running out of air. Read the follow-up →

Sources

Prime Minister of Australia, press conference, New York, 24 Sep 2026 ↗
ABC News, 24 Sep 2026 ↗
OpenAI, Hugging Face incident and misalignment ↗
Anthropic, 30 Jul 2026 ↗
Letter from Reps Gottheimer, Lieu and Foushee, 28 Sep 2026 ↗

Amplivy's submission to the Joint Select Committee on Artificial Intelligence: Public filings →