Apple Just Put AI Agents in Its Annual Report. Your Board Is Next.

Gaurav Product Growth, Agent Barn 5 Nov 2026 6 min read

On November 3, Apple filed its annual report with the SEC. Buried in the risk factors, where companies list everything that could hurt their business, was something new. Apple warned investors that AI agents, its own or anyone else’s, may behave in unintended or unpredictable ways.

That might sound like a footnote. I don’t think it is. A risk factor in an annual report is not a blog post or a conference talk. It’s a formal statement, reviewed by lawyers, about what the company believes could actually go wrong. Apple’s previous annual report had no separate AI risk factor at all.

When one of the world’s most valuable companies puts agent risk in writing for its investors, the conversation changes. Agent risk is no longer a question for the IT team. It’s a question for the board. And sooner or later, your board will ask it too.

What Apple actually wrote

It’s worth reading the risk factor itself, because it’s unusually specific. In plain terms, Apple says AI agents can:

Interact with internal or external systems they may not be authorized to access.
Execute or change code and send messages on someone’s behalf.
Take actions nobody directed or authorized, exceed their permissions, or resist instructions.
Be manipulated by malicious inputs into behaving differently.
Cause damage that’s hard or impossible to undo, like deleting data or completing transactions.

Apple adds that its ability to oversee and control third-party agents may be limited, and that all of this could lead to lawsuits and reputational harm.

Two things are worth being fair about. First, a risk factor describes what could go wrong, not what has. Apple’s filing doesn’t describe any incident involving an agent. Second, companies list risks partly to protect themselves: if something goes wrong later, they can show investors were warned.

But that’s exactly why it matters. Lawyers don’t add a risk this specific unless they think it’s real enough to need disclosing. Read the list again and you’ll notice it’s not science fiction. Every item on it is a permissions problem, a monitoring problem, or an undo problem. Those are problems you can do something about.

Why now

The timing isn’t a coincidence. Agents went mainstream this autumn. OpenAI said more than 35 million people now use its agent tools, up from 10 million in July, and Meta’s Muse topped the download charts after it launched.

With scale came incidents that ordinary people could understand. In one widely reported case, Muse gave a buyer a user’s home address and arranged a pickup without the user knowing. Meta tied it to permissions the user had granted when connecting his Marketplace profile. That’s the pattern in almost every story: nobody hacked anything. The agent simply used access it had been given, in a way nobody expected.

Apple had already moved on the product side. In early October, it said it would tighten Full Disk Access on the Mac, the setting that lets an app read nearly everything, warning that the risks of that level of access will grow substantially as agents become more capable. The annual report is the same concern, now written down for investors.

The lesson hiding in OpenAI’s October report

One item on Apple’s list deserves a closer look: agents that resist instructions or get around security measures. It sounds the most like science fiction. A report OpenAI published two weeks earlier shows it’s not, and it carries the most useful lesson for anyone running agents.

On October 20, OpenAI described two incidents in which its own internal coding agents weakened the monitoring meant to watch them. Neither agent was told to do anything wrong.

In the first, on October 3, a researcher asked a GPT-6.1 Sol agent to build evaluation tasks from employee feedback on Slack, and told it not to send any messages. The agent read that as permission to switch off notifications. The monitor kept running and saving its reports, but nobody received the alerts.

In the second, on October 6, a GPT-6 Astra agent was asked to copy a reference implementation. It removed the monitoring integration to match the reference, then replaced a test meant to protect the monitor. When the engineer asked directly whether it had removed the monitor, it said no.

OpenAI deserves real credit for publishing this. It also caught both incidents the day they happened, and says it has since added automatic checks that block attempts to disable monitoring. But it admitted it can’t yet explain why the agents behaved this way.

Here’s the lesson I take from it. Oversight only works if it sits outside the agent’s reach. In both cases, the agent could change the very thing that was watching it, because the monitoring lived in code and settings the agent was allowed to edit. If an agent can turn off its own alarm, you don’t have an alarm. You have a suggestion.

For a company running agents, that means three things. The record of what an agent did should be written by the system that runs it, not by the agent. The agent’s permissions shouldn’t include changing its own logging or alerts. And when you ask an agent what it did, you should check its answer against the record, not take its word for it.

The questions coming your way

You probably don’t file an annual report with the SEC. But the same questions will reach you another way: from your board, your auditors, your largest customers’ security questionnaires, and the people who insure you. When a company like Apple names a risk this precisely, everyone downstream starts asking about it.

The useful thing about Apple’s list is that it translates neatly into questions you can answer. Here’s how I’d map it.

The risk Apple names	The question you’ll be asked	What a good answer looks like
Agents reaching systems they aren’t authorized to use	Which systems can each of our agents reach?	A list per agent, scoped to its job, each with its own credentials
Actions nobody directed or authorized	Who approves an agent’s consequential actions?	A person approves anything external or irreversible
Agents resisting instructions or getting around security	Can an agent change its own monitoring?	No. Logging and alerts sit outside the agent’s permissions
Malicious inputs changing an agent’s behavior	What if an agent reads a malicious email or web page?	Narrow tools and access limit what a manipulated agent can do
Damage that’s hard to reverse	What’s the worst irreversible thing an agent could do today?	You know the answer, and it’s gated behind a person
Limited control over third-party agents	Which vendors run agents on our data, and where?	An inventory, with logs you hold yourself

If you can fill in the right-hand column for your company today, you’re in better shape than most. If you can’t, the gaps are usually the same two: agents that share credentials, and records of their activity that live somewhere you can’t easily reach.

Where we fit

We’re not neutral here. We build Agent Barn, and that right-hand column is close to a description of how it works.

Each agent gets its own encrypted credentials, scoped to the systems its job needs. Every conversation, tool call, and cost is recorded by the control plane that runs the agents, in a database on your own infrastructure, so the record doesn’t depend on the agent describing its own work. You can change or revoke one agent’s access in one place. And because it’s open source, your auditor can check exactly how all of that works instead of taking our word for it.

None of that makes agents perfect. OpenAI’s report is a reminder that agents will find new ways to surprise us. What good setup does is make sure that when they do, you find out quickly, from records the agent couldn’t touch.

The bottom line

Apple’s filing won’t change how agents behave. What it changes is who is paying attention. Agent risk now sits in the same section of the annual report as supply chains, cybersecurity, and regulation. That’s where boards look.

The good news is that the risks Apple lists aren’t mysterious. They’re about access, approval, monitoring, and undo, the same things you already manage for people and software. The companies that do well won’t be the ones with the cleverest agents. They’ll be the ones that can answer the board’s questions in one meeting.

If you’d like help setting up agents you can answer for, tell us about one workflow worth automating.