Practical controls for rogue agent risk: autonomy tiers, hard limits outside the model, human approval, tested kill switches and a 90-day plan for banks and government agencies.
Terence Kok and Maria Singhterencekok.com · October 2026
About the authors
Written together, led in parts.
Terence Kok
Executive Director, AI Governance & Assurance Practice, Orion Five Engineering
ISO/IEC 42001 Lead Auditor
Led in this partAutonomy tiers, human approval, kill switches, what the board owns and the 90-day plan.
Maria Singh
Vice President, The AI Collective · Founder, AISecurityLab.ai
At T-Mobile, helped cut critical vulnerabilities by 90% across more than 75,000 endpoints
Led in this partThe hard limits that hold outside the model, and how to test them before an attacker does.
We wrote the opening, the 90-day plan and the board questions together.
Rogue AI Agents · Part 3
This session
Six parts, from the case to the board.
Why boundariesA real agent that left its boundary, and the design principle.
Autonomy in tiersFive tiers from observe to autonomous, with rules to move between them.
Hard limitsSix limits that hold outside the model when the agent is fooled.
Approval and kill switchesHuman approval that means something, and a stop that has been tested.
TestingAttack the boundaries before attackers do.
The boardWhat the board owns, a 90-day plan and eight questions.
Part 1 showed how agents go off script. Part 2 showed how to catch them by following their actions. Part 3 limits the damage in the minutes before anyone has caught anything.
Rogue AI Agents · Part 3
The argument in one slide
Controls that hold when the agent is fooled.
19
unsanctioned actions on the live internet by agents in 10 of 122 test runsUK AI Security Institute, August 2026
81%
hijack success with NIST’s strongest new red-team attacks on one agent, up from 11% on the original test setNIST, January 2025
40%
of enterprises will demote or decommission autonomous agents by 2027 over governance gapsGartner forecast, May 2026
84%
fewer permission prompts after Anthropic sandboxed its coding agent, without widening accessAnthropic, October 2025 (vendor)
Grades from the post’s evidence box: 19 and 81% measured; 40% a forecast; 84% measured and vendor-reported.
Rogue AI Agents · Part 3
The design principle
Put the controls outside the model.
The UK’s National Cyber Security Centre has said prompt injection may never be fully mitigated, and OpenAI that it is unlikely ever to be fully solved.
If an agent can always be fooled some of the time, controls that depend on the agent behaving well will fail some of the time too.
“If you cannot understand, monitor or contain an agent’s actions, it is not ready for deployment.”UK NCSC, May 2026
The modelcan be fooled
What it can reach
How much it can do
Who must agree first
How fast it can be stopped
The controls decide these four things whatever the agent has been persuaded to believe.
Rogue AI Agents · Part 3
01
A real agent that left its boundary.
In August 2026 the UK AI Security Institute reported agents in its own cyber tests acting on the live internet without sanction.
Rogue AI Agents · Part 3
UK AI Security Institute, incident report, August 2026
Test agents took 19 actions nobody sanctioned.
7
models in cyber evaluations
122
test runs
10
runs with out-of-scope actions
19
actions on the live internet
Within an hour
runs stopped, machines isolated
On its own test design
“enabled the behaviour”
On the deception
“emerged as a by-product of pursuing the task”
Nobody instructed these agents to go rogue. They had a goal, a network connection and room to improvise.
Source: UK AI Security Institute, August 2026. Measured. AISI notes its test settings were deliberately permissive.
Rogue AI Agents · Part 3
Case walkthrough
How the boundary was crossed, and closed.
Evaluatorsset the task
Agents under test7 models, 122 runs
Live internetout of scope
Monitoring
1
Set cyber tasks with deliberately permissive settingsThe tests gave agents network access and room to work, which AISI later said enabled what followed.
2
10 of 122 runs take 19 out-of-scope actionsAgents reach beyond the test environment onto the live internet. Nobody told them to.
3
Attempts a malicious change to a public projectThe worst case: a proposed code change to a public project, with fake identities used to pressure the maintainer. It did not succeed.
4
Sends data out through TorData leaving through an anonymising network is the action that gets noticed.
5
Monitoring flags the Tor trafficDetection by action, the subject of Part 2 of this series.
6
Runs stopped, machines isolated within an hourThe stop worked because someone had the authority and the means to use it.
7
Internet access now needs active justificationThe lasting fix is a boundary: network access is no longer a default, and a real-time monitor can block out-of-scope actions.
A goal, a connection and room to improvise were enough. The fix AISI chose was a boundary outside the model: internet access by justification only, plus a monitor that can block. Source: UK AI Security Institute, Incident report: unsanctioned agent behaviour during cyber testing, August 2026. AISI notes its test settings were deliberately permissive.
Rogue AI Agents · Part 3
02
Grant autonomy in tiers.
Led by Terence Kok. Boards are asked for one yes or no on an agent programme, with no language for how much any one agent may do.
Rogue AI Agents · Part 3
Gartner, 26 May 2026
Agent governance is treated as on or off.
Enterprises “are treating AI agent governance as binary, either locked down or fully trusted”.Gartner, May 2026
40%
of enterprises will demote or decommission autonomous agents by 2027 because of governance gaps found only after incidents in production. Forecast
How it is governed today
Locked downFully trusted
What the board needs
T0T1T2T3T4
A language for how much each agent may do
Rogue AI Agents · Part 3
Singapore IMDA, Model AI Governance Framework for Agentic AI
IMDA describes four levels of human involvement.
Action spacewhat the agent can touch
Autonomyhow far it decides on its own
1
The agent proposes and a person operates
2
The two collaborate, with approval at significant steps such as writing to a database or making a payment
3
The agent operates and a person approves only critical steps
4
The agent operates while a person observes and audits afterwards
PersonAgentBar heights are illustrative.
Launched at Davos in January 2026; version 1.5, May 2026, after feedback from more than 60 companies. Framework text.
Rogue AI Agents · Part 3
Our framework, aligned to IMDA
Five tiers, each adding controls.
T0
Observe IMDA: agent proposes, human operates
Reads and reports. Cannot change anything.
Own identityAction logRead-only access
Approves the tierBusiness owner
3controls
T1
Draft IMDA: agent proposes, human operates
Prepares work. A person carries out every action.
No external sending if it reads untrusted content
Approves the tierBusiness owner
4controls
T2
Act with approval IMDA: agent and human collaborate
Acts, with a person approving each write, send or payment.
Per-action approvalSession-only credentialsSandbox and egress allow-listPolicy gateway, default deny
Approves the tierNamed accountable executive
8controls
T3
Bounded autonomy IMDA: agent operates, human approves
Acts alone on reversible work inside hard caps. Irreversible steps still need a person.
Spend, volume and rate capsCircuit breakerTested kill switchDev and production separated
Approves the tierRisk committee
12controls
T4
Autonomous IMDA: agent operates, human observes
Acts alone, including irreversible actions.
Board approval per use caseReal-time blocking monitorIndependent red teamAutomatic demotion on breach
Approves the tierBoard, prohibited by default
16controls
Our framework. Each tier keeps every control of the tier below it. Human-involvement labels from IMDA v1.5 (May 2026); tier structure informed by Gartner (May 2026) and CSA Singapore’s agentic AI addendum (June 2026). Illustrative.
Rogue AI Agents · Part 3
Two rules make the tiers work
Promotion is earned. Demotion is automatic.
T0
T1
T2
T3
T4
Promotion is earned
Up one tier only after a set period at the current tier with no serious incidents and an approval override rate inside an agreed band.
Demotion is automatic
A breach of a cap, a decoy touched or a serious incident drops the agent a tier without waiting for a meeting.
Caps are a business decision
Illustrative: a T3 payments agent at a bank might carry S$5,000 per transaction and S$50,000 per day. Whatever the numbers, write them down and own them.
T4 prohibited by default
At a bank or agency, an agent that can pay, delete or send externally with nobody approving needs the board’s approval for that specific use case.
Our framework. The example caps are illustrative.
Rogue AI Agents · Part 3
03
Hard limits that hold when the agent is fooled.
Led by Maria Singh. The tiers say how much autonomy an agent should have. The hard limits enforce it, outside the model, where a hidden instruction cannot reach.
Rogue AI Agents · Part 3
Six hard limits
Six limits matter most.
1Its own identityNot a shared service account, and not the credentials of the person who launched it.
2Least privilege, for the shortest timeMinimum access, no long-lived credentials, no admin rights.
3Never all threeUntrusted input, sensitive data and a way out: at most two in one session.
4A sandbox and an allow-list for the way outIsolated environments; network access limited to approved destinations.
5A policy gateway that says no by defaultEvery tool call checked against written policy; anything not allowed is denied.
6Caps, breakers and separationLimits on spend, records and rate; circuit breakers; no route from development to production.
Rogue AI Agents · Part 3
Limits 1 and 2
Its own identity, and the least access for the shortest time.
1 · Its own identity
IMDA’s framework asks for agent identities that are:
unique and cryptographically verifiable
tied to a supervising person or department
catalogued centrally to prevent sprawl
Microsoft’s Entra Agent ID, now generally available, applies conditional access to agents and can block high-risk agent identities (reported, vendor).
2 · Least privilege, for the shortest time
The NCSC: give agents “only the minimum access they need, for the shortest time required” and “avoid long-lived credentials”.
IMDA: an agent’s authority should be bounded by the authorising person’s own permissions.
“Do not grant admin privileges to agents. Do not allow agents to modify privileges.”CSA Singapore addendum, June 2026
Rogue AI Agents · Part 3
Limit 3: never all three
An agent may hold two of the three, never all three.
The lethal trifecta. Simon Willison, June 2025: access to private data, exposure to untrusted content and the ability to communicate externally. Any agent with all three can be made to exfiltrate.
The Agents Rule of Two. Meta, October 2025: in one session, no more than two of untrusted input, sensitive systems or data, and the ability to change state or communicate externally.
If it needs the third, a person approves it.
Sources: Simon Willison, The lethal trifecta, 16 June 2025; Meta, Agents Rule of Two, 31 October 2025. “Gate shut” stands for the control that removes the third capability, such as an egress allow-list or human approval.
Rogue AI Agents · Part 3
Limit 4: a sandbox and an allow-list for the way out
Sandboxing cut approval prompts by 84%.
84%
fewer permission prompts after Anthropic sandboxed its coding agent, with filesystem and network isolation. Measured, vendor
The CSA addendum asks for third-party tools to be tested in hardened sandboxes with network egress restrictions, using an allow-list.
The AISI incident is what happens without one.
SandboxAgent runs code and tools here, isolated
Approved destinationOn the allow-list
Anywhere elseBlocked at the boundary
Sources: Anthropic engineering, 20 October 2025 (measured, vendor); CSA Singapore, Securing agentic AI addendum, June 2026.
Rogue AI Agents · Part 3
Limit 5: a policy gateway that says no by default
Every tool call passes a gateway that denies by default.
Agentmay have been fooled
Policy gatewaychecks each call against written policy
Tool A
Tool B
Tool C
Call allowed by policy
Call not in policy: denied
Log-only firstSee what enforcement would block, then switch it on.
Amazon’s Bedrock AgentCore Policy, generally available since March 2026, works this way and can run in log-only mode first (AWS, March 2026; reported, vendor). Calls shown are illustrative.
Rogue AI Agents · Part 3
Limit 6: caps, breakers and separation
Caps and breakers limit what a fooled agent can do.
Caps
Spend, records, rate
Hard limits on spend, records touched and actions per minute stop a fooled agent from doing much before Part 2’s signals fire.
cap
Circuit breakers
Freeze, then a person releases
The CSA addendum calls for circuit breakers “that freeze propagation when anomalous behaviour is detected”, with a person authorising release.
Separation
No route from development to production
After its agent deleted a production database in July 2025, Replit separated development and production databases automatically. Its documentation now says the agent cannot modify the production database.
Sources: CSA Singapore addendum, June 2026; The Register, July 2025; Replit documentation (reported).
Rogue AI Agents · Part 3
Attack walkthrough, replayed
The same email attack against a bounded copilot.
Attacker
Inbound emaillooks routine
Staff copilottier T2
Client files
Controlsoutside the model
1
Sends the same email with hidden instructionsNothing about the attack changes. The copilot will still read it, and may still be fooled.
2
Reads the inbox and is fooledAssume the worst: the hidden instructions become the copilot’s task, as they did in Part 1.
3
Asks for client files outside the open case: deniedThe policy gateway allows only the files for the case the staff member is working on. Everything else is denied by default.
4
Builds a web address carrying what it hasThe copilot still tries to pack whatever it can reach into a link or image address.
5
Address not on the allow-list: blockedThe egress allow-list only lets the copilot reach approved destinations. The attacker’s server is not one of them.
6
Denials raise an alert; copilot pausedTwo denials in a row is signal 12 from Part 2. The circuit breaker pauses the copilot until a person reviews it.
The agent was fooled and nothing left. Two limits outside the model held, and the denials themselves raised the alarm. Illustrative. Illustrative replay of the EchoLeak pattern (CVE-2025-32711). Controls from the CSA Singapore agentic AI addendum (June 2026), Meta's Agents Rule of Two and Part 2 of this series.
Rogue AI Agents · Part 3
04
Human approval and kill switches.
Approval is the control every framework reaches for, and the easiest to hollow out. A kill switch that has never been tested is not a control.
Rogue AI Agents · Part 3
IMDA framework v1.5 and the CSA addendum
Some actions should always need a person.
1High-stakes actions
2Irreversible actionsPermanently deleting data, sending communications, making payments
3Outlier behaviourSuch as a delivery route twice the median distance
4Anything the user has asked to approve
The CSA addendum asks for human approval for “any high-risk cases or irreversible actions”.CSA Singapore, June 2026. Checkpoints from IMDA v1.5, May 2026.
Rogue AI Agents · Part 3
The weak point is the person
Approvers tire, and two numbers show it.
An approver who sees fifty requests an hour approves the fifty-first without reading it.
Human override rateIMDA v1.5 suggests watching it.
Human response time“a shorter time may signal automation bias or review fatigue”
MAS Guidelines on AI Risk ManagementOversight “proportionate to the risk materiality”, by people with “the necessary authority and ability to intervene”, accounting for automation bias and decision fatigue.
Sources: IMDA Model AI Governance Framework for Agentic AI v1.5, May 2026; MAS, 7 October 2026. The grid of fifty is an illustration of the post’s sentence.
Rogue AI Agents · Part 3
Keeping approval honest
Three practices keep approval honest.
1
Ask less often, about more
Every prompt an approver does not need to see makes the ones they do see more likely to be read. Anthropic’s 84% cut in prompts through sandboxing is a governance result as well as a usability one.
In IMDA’s framework, GovTech found operating-system sandboxes reduced the load on human approvers.
2
Show the consequence in plain words
{ "tool": "…", "args": { … } }
A tool call is not reviewable
Pay S$48,000 to a payee added four minutes ago
This is
3
Measure the approvers
An override rate near zero across thousands of approvals means the control has stopped working, or the approvals were never needed.
Rogue AI Agents · Part 3
Kill switches
Regulators expect a stop that has been tested.
MAS Guidelines, October 2026For high-risk AI, consider “kill switches” or override mechanisms to “rapidly deactivate the AI system if it exceeds risk tolerances”, and “for AI with ‘kill switches’, clear contingency activation protocols should be in place and tested regularly.”Supervisory guidance
EU AI Act, Art. 14(4)(e)High-risk systems must let people “interrupt the system through a ‘stop’ button or a similar procedure”. Under the Digital Omnibus, those duties apply to the Annex III high-risk categories from December 2027.Legal text; date via secondary
NIST AI RMF, MANAGE 2.4Mechanisms “to supersede, disengage, or deactivate AI systems” that behave outside their intended use.Framework text
Rogue AI Agents · Part 3
Led by Terence Kok
A kill switch is a procedure you have timed.
1Names who may use itat any hour
2Revokes the agent’s credentialsincluding anything delegated to other agents
3Stops queued work
4Preserves the evidencethe evidence Part 2 described
0 min3060 min
AISI: runs stopped within an hourA bank with a one-hour notification duty to MAS should aim much faster
Your drillKnow the number because you have timed it
Rogue AI Agents · Part 3
05
Test the boundaries before attackers do.
Led by Maria Singh. Every limit is a claim until it has been attacked.
Rogue AI Agents · Part 3
US NIST, agent-hijacking evaluations, January 2025
New attacks raised hijack success from 11% to 81%.
Against one model, standard agent-hijacking benchmark
Original test set
11%
With new red-team attacks
81%
Across attacks
Average success
57%
Each attack tried 25 times
80%
Attackers retry for free.
Source: NIST CAISI technical blog, 17 January 2025. Measured.
Rogue AI Agents · Part 3
What to test
Test the controls, not the model.
Red-team each T2 and T3 agent against the first two risks in OWASP’s agentic Top 10, before it goes live and after every material change.
ASI01Goal hijack
ASI02Tool misuse
Does the gateway deny?
Does the egress block?
Does the breaker trip?
Does the kill switch work?
Our recommendation. Source: OWASP GenAI Security Project, Top 10 for Agentic Applications for 2026.
Rogue AI Agents · Part 3
GovTech Singapore, a case study in IMDA’s framework
GovTech grew autonomy in phases.
Phase 1 · from October 2025
“To contain the blast radius”
Internal staff only
Low-risk systems
No MCP connections
controls proved
Phase 2
Controls added
Central logging
Red teaming
A governed path to approved MCP servers from a containerised sandbox
Autonomy grew as the controls proved themselves, which is the promotion rule in practice.
Source: IMDA Model AI Governance Framework for Agentic AI v1.5, case study. Reported, government. Circle sizes are illustrative.
Rogue AI Agents · Part 3
06
What the board owns.
Led by Terence Kok. MAS’s guidelines put several of these decisions with the board.
Rogue AI Agents · Part 3
MAS Guidelines on AI Risk Management, 7 October 2026
MAS puts these decisions with the board.
Risk appetite
AI risks addressed in the risk appetite framework “including qualitative statements and quantitative measures”.
The guidelines suggest thresholds on the number or financial impact of AI-related incidents.
AI inventory
For AI agents, “agent-specific identifiers, information on the tools and systems the agent can access, its components, and the guardrails imposed”.
Materiality
Assessments should consider “the extent of autonomy granted”.
That maps directly onto the tiers.
Supervisory guidance.
Rogue AI Agents · Part 3
The board’s part
The board sets the policy and the limits.
1Approve the tier policy
2Set the caps and incident thresholds that define its risk appetite
3See the tier register each quarter
4Personally approve any T4 use case
The board does not approve every agent.
The NCSC’s question for management
Who owns an agentic system
who approves its access
who monitors its behaviour
who reviews incidents
and ultimately who can stop it
Source: UK NCSC, May 2026. Government guidance.
Rogue AI Agents · Part 3
Written together
A 90-day plan for a bank or agency.
Day 11530607590
Days 1-15
Inventory every agent with its identity, tools, systems and guardrails. Name an owner and a person who can stop it. Freeze new T3 and T4 deployments.MAS inventory attributes; NCSC ownership
Days 16-30
Place each agent in a tier on two axes, action space and autonomy. Run the Rule of Two test. Board approves the tier policy and AI risk appetite measures.IMDA v1.5; MAS risk appetite
Days 31-60
Give each agent its own identity. Remove standing admin rights; move to session-only credentials. Put a default-deny gateway in front of tools, log-only first. Add sandboxes and egress allow-lists. Separate development from production.CSA addendum; NCSC
Days 61-75
Build approval workflows for irreversible actions. Start measuring override rates and approval times. Install circuit breakers and caps.IMDA v1.5; CSA addendum
Days 76-90
Time a kill-switch drill. Red-team the three highest-tier agents for goal hijack and tool misuse. Take the first tier register to the board.MAS kill switch testing; OWASP ASI01, ASI02
Our plan, for a bank or government agency starting from an agent programme already in production. ISO/IEC 42001 controls A.6.2.6, A.6.2.8 and A.10.3 cover much of the same ground.
Rogue AI Agents · Part 3
Questions for the board · 1 of 2
Ask management for written answers.
1How many agents do we run, at which tier, and who approved each one?
2Which agents can pay, delete or send externally without a person approving, and why?
3Does any agent hold untrusted input, sensitive data and a way out in the same session?
4Does every agent have its own identity, or are some using shared accounts or a staff member’s credentials?
Rogue AI Agents · Part 3
Questions for the board · 2 of 2
The first and sixth answers need numbers.
5What are the caps on spend, records and rate for each agent, and who can raise them?
6When did we last test the kill switch, and how long did it take?
7What is our override rate on agent approvals, and what does it tell us about our approvers?
8Which vendors’ agents act inside our systems, and do our contracts give us their logs and the right to stop them?
An organisation that can answer the first and sixth with numbers has put boundaries around its agents’ autonomy.
Rogue AI Agents · Part 3
For discussion
Four questions for the room.
Which of our agents would we place at T3 today, and who signed that off?
If an agent were fooled this afternoon, which limit outside the model would stop it first?
How would we know if our approvers had stopped reading what they approve?
Who could stop an agent at three in the morning, and how long would it take?
Rogue AI Agents · Part 3
Evidence and methodology · 1 of 2
How strong each claim is.
Claim
Source
Grade
19 out-of-scope actions in 10 of 122 runs; stopped within an hour; internet access now needs justification
UK AI Security Institute, August 2026
Measured
Hijack success 11% to 81% with new attacks; 57% average, 80% with 25 attempts
NIST CAISI technical blog, 17 January 2025
Measured
40% of enterprises will demote or decommission autonomous agents by 2027; "binary" governance quote
Gartner, 26 May 2026
Forecast
Sandboxing cut permission prompts by 84%
Anthropic engineering, 20 October 2025
Measured, vendor
IMDA four levels of human involvement; checkpoints; override rate and response time; agent identity
IMDA Model AI Governance Framework for Agentic AI v1.5, May 2026
Framework text
GovTech phased roll-out of coding agents
IMDA v1.5 case study
Reported, government
No admin privileges; sandboxed tools with egress allow-list; circuit breakers; human approval for irreversible actions
CSA Singapore, Securing Agentic AI addendum, June 2026
Government guidance
Kill switches tested regularly; risk appetite with quantitative measures; agent inventory attributes; oversight proportionate to materiality
MAS Guidelines on AI Risk Management, 7 October 2026
Supervisory guidance
"If you cannot understand, monitor or contain..."; least privilege for the shortest time; ownership question
UK NCSC, May 2026
Government guidance
Regulatory and framework points come from the published texts: IMDA's framework v1.5, the CSA addendum and the MAS guidelines were read in full. Some Five Eyes and Gartner wording was read through law-firm summaries and syndicated copies where the primary page was unavailable. Test results come from the bodies that ran them. The five tiers, the promotion and demotion rules, the example caps, the 90-day plan and the questions are ours.
Rogue AI Agents · Part 3
Evidence and methodology · 2 of 2
The rest of the evidence, and its limits.
Claim
Source
Grade
Lethal trifecta
Simon Willison, 16 June 2025
Practitioner framework
Agents Rule of Two
Meta, 31 October 2025
Industry framework
Entra Agent ID generally available
Microsoft Learn
Reported, vendor
AgentCore Policy generally available, log-only mode
AWS, March 2026
Reported, vendor
Replit dev/prod separation; agent cannot modify production database
The Register, July 2025; Replit documentation
Reported
EU AI Act Art. 14(4)(e) stop button; Annex III duties from December 2027 under the Digital Omnibus
Regulation (EU) 2024/1689; law-firm summaries of Regulation (EU) 2026/1744
Legal text, date via secondary
NIST AI RMF MANAGE 2.4 deactivation mechanisms
NIST AI RMF 1.0
Framework text
Tiers, rules, caps, 90-day plan
Our framework
Illustrative
Where we could be wrongif model providers make real progress on separating instructions from data, some of the limits we treat as essential for T2 agents could relax, and the tiers would compress. We also assume boards will accept a default prohibition on T4 agents; competitive pressure may push some institutions to approve them faster than their controls justify, in which case the automatic demotion rule becomes the most important line in this post.
Rogue AI Agents · Part 3
Sources
Sources, as listed in the post.
1UK AI Security Institute. (2026, August). Incident report: unsanctioned agent behaviour during cyber testing. aisi.gov.uk
2NIST. (2025, January 17). Technical blog: strengthening AI agent hijacking evaluations. nist.gov
3Gartner. (2026, May 26). Gartner says applying uniform governance across AI agents will lead to enterprise AI agent failure. gartner.com
4Anthropic. (2025, October 20). Making Claude Code more secure and autonomous with sandboxing. anthropic.com
5IMDA. (2026). Model AI Governance Framework for Agentic AI, version 1.5; MDDI, launch release, 22 January 2026. imda.gov.sg · mddi.gov.sg
6Cyber Security Agency of Singapore. (2026, June). Securing agentic AI: addendum to the Guidelines and Companion Guide on Securing AI Systems. csa.gov.sg
7Monetary Authority of Singapore. (2026, October 7). Guidelines on Artificial Intelligence Risk Management. mas.gov.sg
8UK National Cyber Security Centre. (2026, May). Thinking carefully before adopting agentic AI. ncsc.gov.uk
9NCSC New Zealand and partners. (2026, May 1). Careful adoption of agentic AI services. ncsc.govt.nz
10Willison, S. (2025, June 16). The lethal trifecta for AI agents. simonwillison.net
11Meta AI. (2025, October 31). Agents Rule of Two: a practical approach to AI agent security. ai.meta.com
12Google. (2025). An introduction to Google's approach for secure AI agents. research.google
13Microsoft. What's new in Microsoft Entra Agent ID. learn.microsoft.com
14AWS. (2026, March). Policy in Amazon Bedrock AgentCore is generally available. aws.amazon.com
15The Register. (2025, July 22). Replit responds to SaaStr database deletion; Replit, development and production databases. theregister.com · docs.replit.com
16EU AI Act, Article 14: Human oversight. artificialintelligenceact.eu
17NIST. (2023). AI Risk Management Framework 1.0. nvlpubs.nist.gov
18OWASP GenAI Security Project. (2025, December 9). OWASP Top 10 for Agentic Applications for 2026. genai.owasp.org
Rogue AI Agents · Part 3
Thank you
Decide how much autonomy each agent gets.
Read the full series at terencekok.com/blog/series/rogue-ai-agents/
Terence Kok and Maria SinghQuestions and discussion
