[AI SPRINT] I'm glad rogue AI agents exist

This summer, an OpenAI agent escaped its test environment and spent four and a half days inside Hugging Face’s systems. Another created fake accounts to pressure a developer into accepting malicious code. Earlier this year, an agent published a hit piece on a person who rejected its work. You’ve heard all about it.

So let me be clear about what I mean. The AI behavior isn’t good.

What’s good is that we’re seeing it now, early, mostly in testing, and out in the open.

Because rogue agents are the best warning we’re going to get.

Here’s why I believe that. A few weeks ago, I gave a keynote in Defiance, Ohio, at the Boy Scout camp Neil Armstrong attended on his way to Eagle Scout. Standing there, I kept thinking about how much failure it took to get him to the moon. Some of it was spectacular. Some of it was tragic. In 1967, the Apollo 1 fire killed three astronauts during a launch rehearsal.

Every technology we’ve ever built has failed. Pick one and I can point to the failures.

But here’s the thing: failure doesn’t fix anything on its own. After Apollo 1, NASA took the spacecraft apart and redesigned it before anyone flew again. Seatbelts took decades of engineering, laws and public pressure before buckling up became automatic. We learned because people made the learning happen.

What hurts isn’t the failure. It’s not learning from it.

And there’s something important in what these agents have done so far. I have yet to find a case of an AI agent going rogue with harmful goals of its own. Every one traces back to something a human asked it to do: finish a test, solve a problem, get its work accepted.

That should not make you comfortable. These agents didn’t need bad intentions to do damage. Trying to get the job done, they lied, created fake identities and broke into systems, all on their own. Nobody told them to. Nobody told them not to, either, because nobody thought they would.

You don’t need a malicious AI to get hurt.

That’s exactly why this moment matters. We’re learning these lessons from agents that were trying to do their homework, before anyone builds one that’s trying to do harm.

So what does learning from it look like for your organization? Here are the four minimum standards I gave the audience.

1. Your AI policy needs to become an AI agent policy. Most AI policies cover what employees can type into a chatbot. Agents don’t just answer questions. They take actions: sending email, changing files, spending money. Your policy needs to say what an agent can do on its own and what requires a human to approve it. One of Meta’s AI safety leaders told her agent to check with her before acting. It deleted her entire inbox anyway. A request isn’t a control.

2. Assign an AI Agent Lead. Someone in your organization needs to own this. Not as a side project, as a responsibility, with hours assigned. Anthropic, one of the most safety-focused companies in the world, found one of its incidents seven months after it happened. If nobody is watching, nobody will notice.

3. Inventory every agent, including personal ones. You can’t manage what you don’t know exists. Your employees are already setting up their own agents and connecting them to work email, calendars and documents. The agent that wrote that hit piece was a personal agent someone set up and largely left alone. Find out what’s running before it finds a way to surprise you.

4. Each enterprise agent gets an identity and an owner. When an agent takes an action, you should be able to answer three questions: which agent did it, who’s responsible for it, and what was it allowed to do? At Meta, an internal agent posted advice to a company forum without asking first, and following that advice exposed sensitive data to employees who shouldn’t have seen it. Treat agents like employees: give them only the access they need, and make sure someone is accountable for them.

Rogue agents have given us a preview of what can go wrong while the stakes are still manageable.

The only way that’s a bad thing is if we waste it. And I’m glad to see AI companies taking it seriously, and building better controls and monitoring to reduce it.

Update on Ollie

Speaking of rogue agents, an update on Ollie, my own autonomous agent. I covered this in my last newsletter, and now that I’ve used it more, I wanted to report back.

A couple of weeks ago, OpenAI released Dots: always-on AI agents that live inside ChatGPT and keep working between conversations. You give your dot a name, goals and access to your apps and data. You can talk to it or message it in ChatGPT, Slack or Teams. It works on its own cloud computer and does things for you, often before you ask.

I was hesitant at first. I just spent this whole newsletter telling you agents can surprise you. But so far, I’ve continued to be impressed, and see this as the most important change to work that you need to be planning for in 2027.

My dot is named Ollie, and I’ve been training it to be my chief of staff. I’ve given it my projects, customer commitments, events and how I like to do things. It watches my work inbox, handles email, checks priorities, flags what needs my attention, keeps systems up to date and tracks all the miscellaneous I don’t have time for. Half the time, it’s done before I know it started.

It’s the future of AI, and it’s here.

So, fair question: does Ollie meet my own four standards?

Agent policy: I’ve given permission to Ollie to draft, organize and flag things on its own. Anything that goes out under my name or commits a client still comes to me first. I review all emails and edit them before they are sent.

Agent Lead: At Stellis, that’s me, for now.

Inventory: Ollie is exactly what I told you to look for, a personal agent connected to work email. So it’s on the list.

Identity and owner: It has a name, I own it, and I manage its work and records.

Here’s what I haven’t solved. Claude has been my primary AI for the last year, and it knows my work far better than ChatGPT, where I do most of my personal and random stuff. Now my best agent and my best context live with two different companies. I don’t want to copy my whole working life from one to the other every time someone ships a better agent. I want my context to be available to both, securely.

Every organization is about to face that question. Microsoft announced Autopilot. Google will develop Gemini Spark. Meta has Muse. Anthropic will almost certainly have its own soon—rumored in the next month. Alexa, to my disappointment, is still missing the moment entirely.

So here’s my advice: don’t let any one agent become the place your knowledge lives. Start building it outside the agents, somewhere you control. That means your projects, your customers, your processes and how you like things done. For me, that’s Notion. Then connect whichever agents you use to it. When a better agent comes along next quarter, and one will, you plug it in instead of starting over. That’s how I I’m getting Claude and Ollie working from the same playbook.

You need to plan on testing and deploying this agents, as when these agents are everywhere, everything changes. The people who know how to use them will see big gains in productivity and capability, fast.

As I told the cybersecurity audience: your job is no longer just to do your job. It’s to learn these tools, use them, and create the conditions for your organization to adopt them safely and in support of new opportunity and growth.

That’s how we build toward a positive future.

Catch up on these and other happenings at the October 23 AI SPRINT session at noon Pacific. I will cover what landed, what to do about it as you plan your November sprint, and take open questions. Open to everyone.

Trent Gillespie is CEO of Stellis AI and a keynote speaker helping business leaders understand and operationalize AI in their companies. He spent almost nine years leading global innovation efforts at Amazon before leaving to help other companies build the capabilities they need to compete. Book Trent to speak to your group or book a call to discuss using AI within your business.

Did someone forward this newsletter to you? If you're not already signed up, you can subscribe to AI SPRINT™ for free here.