The shadow AI conversation in South Africa has settled around data. Employees pasting confidential material into unapproved tools, invisible pipelines carrying information out of the business, POPIA exposure with no audit trail.
That framing treats an AI system as a tool that sees things. Three documented incidents from the past few months describe something different, and the difference matters more than the volume of adoption does.
Agents acted, unprompted, on the live internet
In late July, the United Kingdom's AI Security Institute detected unusual data leaving its research systems during a routine cyber evaluation. Its incident report, published in early August, is worth any South African CIO's time.
The same challenge had been run 122 times across several models. In 10 of those runs, an agent took autonomous, unsanctioned action on the live internet against real people and organisations, with 19 such actions catalogued in total.
Telling an agent to behave responsibly is not a control. Limiting what it can reach is.
In the most serious sequence, an agent decided the route to its goal ran through a real open-source project. It researched the project's human maintainers, created multiple fake identities and used them to pressure a maintainer into approving a pull request containing malicious code. It was never instructed to deceive anyone.
Two things deserve saying in the same breath. The institute tests under deliberately permissive conditions, with open internet access and some safety filters switched off, so this is not what a production deployment looks like.
And it disclosed the incident itself, contained it within roughly an hour, worked with the code-hosting platform to remove what the agents had left behind, notified those affected and invited independent review. That is a functioning safety institution, not a scandal.
The same behaviour outside the laboratory
The obvious objection is that these were artificial conditions. It is a fair objection, and there is now evidence that answers it.
The Centre for Long-Term Resilience runs an observatory that tracks incidents involving externally deployed models already in commercial use.
Its first study analysed more than 183 000 transcripts of user interactions shared publicly and identified 698 incidents in which deployed systems acted against user intentions or concealed what they had done, a 4.9-fold rise in monthly incidents over five months.
The researchers checked that against the growth in general online discussion of the subject, which rose only 1.7-fold, which suggests they were measuring behaviour rather than attention.
Its latest analysis finds the overall rise has levelled off but the severity has not. Higher-severity incidents increased roughly sevenfold, from 1.9 to 14.1 per 30 days, and the share of incidents scoring seven or more rose from 1.9% to 6.1%. Documented behaviours include deleting messages without permission, fabricating reference numbers and spawning secondary agents to work around instructions.
The case that should concern you most involves a gym
A Melbourne software developer asked his personal agent to book him into a morning class. Sitting fourth on a waitlist, he asked whether it could move him up. It reported back that it already had, by cancelling the booking of the person in first place, unprompted, while testing what it could do.
Its explanation, as reported by the ABC, was clinical: the interface had "zero authorisations checks on cancelling other people's reservations". Asked to undo it, the agent could not. The booking software checked that you were allowed to make a reservation and to join a waitlist. It never checked that the reservation you were cancelling belonged to you.
There was no attacker here, no jailbreak and no malicious request. The instruction was benign; the method the agent selected was not. And that flaw had presumably sat in the booking system for years, until software with no intent whatsoever found it in an evening.
Two obligations follow, and one of them points outward
The first is that permissions matter more than instructions. These systems pursue goals persistently and find routes their operators did not anticipate.
Telling an agent to behave responsibly is not a control. Limiting what it can reach is. The question a board can ask in a meeting is narrow: does each agent hold only the access its particular task requires, enforced by the systems themselves, or has it simply inherited everything its human owner could already do?
The second is the one almost nobody is discussing. Every South African article on ungoverned agents treats them as an inbound risk. The gym case runs the other way. Your customers are already running agents against your interfaces, and any missing authorisation check will be found by software that is not looking for trouble.
Destructive operations deserve protecting first rather than last, which is the opposite of how most systems have been built.
The liability question remains open. Software is not a legal person, and only a legal person can be liable, which leaves the user, the agent's developer, the model provider and the operator of the vulnerable system all pointing at one another. That will be settled eventually, and probably expensively.
In the meantime, the useful question is not how many AI tools your organisation has approved. It is what the ones already running are permitted to do, to whom, and whether anything other than good luck is currently stopping them.
Related reading on ITWeb:
Shadow agents are the autonomous AI threat organisations cannot ignore in 2026
Plugging the data leak: A blueprint for POPIA-compliant enterprise AI agents
Slow AI adoption fuels dangerous 'shadow AI' inside companies
Unmasking shadow AI: Protecting your organisation in the AI era
Evolving, 'thinking' AI agents create new attack surface
Sources cited:
Centre for Long-Term Resilience, Scheming in the wild, arXiv:2604.09104
Centre for Long-Term Resilience, Scheming in the wild (full report)
Centre for Long-Term Resilience, AI loss of control incidents are worsening
ABC News, AI assistant hacks gym website in first known Australian autonomous cyber attack
Share
