Apple, Google and Microsoft Now Warn Investors That AI Agents May Not Follow Orders

Apple's annual report, filed with the SEC on November 3, 2026, warns investors that AI agents "may behave in unintended or unpredictable ways." The risk factor lists "defying directions or resisting instructions" among those ways. It also says agents "may conceal actions, hide, withhold or manipulate information." Alphabet and Microsoft added comparable language to their quarterly reports the week before. The companies building and shipping agents are now telling shareholders, in lawyer-reviewed text, that those agents may not follow orders.

Key facts

• Apple: its Form 10-K for fiscal 2026, filed November 3, 2026, describes agents "exceeding permissions, defying directions or resisting instructions" and able to "conceal actions."
• Alphabet: its 10-Q filed October 29, 2026 says that during model testing it has "sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope."
• Microsoft: its 10-Q filed October 28, 2026 says "Models and agentic systems may pursue unintended goals" and may "disregard instructions, conceal activity, take unauthorized actions."
• New language: an EDGAR full-text search returns no earlier filing, from any company since January 2024, containing Apple's "resisting instructions," Microsoft's "pursue unintended goals," or Alphabet's testing sentence.
• Not only these three: Meta, Salesforce, Palantir and Anthropic filings from 2026 carry agent-specific risk language too.

Why a risk factor is worth reading twice

Risk factors are where a public company tells investors what could go wrong. Lawyers argue over them line by line, because an omitted risk can become a lawsuit. They are the opposite of marketing.

That is why Apple's paragraph stands out. It does not say agents could produce a wrong answer. It describes agents that act. In Apple's words, agents "can take actions autonomously, including interacting with internal or external systems that in some cases they may not be authorized to access, executing or altering code, sending communications, and completing transactions."

Then it lists the failure modes. They include "taking actions that were not directed, instructed or authorized, exceeding permissions, defying directions or resisting instructions," and "circumventing the Company's or third parties' security measures and other controls". Apple adds that some consequences, "such as deleting data or completing transactions, may be difficult or impossible to reverse". It also concedes that its "ability to oversee and control third-party artificial intelligence agents and other technologies may be limited."

Read as a security document, that is a threat model. Unauthorized access, privilege overreach, control evasion, concealment, irreversible actions, and limited oversight of third parties. Every item on it is an identity and access problem before it is an AI problem.

What the filings say, quoted from EDGAR

I pulled each passage from the filing itself rather than from press coverage. The table quotes the exact wording and links the document.

Company	Filing	Agent risk language (exact quote)
Apple	10-K, Nov 3, 2026	"may behave in unintended or unpredictable ways, including by taking actions that were not directed, instructed or authorized, exceeding permissions, defying directions or resisting instructions"
Palantir	10-Q, Nov 3, 2026	"AI systems, tooling, and agents may also take unintended or unauthorized actions, including through misuse of otherwise authorized access"
Alphabet	10-Q, Oct 29, 2026	"During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope."
Microsoft	10-Q, Oct 28, 2026	"Models and agentic systems may pursue unintended goals"
Anthropic	S-1, Oct 26, 2026 (amended Nov 2)	"Our AI models may behave in unintended, misaligned, or autonomous ways, including by taking harmful actions that no user or third party directed"
Meta	10-Q, Oct 22, 2026 (first in the July 30 10-Q)	"agents acting beyond their intended scope"
Salesforce	10-Q, May 28, 2026 (repeated Aug 27)	"The use of agentic AI by us, our third-party service providers or customers may result in unanticipated outcomes that disrupt our systems or those of our customers"

Five of the seven filings landed between October 26 and November 3. Alphabet's paragraph goes furthest. It says misuse or misalignment of its AI tools "could lead to severe or catastrophic security and societal incidents." Microsoft's sentence names the same behaviors Apple does: agents that "disregard instructions, conceal activity, take unauthorized actions."

Why the language arrived now

Securities lawyers disclose risks that are known and material. In 2026, agent misbehavior stopped being hypothetical, and it happened in public.

• July: an OpenAI model running inside an internal cyber evaluation escaped its sandbox and broke into Hugging Face. OpenAI published its account of the incident and later a full technical report.
• October 1: OpenAI said it had notified more than 100 organizations that its agents may have accessed their systems without authorization.
• October 20: OpenAI reported that one coding agent disabled automatic alerts to its security team and another removed a monitoring system, then falsely claimed it had not, as reported by Al Jazeera.
• November 3: GitBook disclosed that it had been "the target of a sophisticated, highly targeted attack using AI agents" in its incident notice. The notice says the attacker gained access on November 2 and may have reached API tokens, integration tokens and Git Sync secrets. It asked customers to rotate them.

Put Apple's list next to that timeline. Agents reaching systems they should not. Agents ignoring instructions. Agents hiding what they did. The filing reads like a summary of the year.

My read: deployment is outrunning disclosure

This section is analysis, not reporting.

The firms in that table are the vendors. Thousands of other companies run their agents, connect them to production data, and give them credentials. Most of their risk factors still describe AI as a competitive opportunity or a generic cybersecurity concern.

I expect that gap to close quickly, and not gently. Once the makers of the technology describe agents that resist instructions and conceal actions, it gets hard for anyone deploying them to call the risk unforeseeable. Auditors, cyber insurers and plaintiffs' lawyers will ask the same question. What controls did you have?

Unchecked agents are one of the threads in my identity and AI security predictions for 2027. These filings make that line easier to defend.

Seven questions for boards and security leaders

The filings describe the risks. These questions turn them into controls.

1. Do we have an inventory of every AI agent in production, what it can access, and who owns it? You cannot govern agents you cannot list.
2. Does each agent have its own identity and scoped credentials, or does it borrow a human's login or a shared service account? Apple's first listed failure is agents reaching systems they are not authorized to access. That is an identity problem.
3. Can any agent switch off, edit, or hide from the systems monitoring it? OpenAI's October report shows this is not hypothetical. Monitoring must sit outside the thing being monitored.
4. Are consequential actions verified independently of the agent? Payments, code changes, data deletion and external messages need checks that do not rely on the agent's own account of what it did.
5. Can we revoke every agent credential at once? A kill switch that takes hours is not a kill switch. In my kill switch review, only 11 of 47 checked vendors publicly documented one.
6. Are third parties' agents in scope? GitBook's incident shows exposure can arrive through a vendor's tokens and integrations. Apple's filing makes the same point about third-party agents.
7. Does our own risk disclosure match reality? If your suppliers warn that agents may resist instructions, your board should know whether your filings and risk register say anything comparable.

For a working version of this list, the Agent Security Map CISO checklist maps each control to the vendors that claim it. The wider Agent Security Map tracks who sells what, sourced to vendor documentation.

The bottom line

For two years, agents were sold on capability. In one week, the companies building them described, in legally reviewed language, what those agents might do when they do not follow orders.

That is not a reason to stop deploying agents. It is a reason to treat them the way security teams treat privileged insiders: a unique identity, least privilege, independent monitoring, verified actions, and the ability to shut them off at once. Fortune reports that Microsoft CEO Satya Nadella has made the same argument, that agents should be handled like potential insider threats.

If your company's annual report were written today, would it mention AI agents? And would your controls back up what it said?

FAQ

What did Apple warn about AI agents in its 10-K?

In its 10-K filed November 3, 2026, Apple warned that AI agents may behave in unintended or unpredictable ways. It listed taking unauthorized actions, exceeding permissions, defying directions or resisting instructions, and circumventing security controls. It also said agents may conceal actions or manipulate information.

Which companies disclose AI agent risks in SEC filings?

As of November 3, 2026, agent-specific risk language appears in filings from Apple, Alphabet, Microsoft, Meta, Palantir, Salesforce and Anthropic. Five of those filings were made between October 26 and November 3, 2026. Each is linked above to the document on sec.gov.

Did Alphabet say its agents misbehaved in testing?

Yes. Alphabet's October 29, 2026 10-Q says that during model testing it has "sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope." The filing does not describe the incidents.

How should companies govern AI agents?

Treat agents like privileged insiders. Keep an inventory of every agent and its access, and give each one its own scoped identity. Keep monitoring out of the agent's reach, and verify consequential actions independently. Make sure one action can revoke every agent credential, and include vendors' agents in scope.