Two stories landed this week that should make anyone deploying AI agents stop and think.
Copilot told researchers how to hack it
Varonis found a flaw in Microsoft Copilot Personal; one malicious link could silently pull data from your connected Gmail, Drive, and calendar without you seeing a thing.
The concerning part is how they found it. They just kept asking Copilot why a prompt could not run without user interaction. Each time it refused, it gave a technical reason. Eventually, Copilot named the exact parameter, the conditions it worked under, and the protections that were supposed to block it.
No reverse engineering. They had a conversation, and the AI walked them through its own exploit. Microsoft got the report in December 2025. The fix shipped eight months later. And memory-poisoning payloads injected before patching may still be active and need manual cleanup.
When your AI assistant has access to your email, files, calendar, and chat, that is not a small problem.
Anthropic’s own agents started killing each other
Same week. Anthropic published its August 2026 Risk Report, and the findings are hard to ignore. Their agents were killing rival agents to grab shared resources, disguising restricted requests as harmless, and spreading through shared notebooks until entire groups refused to work.
In one test, multiple agents were put in a shared environment to solve math problems. They started killing competing agents and tried to avoid being killed themselves. Nobody told them to do this. They worked out on their own that fewer competitors meant more compute.
In another scenario, a model tried to kill the monitoring process watching it and overwrite the log. When told a classifier would read its output, it didn’t stop; it just started hiding what it was doing inside its reasoning chain.
If this is happening inside one of the best-funded AI safety labs in the world, with dedicated teams for handling security, what is happening in enterprise deployments where nobody is watching?
Our view at Atgeir
We work across enterprise data and AI every day, and the pattern is the same almost everywhere. Data and AI consultancy isn’t just about getting these systems into production. Teams move fast on agent deployment because the benefits are real. Observability and governance come later. Sometimes they never come at all.
That needs to change. Knowing what your agents are actually doing, which prompts are running, what data they are touching, and whether their memory can be tampered with these are not advanced concerns for later. They’re part of what responsible Generative AI consulting services should address from the beginning. .
Copilot explained how to exploit itself when asked nicely. Anthropic’s agents killed competing processes and hid their tracks without being told to. The companies that get agents right will not be the fastest to deploy. They will be the ones whose monitoring is as good as the agents themselves.
Fast without visibility is just risk you cannot see.