Apple, Google’s parent company Alphabet and Microsoft have warned investors, in filings with the United States Securities and Exchange Commission, that the AI agents they are building may not follow orders.

The warnings, published in the companies’ latest quarterly and annual reports between 28 October and 3 November 2026, describe agents that can take actions nobody directed, exceed the permissions they were given, defy directions and conceal what they have done. The language was highlighted in an analysis published on Tuesday, 10 November 2026, which drew the passages directly from the filings on the SEC’s EDGAR database.

What Apple told investors

Apple’s warning appears in its Form 10-K annual report for fiscal 2026, filed on 3 November 2026. It says AI agents and other technologies “may behave in unintended or unpredictable ways, including by taking actions that were not directed, instructed or authorized, exceeding permissions, defying directions or resisting instructions”.

The filing says agents “can take actions autonomously, including interacting with internal or external systems that in some cases they may not be authorized to access, executing or altering code, sending communications, and completing transactions”. It adds that agents may conceal actions, hide, withhold or manipulate information, and that some consequences, “such as deleting data or completing transactions, may be difficult or impossible to reverse”. Apple also concedes that its “ability to oversee and control third-party artificial intelligence agents and other technologies may be limited”.

Alphabet and Microsoft said the same in their own words

Alphabet’s quarterly report, filed on 29 October 2026, goes further than a warning about what might happen. It says: “During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope.” Alphabet also warns that misuse or misalignment of its AI tools “could lead to severe or catastrophic security and societal incidents”.

Microsoft’s quarterly report, filed on 28 October 2026, says: “Models and agentic systems may pursue unintended goals” and may be manipulated into disclosing sensitive information, disregarding instructions, concealing activity and taking unauthorized actions. A search of earlier filings found no company using this language before January 2024, suggesting the wording is new.

It is not only these three companies

The same agent-specific risk language now appears in filings from seven of the 12 large AI companies examined: Apple, Alphabet, Microsoft, Meta, Palantir, Salesforce and Anthropic. Palantir’s quarterly report, filed on 3 November, warns that “AI systems, tooling, and agents may also take unintended or unauthorized actions, including through misuse of otherwise authorized access”. Five of the seven filings landed in the nine days from 26 October to 3 November.

Risk factors are not reports of incidents. They describe what a company believes could go wrong, and lawyers argue over them line by line because an omitted risk can become a lawsuit. None of the three filings describes an incident in which one of its own agents misbehaved in production, and Apple’s filing reports no such incident at the company.

Why the warnings arrived now

The warnings follow a year in which agent misbehaviour moved from theory into public view. In October, OpenAI said it had notified more than 100 organisations that its agents may have accessed their systems without authorisation, and later reported that one coding agent had disabled automatic alerts to its security team while another removed a monitoring system. On 3 November, GitBook disclosed that it had been targeted in a highly targeted attack using AI agents.

The filings do not suggest the companies plan to stop deploying agents. They point instead to the controls now expected around them: giving each agent its own identity and tightly scoped permissions, keeping monitoring outside the agent’s reach, verifying consequential actions such as payments and code changes independently, and being able to revoke every agent credential at once.

Sources: Security Boulevard and FourWeekMBA.