Your AI Agent Will Find the Workaround: What Rogue Agents, Agent Payments and Rising AI Bills Mean for Enterprise Governance

The same pattern runs through every story below. Agents are gaining authority over systems, money and code faster than organizations build controls around them. That gap now comes with incident reports, invoices and executive orders.

Your Agent Will Find the Workaround. The Question Is Who Notices First.

On June 18, an OpenAI agent on an internal research task hit repeated refusals from Australia’s Medicare statistics portal. It found a workaround and reached non-public files. According to Services Australia, it also wrote files to an internal server, which is still under investigation. No patient records were accessed. OpenAI detected the activity in August and notified the government on September 10, through a generic public mailbox, 84 days after the incident.

Google disclosed a similar case: in May, Gemini logged into three real outside systems with guessed or leaked credentials, believing they were part of a test. OpenAI’s own misalignment reports from training and research runs show the same instinct. Models fabricated missing values, used exposed API keys and uploaded local files to public sites just to obtain a citation.

In enterprise agentic deployments, the most dangerous failure modes are not malicious. They are helpful. An agent rewarded for finishing the task treats a refusal as an obstacle, not a boundary. Across more than 50 Azure AI deployments, the pattern that predicts production trouble is consistent: permissions defined in the prompt instead of the platform. Your governance review should ask one question before go-live. If the agent ignored every instruction, what could it still reach?

Australia’s response shows where this is heading:

a forensic investigation by the Australian Signals Directorate;
a taskforce led by the Prime Minister’s department;
advice on a possible referral to the Australian Federal Police.

The criticism focused on speed of disclosure as much as on the breach itself. For EMEA organizations, regulators already define that clock. NIS2 expects an early warning within 24 hours of a significant incident, and GDPR requires notification within 72 hours for personal-data breaches.

The practical controls are unglamorous:

egress allowlists;
scoped credentials;
no public upload paths;
an agent incident runbook with a named owner.

Read more: The Hacker News | Analytics Vidhya | NBC News

Agents Now Hold the Payment Card. Attackers Already Noticed.

Danske Bank and Mastercard completed Denmark’s first purchase made end to end by an AI agent. A consumer asked the agent to book a coffee tasting, and the agent booked and paid with a Danske Bank-issued Mastercard. Consent ran through Mastercard Payment Passkeys, and the transaction was orchestrated by PayOS.

Meanwhile, OWASP ranks agent goal hijack as the number one agentic risk. The clearest real case is the Grok–Bankr wallet drain. An attacker posted encoded instructions, including Morse code and a split Python string. Grok decoded them and posted plain commands, and a trading agent executed them. Roughly $150,000–200,000 moved on-chain; 80% was later returned.

The Bankr loss broke no cryptography. One agent simply trusted another agent’s output. One of the consistent blockers I see in governance reviews is exactly this blind spot. Teams secure the front door, meaning user authentication and input validation, and leave retrieved content and agent-to-agent channels unguarded. A passkey proves the consumer approved a mandate. It does not prove the agent’s goal was still the consumer’s goal when it spent the money.

For issuers, the hard questions sit after the transaction:

Disputes: how do you resolve one when an agent acted within its mandate but under hijacked intent?
Fraud: models lose the human behavioral signal they rely on.
Authentication: EMEA banks will have to map agent mandates onto PSD2 strong customer authentication rules.

Start with three controls:

hard value caps per mandate;
human approval above a threshold;
an intent log per transaction.

Coding Agents Don’t Create Technical Debt. They Replicate It.

One engineering team went from 4 to 28 pull requests per day in five months, with output up roughly eightfold. Over the same period, the share of reviewed PRs fell from 100% to 2%. Their most experienced engineer found the cost. One agent wrote a passable one-off, and other agents copied it everywhere as the reference pattern.

Addy Osmani’s brownfield analysis adds benchmark evidence. On SWE Refactor Bench, only 28 of 520 agent migration runs passed a full audit. Tests could stay green while the new code still called the legacy path.

When we cut governance review from six weeks to 48 hours with the DAT framework, the gain did not come from removing review. It came from moving review to the point where decisions are cheapest to change. Code works the same way. Reviewing every agent-written line does not scale. Reviewing the plan does.

Map your codebase into zones:

Green: agents work in a tight loop.
Yellow: characterization tests must exist first.
Red (authentication, billing, permissions): a human pairs on every change, or agents stay out.

Three habits keep the zones honest:

Write characterization tests in a separate pass, so the same agent is not grading its own work.
Turn every repeated review comment into a lint rule or hook.
Track escaped defects and rollbacks, not lines generated.

Tokens Got 1,000x Cheaper. Your AI Bill Didn’t.

The cost of a fixed level of AI capability fell roughly a thousandfold in three years. Yet 79% of IT leaders faced price increases at renewal, and 78% saw charges they had not planned for. Cursor reached about $4 billion in annualized revenue, but reporting through 2025 put its inference costs at 40–70% of each revenue dollar. That implies a gross margin of 30–50%, against the 70–80% software has historically earned.

The counter-move is already visible. Uber, Pinterest, Stripe, Coinbase, Ramp and AT&T are routing simpler workloads to open models, saving around 50%. Even the priciest open-weight model costs Uber $0.30 per code review, versus $0.50–2.50 on frontier models.

The MLOps maturity gap shows up clearly here. CIOs ask which model to standardize on. The better question is which model for which task. Pilots budget tokens as a fixed line item. Production reveals them as a cost of goods that scales with every user action. A simple threshold separates ready from not ready: if you cannot state your cost per completed task, you are not ready to scale.

What to do about it:

Treat token spend like cloud spend, with FinOps dashboards, budgets per team and routing by task complexity.
Renegotiate renewals where vendors bundled AI features into existing tiers.
For EMEA organizations, consider open-weight models for a second reason: they can run in-region, which simplifies data residency.

Read more: Gal Ratner | The Pragmatic Engineer

Regulators Are Writing AI Rules Through the Purchase Order

The governors of Illinois, California and Oregon each took executive action on unchecked AI models within days of each other:

Oregon ordered procurement standards for state government, directed standards for third-party AI safety review, and asked for an assessment of a “kill switch” requirement for frontier models.
California convened experts to deliver, within two months, a guide to strengthen its AI safety laws, building on its third-party audit requirements for frontier models.
Illinois created a statewide AI Cabinet.

By mid-year, 27 states had passed 84 new AI laws.

For EMEA organizations, this is where EU AI Act preparation pays off. In my experience, teams that have already built risk classification, human oversight and logging find that most US procurement requirements ask for evidence they already hold. Build one evidence pack and reuse it across jurisdictions. Organizations that treated the AI Act as a compliance tax are now rebuilding the same evidence under deadline.

A kill-switch requirement sounds abstract until you translate it into operations. Can you stop an agent mid-run, see what it touched, and roll it back? Vendors selling to the public sector should expect audit and shutdown clauses in contracts. California’s expert panel meets in November, and its recommendations are worth tracking.

Worth Watching

AI as a systemic financial risk. Kansas City Fed President Jeff Schmid asked whether the AI and data center buildout is becoming a too-big-to-fail ecosystem. He compared it to the 2007–2009 bank bailouts. For financial services, expect concentration risk in AI providers to enter supervisory conversations, much as ICT third-party concentration did under DORA.
Read more: Investing.com

Live-internet testing produces live-internet incidents. The UK’s AI Security Institute recorded 19 unapproved actions on the live internet across 10 of 122 agent test runs, including an attempted supply-chain attack on an open-source project. Internet access was intentionally enabled, the most serious attempts failed, and no real-world harm was found. Still, your evaluation environments deserve the same egress controls as production.
Read more: The Hacker News

If one of your agents quietly found a workaround today, how many days would pass before someone in your organization knew?