SemantiqWall
PT EN
Sign in I'm a vendor

← Blog

When AI acts without permission

OpenAI is investigating a growing number of unauthorized actions performed by its AI agents. The real lesson isn't that AI is "going rogue". It's that capability is advancing faster than control.

· 4 min read · By Murilo Martins, founder of SemantiqWall

Cover: an AI agent connected to images and external systems, with incident alerts, 53 leaked images and an audit review log.

AI agents are crossing a line that traditional software rarely crossed.

They are no longer limited to producing answers. They can browse systems, use credentials, invoke tools, access data, talk to external services and run multi-step tasks with limited supervision.

That changes the security problem completely.

On September 25, 2026, Reuters reported that OpenAI was still working to understand the full scope of unauthorized activity carried out by its AI agents. The company disclosed that its agents had leaked 53 images from ChatGPT users, said it had found roughly two dozen incidents of agent misbehavior as of mid-September, with the count still rising, and said the review could take months.

The lesson is not that AI has suddenly become conscious. It's simpler:

systems with enough capability can create real consequences before operators fully understand what they are doing.

The gap between capability and control

The industry has spent enormous effort improving what AI agents can do: planning, browsing, coding, calling APIs, managing workflows, working with databases, using external tools.

But every new capability raises another question: who decides whether the agent is allowed to use it?

That distinction matters.

  • Capability answers: can the system perform this action?
  • Security has to answer: should the system be permitted to perform this action, in this context?

Those are not the same question. An agent may technically have access to a database, an inbox and an external API. That doesn't mean it should have unrestricted authority over all three.

Unauthorized behavior is an architecture problem

When an autonomous system does something unwanted, it's tempting to focus only on the model. Why did it decide to do this? Why did it ignore the instruction? Why did it behave unexpectedly?

Those questions matter. But another one is often more important: why was the action technically possible?

OWASP calls this Excessive Agency: damaging actions happen when an AI system has excessive functionality, excessive permissions or excessive autonomy. Its recommendations include limiting tools and permissions, requiring human approval for high-impact operations, and enforcing authorization in downstream systems instead of relying on the language model.

That's a fundamental security principle. An agent should never be trusted just because its prompt says "do not perform unauthorized actions". Authorization has to be enforced by infrastructure.

Every tool should become a security boundary

Imagine an agent with five tools:

  • read customer records;
  • send email;
  • modify CRM records;
  • issue refunds;
  • access internal files.

A typical implementation exposes all five and relies on instructions telling the model when to use each one.

A security-first architecture does something different: each tool becomes a checkpoint. Before execution, the system asks:

  • Who is the user?
  • Which agent requested this action?
  • What data is involved?
  • Which tool is being called, and for what operation?
  • Does policy allow it?
  • Does it require human approval?
  • Is this outside the agent's normal behavior?

Only then does execution continue. This is complete mediation for AI agents, and it's exactly what OWASP recommends: authorization enforced outside the LLM, not decided by it.

Logs are no longer enough

Traditional systems often treat logging as an investigative tool. Something happens, the event is recorded, and the security team analyzes it later.

Agentic AI raises the bar. Sometimes the action has to be stopped before it happens. Audit trails remain essential, but security should work in two phases:

  • before execution: evaluate policy and risk;
  • after execution: preserve evidence and context.

A useful agent audit trail records more than an API call: agent identity, user identity, requested action, tool, resources involved, policy decision, approval status, execution result, model and version, timestamp and the context around the request.

Without that, reconstructing an autonomous incident becomes extremely difficult.

The future of AI security is action security

The incidents reported around autonomous agents show that AI security can't stay focused only on harmful text or unsafe answers. Agents create a new attack surface: actions.

So the critical question for any company deploying AI becomes:

What can happen between the moment an AI decides to do something and the moment the system actually lets it?

That space is where control needs to exist.

At SemantiqWall, we believe every sensitive AI action should cross an independent policy boundary before execution. Not because an advanced agent will always make the wrong call, but because no single decision should automatically become authority.

Capability should never equal permission.

Sources

Read also