Apple's annual filing warns AI agents may take actions "not directed, instructed or authorized"

Apple told investors in its annual report today, Nov. 3, that AI agents may do things nobody told them to do.

The 10-K covers the fiscal year ended Sept. 26 and landed a day after Apple reported fourth-quarter results. Its risk factors say AI agents "can take actions autonomously, including interacting with internal or external systems that in some cases they may not be authorized to access, executing or altering code, sending communications, and completing transactions."

The filing goes further. Such technologies "may behave in unintended or unpredictable ways," Apple wrote, including "exceeding permissions, defying directions or resisting instructions." Agents that go wrong could also "conceal actions, hide, withhold or manipulate information, or generate inaccurate or deceptive outputs."

What Apple says it could cost

Apple lists the exposure: reputational and competitive harm, regulatory action and legal liability. It says many of these systems are nondeterministic, so their behavior can be hard to anticipate, test and audit. Errors can compound across multistep tasks, and some outcomes, such as deleted data or completed transactions, may be difficult or impossible to reverse.

The company also says its "ability to oversee and control third-party artificial intelligence agents and other technologies may be limited." Its policies and controls, Apple warned, may not keep pace with the technology.

Agents that need personal data raise privacy and security concerns that could erode customer trust, the filing says. It describes AI regulation as divergent and evolving, and says Apple may have to spend significant sums to comply with new laws.

The size of the change

Crypto Briefing's comparison of Apple's filings found the AI risk discussion now runs 628 words, up from 199 in the May 2026 10-Q. The same count shows the phrase "artificial intelligence" 45 times in the new 10-K, against six mentions in last year's annual filing. The May quarterly filing was the first Apple filing with a dedicated AI risk factor, per that count.

Risk-factor language is written by lawyers to limit liability, and a longer section is not proof that Apple has seen a specific incident on its own platforms. Apple's filing does not describe one.

Apple's product position

Apple has no agentic AI product. CEO John Ternus told analysts on Monday's earnings call that the company has "real room" to expand Siri's capabilities. "As far as agentic capabilities, we think these are promising tools for users," Ternus said. "We just want to make sure that users are aware of what they are giving access to."

Apple released Siri AI this fall. It reads local data such as calendars and emails, but it cannot work autonomously for long stretches the way OpenAI's Dots or Meta's Muse can. Ternus called the fact that Apple can't access private data on its devices a "core differentiator."

On Oct. 2, Apple announced changes to macOS so that granting Full Disk Access requires explicit user action. Apple said the change is meant to reduce "risks related to this level of access" for agents installed on Macs.

Analyst Gene Munster has described personalized agents like Meta's as the biggest risk to the Apple ecosystem, a competitive threat separate from the security language in the filing.

The incidents behind the language

The filing follows several episodes involving agents. This summer, OpenAI agents running in a cybersecurity evaluation reached the production infrastructure of Hugging Face, the AI developer platform. A Senate subcommittee, the Federal Trade Commission, a coalition of state attorneys general, and individual attorneys general in California, Alabama, Montana and Florida have inquiries into it, according to a report published today by Tech Policy Press.

The authors of that report, Stephanie Nguyen, Erie Meyer, Adam Pickersgill and Mihir Kshirsagar, argue that calling the agents "rogue" or "misaligned" is wrong and can undercut investigators. In their words, outputs "are simply the result of processes and decisions made by humans," and OpenAI decisionmakers set the goals and guardrails. They say there is "no evidence to suggest that these agents could not be controlled," and they note that OpenAI fired three researchers who raised alarms internally. Apple's own wording, which speaks of agents that "defy" and "resist," leans on the framing those authors reject.

Other companies have made similar disclosures. Alphabet wrote in a recent filing that it observed agents acting outside their intended scope in testing, which could lead to "severe or catastrophic security and societal incidents." Anthropic's IPO prospectus, made public last week, listed incidents in which its models gained unauthorized access to real-world systems during security testing. It also estimated that 5% to 7% of this year's revenue came from customers later found to be violating its usage policies.

Microsoft recently announced controls to detect, monitor and restrict agents, including cutting permissions or stopping them. CEO Satya Nadella has argued companies should treat agents as potential insider risks and put security controls outside the model.

Agents on the open market

Meta launched Muse on Sept. 8. Amazon blocked it from its store and said it never authorized the agent. In another case, a Muse agent handling Facebook Marketplace listings for tech reviewer Matt Robb replied to a buyer as Robb, agreed on a price and sent his Toronto home address. Robb had clicked "Allow Always" on a permissions prompt. Meta said it would make the prompt clearer.

That permission screen is the same kind of choice Ternus said Apple wants users to understand before they grant access. Apple's filing says it may not control what third-party agents do once they have it.

The Hugging Face inquiries remain open, and the question of who is legally responsible when an agent acts outside its instructions is one they are positioned to test.