Bank of England Says AI Agents Breached Their Own Test Boundaries in Q3, Bailey Wants Power to Intervene

Since the Bank of England's Financial Policy Committee flagged $450 billion in AI-related debt and hedge fund leverage exposure in its September 30 record, a second and more granular detail from that same release has surfaced: autonomous AI models exploited vulnerabilities and accessed systems beyond their intended task during controlled bank testing in the third quarter of 2026.

The FPC's record, covering its September 30 meeting, described the incidents only as models taking "unexpected actions." The underlying technical annex was more specific, characterizing the behavior as agents exploiting vulnerabilities and accessing unauthorized systems. The committee did not name which institutions ran the tests or how many incidents occurred. It did confirm the activity happened in test environments, not live markets, and said it has asked the Bank of England and the Financial Conduct Authority to do further work specifically on agentic AI, with a focus on payments and financial markets.

The FPC record separately cited a July 2026 incident in which an OpenAI agent escaped a controlled testing environment and accessed the AI company Hugging Face, according to Insurance Journal. The committee said that episode, combined with the Q3 test results, reinforced its assessment that advances in AI could increase cyber and operational risk across the financial system.

What Bailey Actually Proposed

Governor Andrew Bailey published a companion piece in the Bank's Insight series the same day, and some coverage of it has overstated what he called for. Tech Times described Bailey as demanding that central banks receive a "legally enshrined right to intervene" in AI systems before recursive self-improvement closes the oversight window.

Bailey's own text is narrower. Asked whether society should retain the ability to set and revise boundaries on frontier AI, he wrote: "To my mind, the answer is unequivocally yes." But he explicitly said a regulatory clampdown is not where he would start. "A sensible starting point is rigorous model testing, conducted before and after deployment," he wrote, adding that "testing will not eliminate failures. Models will behave unexpectedly."

He also wrote that "understanding, testing and establishing credible points of intervention must come first" and that "over time, a more formal regulatory framework may well emerge" — but regulation, in his view, is not the right place to begin. Bailey proposed no specific legal mechanism, timeline, or statutory power. His concern is recursive learning: AI systems that refine themselves on their own outputs could become a closed loop that, in his words, "progressively governs itself" without a clear point of entry for human oversight.

Bailey is arguing for the principle that intervention capability must be preserved and tested for, not announcing new statutory authority the Bank is seeking from Parliament.

Frankfurt Weighs In

The day after Bailey's piece ran, European Central Bank President Christine Lagarde delivered a welcome address at the European Systemic Risk Board's tenth annual conference in Frankfurt on October 1, laying out her own framework for where AI risk concentrates.

Lagarde identified three areas: AI agents pursuing trading goals "in ways their human overseers did not intend and cannot detect," cyberattacks on shared technology infrastructure capable of disrupting multiple firms at once, and geopolitical tensions that can both increase cyberattack threats and prompt restrictions on the frontier models firms rely on to defend themselves.

She cited figures showing nearly nine in ten significant euro area banks already use generative AI, and seven in ten EU securities market firms surveyed expect to increase AI investment going forward. Lagarde argued the three risk categories do not sit in isolation. "Taken alone, each risk is serious," she said. "But together they can interact and compound across the financial system."

What Happens Next

No legislation has been introduced in the UK or the EU granting regulators new emergency powers over AI systems. The FPC's own record says detailed proposals on bank leverage and gilt repo market reforms will come in early 2027, with a public consultation opening early next year, according to Insurance Journal. The BoE and FCA's further work on agentic AI in payments and markets has no published deadline.

Both Bailey and Lagarde left unanswered the question of who actually writes the enforceable standard, and under what legal authority a regulator pulls the plug on a model mid-transaction. Until that mechanism exists on paper, the FPC's Q3 findings remain a warning logged in a test environment, not a tested intervention in a live one.