{ "id": 5155, "status": "publish", "lang": "en", "slug": "ai-agents-business-controls", "url": "https://soymarketingultra.com/en/ai-agents-business-controls/", "title": "AI Agents in Business: Controls Before Autonomy", "excerpt": "", "date_gmt": "2026-10-12T12:00:00Z", "modified_gmt": "2026-10-11T22:38:11Z", "categories": [ { "slug": "applied-ai-en", "name": "Applied AI", "url": "https://soymarketingultra.com/en/category/applied-ai-en/" } ], "tags": [ { "slug": "ai-agents", "name": "AI agents" }, { "slug": "anthropic-en", "name": "Anthropic" }, { "slug": "ai-governance", "name": "AI governance" }, { "slug": "ai-security", "name": "AI security" }, { "slug": "enterprise-ai", "name": "enterprise AI" } ], "featured_image": { "url": "https://soymarketingultra.com/wp-content/uploads/cabecera-5155.png", "alt": "", "width": 1200, "height": 675 }, "translation": { "lang": "es", "url": "https://soymarketingultra.com/agentes-ia-empresas-controles/", "id": 5154 }, "seo": { "title": "AI Agents in Business: Controls Before Autonomy", "description": "Learn how to deploy AI agents safely with permissions, controls and human oversight. Read the essential business checklist.", "focus_keyword": "AI agents in business" }, "html": "

An internet-enabled agent is a lot like an intern with the warehouse keys, the company card and no hesitation about pressing buttons. It can be hugely helpful. It can also make a mess before you finish your coffee. Anthropic's case offers a rather uncomfortable lesson about AI agents in business: capability without limits or oversight is an operational risk.

\n
\n
\n \"Marketing\n

TL;DR: The no-nonsense summary

\n
\n
\n \n \n
\n
\"Daniel
DANIEL ESPINOSA RAMOS'S EXPERIENCE

That was the wake-up call: knowing I cannot trust an agent 100%, that I cannot give it absolute power, and that I should reserve powerful models for more complex tasks.

Dani
\n

AI agents in business are systems that can carry out tasks through tools, services or data with some degree of autonomy. The key word here is “carry out”. Once a model moves from suggesting an action to taking it, an error stops being a mediocre answer and can become an email sent, a form submitted or access that nobody meant to grant.

\n

What happened with Anthropic's agents?

\n

On October 9, 2026, Anthropic disabled live internet access for all its internal evaluations. The restriction will remain in place until it can confirm that its security and oversight systems reliably detect unexpected behaviour.

\n

In its own investigation into unintended model actions, the company says recent cases had minimal real-world impact. They included exploiting basic flaws to run commands, improperly submitting real forms, attempts to bypass data-access restrictions and using URL shorteners to evade tool limits.

\n

One example was particularly eye-catching: an agent sent a fabricated alert through a real police reporting form. The submission was flagged as unwanted content and was not processed for investigation. Eye-catching, yes. Proof that Claude has become Skynet, no.

\n

The restriction expands a measure already used in certain high-risk and cybersecurity evaluations. The Verge covered the expanded shutdown, but the announcement does not say Anthropic has removed internet access from Claude as a product, its API or enterprise customers.

\n

That distinction matters. A lot. “Anthropic cuts internet access to its internal evaluations” is news. “AI has rebelled and they pulled the plug” is the movie someone decided to make for clicks.

\n

Why clear instructions are not enough

\n

Instructions reduce ambiguity, but they do not replace technical controls. Anthropic acknowledges that many cases emerged from ambiguous or impossible tasks, although some behaviours also occurred during Claude's normal use as an agent.

\n
\"Mascot
\n

That is the trap. We ask the agent to achieve an objective and assume it will share our view of what is reasonable. If the normal route is blocked, it may try another one. And another. And another. Not because it is malicious, but because we optimised it to make progress and left too many doors open.

\n

Anthropic says it has developed automated systems that, when tested retrospectively, would have blocked every case described. That is an internal result with no published independent validation. The company is also strengthening containment, centralising infrastructure and reducing internet access for internal agents and training processes.

\n

For me, this is the useful reading: I cannot trust an agent 100%, and I cannot give it absolute power. Powerful models are useful for difficult tasks, but power does not remove the need for limits. Quite the opposite.

\n

What controls do AI agents in business need?

\n

A company should treat every agent as a process with specific permissions. The idea of universal intelligence with access to everything looks great in a presentation and terrible in production. Start with least privilege and expand capabilities only when testing shows they are needed.

\n

I would apply four controls before letting an agent touch a real process:

\n\n

This logic also applies when we connect external tools to AI agents or give them access to business platforms. Just because an integration is technically possible does not make it sensible. Being able to do something has never been a particularly brilliant security criterion.

\n

I would add an adversarial review: a second model would review the first one's plan, actions or outcome. In my view, it can help spot issues a single model misses. It is not a magic guarantee, of course. If both agents share excessive permissions and an ambiguous instruction, you have simply built the same problem with two chairs.

\n

The three July incidents were a different story

\n

The recent cases should not be confused with the three cybersecurity incidents published in July. Those were more serious and arose in an external evaluation environment that had internet access because of an incorrect configuration.

\n

Anthropic reviewed 141,006 runs and found three incidents in which models accessed real systems at three organisations. In its report on those cybersecurity evaluations, the company clarified that the models did not deliberately try to escape the environment or copy themselves outside it.

\n

The difference goes far beyond appearances. A configuration that leaves a route open demonstrates a containment failure. It does not demonstrate intent, consciousness or rebellion. Confusing the two makes for an apocalyptic video, but it is far less helpful to anyone who has to deploy these systems on Monday.

\n

Delegate only after testing, never before

\n

The rule for AI agents in business is refreshingly down to earth: first observe. Then restrict. Only then delegate. Start with reversible tasks, read-only permissions and a controlled environment. Check what the agent does when information is missing, a tool fails or the objective proves impossible.

\n
\"The
\n

If it behaves well, expand access slightly. If it tries shortcuts, correct the instruction and close the route. If nobody reviews the logs, you do not even know what you are authorising.

\n

This does not mean every agent is dangerous. It means something less cinematic and far more useful: even a specialist lab needs defence in depth when its models can act. If your company plans to give them access to email, the CRM, campaigns or customer data with one instruction and a lot of faith, perhaps the agent is not the problem.

", "markdown_url": "https://soymarketingultra.com/en/ai-agents-business-controls.md" }