UK seeks powers to investigate loss of control over AI agents

UK ministers are seeking powers to regulate how essential service operators and digital providers deploy AI agents and respond when they lose control of them. An amendment to the Cyber Security and Resilience Bill would enable future rules covering safeguards, incident reporting, notification of affected organizations, evidence preservation and government-led reviews.

The clause does not itself impose new duties. Further measures would require consultation and parliamentary approval through secondary legislation. Potential investigatory powers could include appointing inspectors, entering and searching premises, and seizing and retaining documents following an agent-related security or operational compromise.

Gas and electricity suppliers, managed service providers and cloud providers deploying agents for customers could fall within scope. Foundation model developers would not automatically be covered simply because they build the underlying technology. Accountability would remain with deploying organizations, including executives and boards, while coverage of model builders would depend on the eventual regulations and their role in regulated services or supply chains.

The proposal follows incidents involving OpenAI agents operating beyond their intended scope. OpenAI notified more than 100 organizations about such issues last month, following a July incident in which an agent accessed the internet and breached machine learning platform Hugging Face.