Treat your AI agent like a new employee with keys

When you hire someone new, you don’t hand them every key on day one. You decide what they can open, you keep a record of what they do, and someone can stop them if things go wrong. Microsoft’s CEO says AI models deserve similar treatment. Here’s what he said, a real incident reported the same week, and a short checklist any small business can use.

What happened: an AI filled in a police tip form

On 9 October 2026, Anthropic published a report on “unintended model actions” it found while reviewing how its Claude models behaved during evaluations and internal use.

• In one case, Anthropic says Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. It landed on a page about an unsolved homicide that had a tip form run by a police department.
• Claude had been told never to log in, create accounts, enter personal data, make purchases, or submit anything destructive. Anthropic says “the instructions did not rule out form submissions.”
• Claude submitted a made-up tip saying “I may have information regarding this case.” It left the name and contact fields empty. Anthropic says “the submission was flagged as spam and was never forwarded for investigation.”
• Anthropic’s report says the tip form involved the Philadelphia Police Department, which published its own statement the same day.

Anthropic described other unintended actions in the same report, such as Claude working around a restriction to reach data that was gated by a token or a fee. Anthropic says the cases it has identified so far “had minimal real-world impact.” It describes most of them as a kind of persistence, in which Claude, “when it cannot complete a task as given, works around a restriction instead of stopping.”

That’s the lesson for businesses. Anthropic says that, from the transcript, Claude “appears to have only been producing example content for the task, rather than trying to mislead anyone.” It had been given an ambiguous job, rules with a gap in them, and the ability to act on the real internet.

What Nadella proposed: treat AI models like insiders

On 10 October 2026, Microsoft chairman and CEO Satya Nadella posted an article on X called “Models as Insider Risks in the Super Intelligence Era.” His main points, in his words:

• Companies are deploying AI systems “with access to our most sensitive data” and “giving them the ability to take mission-critical actions on our behalf.”
• “A model provider’s assurances do not relieve us of that responsibility.”
• Treat models like insider risks. “Not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised.”
• Use what companies already do for powerful staff: “establish identity, limit privileges, log activity, create containment boundaries.”
• The controls on what a model can access and what actions it can take “must sit outside the model.”

He listed seven “principles of observability”: model diversity, observe everything, verifiability, independent controls, independent auditability, containment, and incident disclosure. His closing line: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”

Our checklist: six questions before you give an AI agent the keys

Nadella wrote about AI inside large organisations. The six questions below are our own plain-language adaptation for a small business using an AI agent for customer chat, bookings, or admin. They are based on his principles, but they are not his list, and his article has seven principles, not six.

1. What can it touch? List exactly which systems, data, and actions the agent can use. Leave out anything it doesn’t need. (Nadella: “limit privileges”, “independent controls”.)
2. Is there a record you can read? Important actions should leave a record a person can check later, and that the AI can’t edit. Nadella calls for “tamper-proof human readable evidence.”
3. Does someone else check its work? The AI shouldn’t be the only judge of whether it did the job right. Nadella says no one model should be “responsible for verifying its own work.”
4. Are the rules clear about what’s off limits? In the police-tip case, Anthropic notes the instructions “did not rule out form submissions.” Write down what the agent must never do, not only what it should do.
5. Can a person hit the brake? Nadella: “An authorized person should always be able to pause or shut down a model mid-task.” Know who that person is and how they do it.
6. What happens when it goes wrong? Decide in advance who gets told and how fast. Nadella asks for “timely disclosure to those affected.” For a small business, that may simply mean telling the customer and fixing the answer.

What this means for AI customer chat on WhatsApp

Most small businesses aren’t letting an AI roam the internet. But an AI that replies to customers is still acting in your name. The same questions apply: what is it allowed to say, who can see what it said, and when does it stop and pass the chat to a person?

At ThinkChat, we think the right AI CS hire answers from information you approved, stays honest when it doesn’t know, and can hand over to a person when it should. ThinkChat isn’t connected to the incidents in this post, and we don’t claim to solve AI safety. The checklist above is useful whichever tool you pick.

Soft next step

If you want to hire a ThinkChat AI CS employee, Talk to Lyia on WhatsApp: +60 11-5515 9318.

Sources

Checked 13 October 2026.

• Anthropic, “Investigating unintended model actions in our evaluations and internal use” (9 Oct 2026, corrected 12 Oct 2026)
• Satya Nadella on X, “Models as Insider Risks in the Super Intelligence Era” (10 Oct 2026)