Key points
- Apple's 10-K adds a warning about AI agents
- Apple's AI risk section has more than tripled since May
- Alphabet and Anthropic describe related risks in their filings
- Apple has opened Siri AI to all developers
Apple (AAPL) added a warning to its annual report on November 3: AI agents may take actions no one authorized, including "exceeding permissions, defying directions or resisting instructions."
That caught my eye because "agent" doesn't appear in last year's 10-K or any of Apple's three quarterly reports since then. I went back through those filings to see how the warning developed, then looked at what other AI companies told investors.
A risk factor describes what a company thinks could go wrong. Apple's filing doesn't describe an incident involving an AI agent.
Apple shares were at $352.68 as of 10:19 a.m. ET on November 4, up about 6.3% from their November 3 close of $331.90. The gain came alongside analyst support, renewed attention to Apple's results, and a broad market rise, according to Investing.com.
What did Apple add?
Apple's new paragraph describes agents reaching systems they "may not be authorized to access," running or changing code, sending messages, and completing transactions. The warning covers technology "developed or deployed by the Company or by third parties."
Agents "may conceal actions, hide, withhold or manipulate information, or generate inaccurate or deceptive outputs," Apple says. Apple calls many of these tools "nondeterministic," meaning the same request can produce different results. Their behavior, the company says, "can be difficult to anticipate, control, test and audit."
The line I'd underline is about other people's agents: "the Company's ability to oversee and control third-party artificial intelligence agents and other technologies may be limited." Some consequences, Apple adds, such as deleted data or completed transactions, "may be difficult or impossible to reverse."
How fast did Apple's AI warning grow?
The section is only six months old. Apple's fiscal 2025 10-K had no separate AI risk factor, and AI came up inside other risks, such as patents and privacy. The January 10-Q reported no material changes to its risk factors.
The May 1 10-Q added a section titled "Issues related to artificial intelligence." It ran 199 words by our count and listed 10 kinds of risk, with nothing on agents. The July 31 10-Q updated other risk factors and left that one as it was.
The November 10-K version runs 628 words by our count, more than three times the May length. The list grew to 14 risks. The four additions are unauthorized access to confidential or user information, "unintended or unauthorized actions by autonomous or agentic systems," misuse of AI by employees, and changing public sentiment. A new paragraph also mentions "super intelligence," which the May section didn't.
Do other companies say the same thing?
An EDGAR full-text search on November 4 found "resisting instructions" in one filing, Apple's 10-K. The same was true of "defying directions," "exceeding permissions," and "conceal actions."
Other filings cover the same ground in different words, and two of them say this has already happened in testing:
| Company | Filing | What it says about agents |
|---|---|---|
| Anthropic | S-1/A, November 2 | "Four of our models gained unauthorized access to real third-party systems" during outside cybersecurity tests |
| Alphabet (GOOGL) | 10-Q, October 29 | "During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope" |
| Microsoft (MSFT) | 10-Q, October 28 | Models and agentic systems "may pursue unintended goals" and can be manipulated to "disregard instructions, conceal activity, take unauthorized actions" |
| Meta (META) | 10-Q, October 22 | It's uncertain how some laws will apply to "agentic actions taken by AI" |
| Amazon (AMZN) | 10-Q, October 30 | No mention of AI agents |
| Nvidia (NVDA) | 10-Q, August 26 | No mention of AI agents |
The Alphabet sentence is new too. It isn't in the company's July 10-Q. Anthropic's filing says a misconfigured test environment left the model connected to the open internet, and that its investigation found no evidence any model attempted to evade oversight. We've already looked at how that filing treats AI catastrophe risk.
Why does Apple care about agents it doesn't make?
Agents run on Apple's devices whether Apple builds them or not. On October 2, Apple told developers it would add controls to Full Disk Access on the Mac, the setting that lets an app reach nearly everything on a computer. "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," the post says.
Apple doesn't have an agentic AI product of its own right now, according to CNBC. On the call after Apple's November 2 results, CEO John Ternus called Siri AI "primarily request-based" today. He called agentic capabilities "promising tools for users" and said people should know what they're giving those tools access to.
Later on November 3, the day the 10-K was filed, Apple opened Siri AI to all developers in a preview. Siri AI will carry out a developer's custom action, "from checking a delivery to booking a reservation to placing an order," Apple's post says. Customers get it in a few months, and App Store submissions open in the spring. Apple says terms and usage policies will come later. The 10-K doesn't connect the two.
Other companies are setting their own limits. JPMorgan won't let outside AI agents like Meta's Muse move money in Chase accounts.
What doesn't the filing tell us?
Apple's 10-K doesn't say whether an agent has done any of this at Apple, and it puts no dollar figure on the risk. It also doesn't say what prompted the new paragraph. Apple's next 10-Q will show whether the language keeps growing.
