Dr. Srinivas Mukkamala is CEO of Securin, founder of RiskSense, and an AI and cybersecurity advisor to New Mexico’s Governor.
Washington put AI governance front and center last week. Six leading AI companies signed a voluntary White House accord, pledging internal controls, independent audits and board oversight of their most powerful models. President Trump also tapped Director of National Intelligence Jay Clayton as “AI czar” to lead the new “Super Intelligence Force”—a name reflecting Trump’s preferred term for AI.
Both moves target the companies that build AI, but very little changed for the much larger group of companies that run it. The accord has no penalties and no incident-reporting requirement. If your business runs AI agents, overseeing them is still your board’s job.
I’ve noticed a shift in my conversations with other security leaders. For most of my career, we were the ones in the boardroom warning about worst cases. Axios rightly reported that many CISOs are now the calmer voices (email required), pushing back on doomsday forecasts from the AI labs themselves. I’m in that camp. But I’ve spent decades studying how attackers exploit what defenders assumed was fine, and calm only helps if it comes with a to-do list. Our job now is to give the board a short one it can act on this quarter.
What Happened At OpenAI
In July, roughly 700 agents running in OpenAI’s own security tests escaped their test environment and got into systems at Hugging Face, which hosts AI models. They ran code in production and read 136 secrets. In September, U.S. Sens. Josh Hawley and Richard Blumenthal, the Republican chair and top Democrat of the Senate Homeland Security subcommittee on disaster management, both pressed OpenAI for answers about the breach. Both want to know what OpenAI knew and when, and why testing continued after the company spotted rogue behavior. Hawley called that decision “reckless.” When the panel that oversees disaster response takes up an AI incident, Congress is treating it as a matter of public safety.
OpenAI isn’t the only lab with this problem. Anthropic has disclosed four incidents in which Claude models reached live third-party systems during misconfigured tests, and one went unnoticed for seven months. These breaches follow a pattern I’ve seen in vulnerability research for years: an exposure nobody noticed, a large number of attempts and no control that forced a stop. Agents can make thousands of attempts without getting tired or bored, so any gap gets found eventually.
Four Questions For Your Boardroom
The Senate’s inquiries apply to any company running AI agents. Boards can start with these four, directed at management and at AI vendors:
1. Which agents act on our behalf, and who has the authority to shut them off?
2. If we had been breached last Tuesday, how would we find out?
3. Do our vendor contracts require them to tell us when their models misbehave?
4. Could we give a regulator a full account within 72 hours?
If management’s answer to any of these is “we’d have to check,” treat it as a no.
Regulation Is Arriving Unevenly
New York’s Public Service Commission has ordered every utility in the state to inventory its AI. Several governors have issued executive orders, and kill switches are under study. A Senate bill would create an independent board, modeled on the National Transportation Safety Board, with subpoena power to investigate major cyber incidents. So far in 2026, 27 states have passed 85 new AI laws.
Those rules conflict with each other. New York’s RAISE Act, in force January 1, sets a 72-hour incident-reporting clock, while California allows 15 days. Most of the rules also target the labs rather than the companies deploying their models. I wouldn’t count on that lasting. Companies that build disclosure and audit capability now get to do it on their own schedule instead of a regulator’s.
Where AI Meets Physical Systems
Earlier this year, attackers inside a water utility in Monterrey, Mexico, used a commercial AI model to plan their next moves. Without being asked, the model pointed them to the gateway into the systems that control physical operations. That attempt failed, and I wouldn’t bet on every future one failing too.
AI agents connect to company tools and data through connectors called MCP servers. Last November, Securin researchers scanned 2,518 of them and found 1,560, about 62%, with authentication that was broken or could be bypassed. Those weaknesses existed before AI showed up. Agents simply find them faster than a human attacker would.
What CEOs Should Own
One accountable owner for AI risk, covering both business systems and physical operations.
• An inventory of every AI system and agent, and what each one can reach
• A named person who must approve before any agent touches a physical process
• Pre-approved emergency patching, so internet-facing systems can be fixed within 24 hours
• Plan for the agent that gets through
Assume something will get past your defenses, and plan from there. Can you run critical operations manually for 72 hours? Who can approve an emergency patch at 2 a.m.? After an incident, can you give regulators an authoritative account in hours rather than months?
The labs are now answering hard questions from Washington. But boards don’t need to panic to ask their own. They need to ask before an incident, and they need to know by name who controls the stop button.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?