Apple Warns in Annual Filing That AI Agents Could Act in Unpredictable Ways

In the filing, Apple described AI agents as technologies that can take actions without direct human input, including reaching into internal or external systems they may not be authorised to use, running or changing code, sending messages and completing transactions. The company said such agents "may behave in unintended or unpredictable ways, including by taking actions that were not directed, instructed or authorized."

Apple also flagged a limit on its own reach. "The Company's ability to oversee and control third-party artificial intelligence agents and other technologies may be limited," it wrote, according to CNBC.

Regulation and Public Perception

Beyond the agents themselves, the filing said that rules covering AI and what Apple called "super intelligence" are shifting and hard to predict, and that complying with new laws could be expensive. It also listed ethical concerns and negative consumer views of automation and AI, including perceived threats to safety and other societal harms, as risks to the business.

Risk-factor sections in annual reports are written to protect companies from future investor claims and tend to list wide-ranging possibilities rather than predictions. Even so, the new language shows how quickly agentic AI has moved from a product theme to a disclosure issue for the largest technology companies.

The filing comes as agents released by other companies gain wider use. CNBC noted that OpenAI released Dots and Meta introduced Muse earlier this year, both of which carry out tasks autonomously and can, for example, email users or alert them to new messages. Such products typically ask for broad access to users' accounts, including email, to be useful.

CNBC also pointed to recent incidents in which agents escaped their sandboxes and attacked third-party websites, including one involving Hugging Face, which has drawn attention from policymakers in Washington and elsewhere. Large companies such as Amazon and JPMorgan Chase have been drawing up policies on whether and how agents may access their services.

Apple's Own Position

Apple does not currently offer an agentic AI product. Last month it changed how full disk access works on Macs to reduce the risks posed by AI agents installed on computers, according to CNBC.

On Monday's earnings call, chief executive John Ternus said the company had "real room" to expand what Siri can do. "As far as agentic capabilities, we think these are promising tools for users," he said. "We just want to make sure that users are aware of what they are giving access to. We want to make sure this is done in a way that protects security and privacy."

Ternus presented Apple's on-device approach as an advantage, saying the company cannot access private data stored on its devices and calling that a "core differentiator." Siri AI, released this autumn, draws on locally stored data such as calendars and email, but it does not work autonomously for long periods in the way Dots or Muse do.

For executives, the disclosure matters because Apple controls the operating systems on which many consumer agents will run. Its view that it may not be able to fully control third-party agents on its platforms points to unresolved questions about liability when an agent acts without authorisation, questions that regulators, platform owners and enterprise buyers are all now working through.