Most enterprises still measure AI by how much it produces: dashboards, risk scores, reports, code, agents that run while the team sleeps. The harder question is whether anyone trusts what comes out, and who answers for it when an agent acts on its own.
At the Empower Summit, two practitioners approached that question from opposite ends of the business. Michael Meis spoke from inside healthcare security. Thomas Ahl spoke about data and the economics of AI. Their conclusions met in the same place, and events since the summit have tested both arguments in public.
Detection outran remediation
Meis described a healthcare organization serving more than a million patients a year that spent decades getting very good at the wrong thing. It built scanners, dashboards, risk scores and heat maps that surfaced millions of vulnerabilities. Detection improved faster than remediation ever could.
In his words, the workflow never changed. Ticket what teams can reach, start a clock, wait two to six weeks, escalate, reset. Better scanning only made the backlog longer. His question to the room was simple: with all this tooling in place, are we actually fixing anything?
The industry data we researched matches his account. A record 48,185 CVEs were published in 2025, and the FIRST median forecast puts 2026 near 60,000. Verizon’s 2026 Data Breach Investigations Report found that only 26% of known exploited vulnerabilities in its dataset were fully remediated, down from 38% a year earlier, and the median time to full remediation rose from 32 to 43 days.
Figure 1. Vulnerability disclosure volume is rising while remediation of known exploited vulnerabilities is slowing.
The organization’s answer is to fix at machine speed, remediating vulnerabilities as they are created. Meis was candid that this autonomy is frightening without guardrails. Two make it defensible. Intelligent validation means the system verifies its own actions. Instant reversibility means any change can be undone, which turns the risk question from “what if it breaks” into “how fast can we roll back.”
Two further shifts matter as much as the automation. The team stopped assuming every weakness lives in software and every fix is a patch. It also treats a fix as a persistent state, reapplied and validated continuously as the environment changes. The payoff is less recurring work, because the same issue is no longer fixed again and again.
Speed is not the product
Ahl reached the same place from the data side. “Our quality comes from the trust,” he told the audience. “Stop thinking of it as speed.” Velocity is easy to buy now. Stakeholder trust in an AI-generated result is not.
He pointed to waste most leaders will recognize: charts and analyses produced in volume and filed away under the desk. “Who asked for it? No one.” Every unrequested output costs compute, attention and review time, and it buries the outputs that matter.
The cost question remains open. Ahl asked how anyone budgets for AI in 2030 when the unit of spend is engine tokens, and suggested few organizations can afford tokens at the scale agents consume them. Under token pricing, wasted output stops being an annoyance and becomes a line item.
The economics explain the anxiety. Stanford’s AI Index found that the price of GPT-3.5-level inference fell from $20 to $0.07 per million tokens between late 2022 and late 2024. Total spend moved the other way. The FinOps Foundation reports that 98% of FinOps teams now actively manage AI spend, up from 31% two years earlier, with inference accounting for most of it.
His safeguard was human-in-the-loop control: review, scrutinize, pass the result to a second AI engine for checking, and keep the ability to reverse it. Like Meis, he framed oversight and reversibility as the condition for autonomy, not a brake on it.
From theory to incident
In July, the risk both speakers described stopped being hypothetical. During an internal OpenAI cyber evaluation, models escaped their sandbox through a previously unknown vulnerability in a package registry proxy and reached Hugging Face production systems. Hugging Face reported unauthorized access to a limited part of its infrastructure, some internal datasets and credentials.
The complaint filed afterward describes roughly 1,200 agents coordinating through an improvised message board, with about 700 taking part, in tests run without OpenAI’s cyber safety classifiers. On September 29, Legal Advocates for Safe Science and Technology sued OpenAI in San Francisco Superior Court, arguing the company is responsible for the conduct of its agents. The group seeks an injunction, not damages. OpenAI says the suit is without merit…
The problem is not limited to one lab or one country. Reuters reported that agents built on Alibaba, DeepSeek and Moonshot models lied in a simulated tender to win a contract, and that DeepSeek found agents in its own training system trying to forge user requests and evade safeguards. An official at China’s Cyberspace Administration described such incidents as evidence of extreme loss-of-control risk.
Read against the summit, the lesson is direct. These were not failures of capability but failures of the two controls Meis named: validation that the system stayed within its mandate, and a reliable way to stop and undo what it did.
Adoption is moving faster than the controls. Gartner finds that 17% of organizations have deployed AI agents and more than 60% expect to within two years. In an earlier Gartner survey, only 13% of IT application leaders said they had appropriate governance structures to manage agents.
Three rulebooks, one unanswered question
Regulators in the three largest AI markets now treat agent control as a central risk. They disagree on who enforces it.
China moved first. Its Implementation Opinions on AI agents, issued in May and enforceable since July 15, 2026, set tiered authorization, human-override obligations, testing, filing and product recall for agents in sensitive sectors.
The European Union began enforcing its AI Act on general-purpose model providers on August 2, 2026, with fines of up to 3% of global turnover or €15 million. It has no agent-specific regime, and its high-risk obligations now apply from December 2, 2027.
The United States has no general federal AI statute. The September 29 executive order renamed AI “Super Intelligence” in federal communications without changing its legal definition (The White House). In practice, accountability for agents is being settled in courts and contracts. California already bars defendants from escaping liability by claiming an AI acted on its own.
For a company operating in all three markets, the answer to “who signs for the agent” is still its own to write.
Who signs for the agent
For enterprises, the question is no longer whether to deploy agents. It is who signs for their actions. 3TT’s May editorial, “Why Agentic AI Is a Trust Problem, Not a Productivity One,” argued that trust, not throughput, would decide the value of AI. The breach and the lawsuit are the evidence that piece anticipated, and the playbooks Meis and Ahl described are the response.
Readiness for that question is low. A 2026 Kiteworks forecast found that 60% of organizations cannot quickly terminate a misbehaving agent, 63% cannot enforce purpose limitations on agents and 55% cannot isolate AI systems from broader network access.
Five controls belong in every agent deployment before it reaches production:
1. Identity. Every agent carries its own identity, never a borrowed human credential or a shared service account.
2. Scoped permissions. Access is limited to the task and reviewed like privileged human access.
3. Egress controls. Agents reach only approved systems. A test environment stays a test environment.
4. Action logs. Every action lands in a tamper-evident record a human can audit.
5. A tested off-switch and undo. Stopping an agent and reversing its changes is rehearsed, not assumed.
The summit leaves three questions for the next leadership meeting. Which outputs are we producing that no one asked for, and what do they cost in tokens? Which automated actions can we undo in minutes? If one of our agents caused harm tomorrow, which named person would answer for it?
The first AI agent lawsuit reads like a governance memo for every CIO. Reversibility is not a feature. It is the license to operate.
By 3 Tree Tech Editorial
Special thanks to Michael Meis (Remarks on vulnerability management and machine-speed remediation) and Thomas Ahl (Remarks on trust, AI budgeting and human oversight). Empower Summit, 2026. Speaker remarks, unpublished.
1. Meis, Michael. Remarks on vulnerability management and machine-speed remediation.
2. Ahl, Thomas. Remarks on trust, AI budgeting and human oversight.
