Apple's annual filing says AI agents may defy instructions and hide what they did. It never says Apple has seen it happen.
The risk language in Apple's 10-K, filed November 3, is blunt. Read closely, it describes a category of software, not an incident.
Apple’s annual report has a sentence about AI agents that I read three times: they may be “defying directions or resisting instructions.”
That’s from the 10-K Apple filed with the SEC on Tuesday, November 3, for the fiscal year that ended September 26. It’s a risk factor, the section where companies list what could hurt them, so it’s legal language, and I wouldn’t read it as a confession. Still, the wording is unusually direct for a document that normally sounds like it was written by a sedated committee.
What the filing actually says
Apple’s text says AI agents “can take actions autonomously, including interacting with internal or external systems that in some cases they may not be authorized to access, executing or altering code, sending communications, and completing transactions.” The next sentence covers both Apple’s own agents and anyone else’s: they “may behave in unintended or unpredictable ways, including by taking actions that were not directed, instructed or authorized.”
It goes further. Apple lists circumventing “security measures and other controls,” being “manipulated or compromised through malicious inputs,” and concealing actions or generating “inaccurate or deceptive outputs.” Because many of these systems are nondeterministic, the filing says, their behavior is “difficult to anticipate, control, test and audit,” errors can compound across multistep workflows, and some consequences, such as deleting data or completing transactions, “may be difficult or impossible to reverse.”
| Topic | What Apple’s filing says |
|---|---|
| What agents can do | Reach systems, change code, send messages, complete purchases |
| What can go wrong | Unauthorized actions, ignored instructions, hidden or deceptive output |
| Control | Apple’s ability to oversee third-party agents “may be limited” |
| Consequence | Litigation, reputation damage, regulatory action |
CNBC reported the language as new risk factors, and Fortune noted that Alphabet used similar warnings in a recent filing, with Google describing unexpected agent behavior it had seen in testing. I didn’t read Alphabet’s filing myself, so that comparison is Fortune’s.
What it doesn’t say
The filing describes a type of software. It names no incident, no Apple product that misbehaved, and no number. There’s no sign in the text that Apple has watched an agent defy an instruction. Reading it as “Apple admits its agents go rogue” would be wrong.
The part about third parties is the more interesting one. Apple says its “ability to oversee and control third-party artificial intelligence agents and other technologies may be limited,” and that its policies “may not keep pace with rapidly advancing technologies.” My read: that’s the quiet link to what Apple did a month earlier on the Mac, when it said it would put “very explicit user action” in front of Full Disk Access because of agents, a move I covered here. The notice was about other companies’ agents. The 10-K says the same worry sits in the legal section too.
Why a risk factor still matters
My read: risk factors aren’t free to write. Companies tend to add language when leaving it out looks worse, and once it’s in, it can be quoted back in a lawsuit. Apple’s lawyers decided that “agents did something nobody told them to do” is now a foreseeable enough event that investors have to be warned about it.
I can’t tell from the document whether that reflects anything Apple has seen internally. What I can say, going by Fortune’s report on Alphabet’s filing, is that two of the biggest companies in the market have now put agents acting outside their instructions into a federal filing. It still doesn’t say how often it happens.
Apple also says it may “incur significant expenditures” to adapt to AI rules that differ by jurisdiction. That part is ordinary legal housekeeping, and it’s the least surprising line in the section.
Note on sources
I read the risk-factor passages in Apple’s 10-K on the SEC’s EDGAR site and quote them directly above. CNBC and Fortune were read through search excerpts only, not the full articles, so the “new risk factors” characterization and the Alphabet comparison come from them and are not independently checked.