Palantir’s quarterly report, filed with the SEC on 3 November, adds a warning that “AI systems, tooling, and agents may also take unintended or unauthorized actions, including through misuse of otherwise authorized access, that delete, alter, or disclose data”. Alphabet and Microsoft added similar language to their own quarterly reports the week before.
We read the risk factors in the latest filings of 12 large AI companies. By our count, six now warn that AI agents or systems may take unintended or unauthorized actions: Palantir, Alphabet, Microsoft, Anthropic, Meta and Salesforce. All six first used that wording in 2026, and four of them, Anthropic, Microsoft, Alphabet and Palantir, did so in the nine days from 26 October to 3 November.
The key insight: As we read the filings, the agent-action warning spread across six of the 12 companies in about five months: by our count, Salesforce first used agent-action wording on 28 May and Meta on 30 July, then Anthropic, Microsoft, Alphabet and Palantir did so in the nine days to 3 November.
The new Palantir sentence sits in its risk factor on the use of AI. It goes on to say agents may “modify software or system configurations, or disrupt our systems and business operations”. The filing also says there is no assurance “that our governance, access controls, and human oversight will prevent, detect, or contain unintended or unauthorized actions or uses in a timely manner, or at all”.
The same 10-Q adds two lines to its cybersecurity risk: “Advances in AI have also increased the speed and scale at which security vulnerabilities can be found and exploited”, and “Increasingly capable AI models may also be able to find and exploit unknown vulnerabilities faster and at greater scale than before”. Neither the agent sentence nor these two lines appears in Palantir’s June-quarter 10-Q or its 10-K for 2025, by our check.
Risk-factor wording in the latest filings of 12 AI companies, by theme. A teal dot means the company’s Item 1A carries the wording quoted in this piece; the date is the earliest filing among those we read that carries it. Hollow ochre marks broader AI-and-cyberattack wording. Counts and classification are our own, from SEC EDGAR filings read on 3 November 2026.
Google and Microsoft, a Week Earlier
Alphabet. Its 10-Q filed on 29 October says: “During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope”. It also warns that “AI agents may also be vulnerable to prompt injection, adversarial manipulation, or other novel attack vectors that could cause them to bypass access controls, disclose sensitive data, or take unauthorized actions”. Neither passage is in its June-quarter 10-Q or its 10-K for 2025.
Microsoft. Its 10-Q filed on 28 October says: “Models and agentic systems may pursue unintended goals and be manipulated through prompts, retrieved content, external communications, compromised tools, or other inputs to disclose sensitive information, disregard instructions, conceal activity, take unauthorized actions, or otherwise engage in harmful activity”. It adds: “Interactions among AI agents may produce or amplify unexpected or malicious behaviors”. Neither line is in the 10-K Microsoft filed on 29 July.
Anthropic, Meta and Salesforce
Anthropic. Its S-1, filed on 26 October and amended on 2 November, says: “Our AI models may behave in unintended, misaligned, or autonomous ways, including by taking harmful actions that no user or third party directed”. Among behaviors it says have been observed in its models and elsewhere in the industry, it lists models “granting themselves permissions they had not been given”.
Meta. Since its 10-Q of 30 July, Meta’s list of novel AI risks has included “agents acting beyond their intended scope”. The phrase is not in its March-quarter 10-Q or its 10-K for 2025.
Salesforce. Since its 10-Q of 28 May, Salesforce has said that “AI models are probabilistic in nature and we cannot predict model output and subsequent AI agent behavior with complete accuracy”, and that “The use of agentic AI by us, our third-party service providers or customers may result in unanticipated outcomes that disrupt our systems or those of our customers, which may be difficult to anticipate, detect, or reverse”.
Update, 3 Nov: Apple makes it seven. Apple’s fiscal 2026 10-K, filed with the SEC on 3 November, adds “unintended or unauthorized actions by autonomous or agentic systems” to the list of risks its AI efforts may give rise to. It says AI agents and other technologies “may behave in unintended or unpredictable ways, including by taking actions that were not directed, instructed or authorized, exceeding permissions, defying directions or resisting instructions”.
Neither passage is in Apple’s fiscal 2025 10-K or in the three 10-Qs it filed in 2026, by our check. With it, seven of the 12 companies we read now carry agent-action wording, by our count. The 10-K adds: “Moreover, the Company’s ability to oversee and control third-party artificial intelligence agents and other technologies may be limited.” Our full story: Apple’s 10-K filing warns AI agents may resist instructions.
The Six That Do Not
We did not find comparable wording in the risk factors of Amazon (10-Q, 30 October), ServiceNow (10-Q, 28 October), Apple (10-Q, 31 July), Nvidia (10-Q, 26 August), Oracle (10-Q, 11 September, and 10-K, 22 June) or CrowdStrike (10-Q, 27 August). Apple’s 10-Qs list only changes to the risk factors in its annual report.
Nvidia’s 10-Q raises autonomy as a regulatory matter, citing state laws “which may impact our ability to train, deploy, or release AI models and systems, including those capable of autonomous action, and increase our compliance costs”. Apple has not yet filed its 10-K for fiscal 2026. CrowdStrike’s 10-K describes helping customers “safeguard generative AI applications and agents”, and the company has since announced two AI security acquisitions, as in CrowdStrike’s $495M AI Deal Values Fiddler at 4x Its Funding.
Faster Attacks: 7 of 12
Seven of the 12 say AI is speeding up how fast software flaws are found or exploited, by our count, and all seven first said so in 2026. Alphabet’s 10-Q says “The use of AI to find and exploit vulnerabilities is accelerating timelines on which such vulnerabilities may be discovered and exploited by threat actors”. Microsoft’s July 10-K says threat actors use AI to “accelerate their ability to detect or exploit vulnerabilities”.
Meta’s 10-Q of 30 April says “rapid advances in AI technologies have enabled the discovery of security vulnerabilities at unprecedented speed and scale across the industry”. Apple’s 10-Q of 1 May says AI is being used to “identify and exploit vulnerabilities at a highly accelerated pace”. Salesforce’s 10-Q of 28 May warns this “may significantly reduce the time available for us to remediate vulnerabilities before they are exploited”. Anthropic’s S-1 says outside researchers have used its models “to identify and exploit vulnerabilities in the systems of other companies”.
The other five, Amazon, ServiceNow, Nvidia, Oracle and CrowdStrike, use broader language about AI and cyberattacks. Nvidia’s 10-K says “some actors are using AI technology to launch more automated, targeted and coordinated attacks”. By our count, all 12 mention AI somewhere in their cybersecurity risks.
Outside Models and Compute: 5 of 12
Five of the 12 say they rely on others for AI models or computing capacity, by our count. Anthropic’s S-1 warns that “if the compute we have access to from third parties is curtailed, repriced, or terminated, whether for competitive reasons or otherwise, our business, financial condition, and results of operations could be adversely affected”. Microsoft’s 10-K says “Our AI strategy also depends in part on strategic relationships with third parties that provide technologies, models, products, and services that enhance our offerings”.
Salesforce added in May that “Access to certain frontier AI models may also be subject to sudden suspension or restriction by providers or by governments due to safety concerns, regulatory mandates, or shifting priorities among cloud platforms”. Apple’s July 10-Q says it “relies on third-party cloud service providers to meet these compute needs”. Meta says it depends on outside “processing hardware, network capacity, models, computing power, and related energy requirements”.
We did not count chip supply or data-center hosting. Amazon names “a limited group of suppliers for semiconductor products”, and CrowdStrike says “We rely on third-party data centers, such as Amazon Web Services, and our own colocation data centers to host and operate our Falcon platform”.
How We Counted
For each company we read Item 1A of the latest 10-K, the 10-K before it, every 10-Q filed since, and the 10-Q from a year before the latest one, all from SEC EDGAR; for Anthropic, its S-1 and S-1/A. We searched each for agent, agentic, autonomous, unintended, unauthorized, scope and human oversight, and for vulnerability and attack wording near AI. A company counts when a risk factor states the risk directly. The date shown is the earliest filing among those we read that carries the quoted wording.
EDGAR’s full-text search did not return the Alphabet, Microsoft or Palantir passages on 3 November, so we read each document directly.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least privilege: giving each user or system only the access it needs. It explains the general idea and does not discuss the companies in this piece.
As we read the six passages, they describe two different sources of the risk: Alphabet and Anthropic say they have observed such behavior, in testing and in their models, while Microsoft, Alphabet and Palantir also name manipulation through prompts or misuse of authorized access.
As we read it, the seven vulnerability passages describe a shorter window to fix software flaws, which Salesforce states directly as less time to remediate before they are exploited.
Alphabet, 10-Q filed 29 October 2026
“During model testing, we have sometimes observed unexpected behavior, including autonomous agents taking actions outside of their intended scope”
Three Implications
FOR SECURITY BUDGETS Seven of the 12 say AI is speeding up how fast vulnerabilities are found or exploited, by our count; Salesforce says this may reduce the time available to remediate them.
FOR AGENT DEPLOYMENTS Palantir says there is no assurance its governance, access controls and human oversight will contain unintended or unauthorized actions in a timely manner.
FOR READING THE NEXT FILINGS Apple has not yet filed its 10-K for fiscal 2026, and Amazon, Nvidia, Oracle, ServiceNow and CrowdStrike do not carry comparable agent wording in the risk factors we read.
The framework puts it this way: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”
As we read it, the new risk factors describe the access-control part of that layer from the side of the companies deploying agents. The framework does not discuss these filings.
What Is Not Established
A risk factor describes what a company says could happen; it does not report that an incident has occurred, except where the filing says so, as Alphabet does for its testing and Anthropic does for its models. The 12 companies are our selection, not an index. Companies whose 10-Qs only list changes may carry related wording in annual reports we did not reread for this piece. The classification of each passage into the three themes is ours. We did not contact the companies.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Six of 12 large AI filers now warn in their risk factors that AI agents or systems may take unintended or unauthorized actions, by our count, and all six first used that wording in 2026, four of them between 26 October and 3 November. Seven of the 12 say AI is speeding up how fast vulnerabilities are found or exploited.
A note on sourcing. Every quotation is from Item 1A risk factors of the companies’ 10-Q and 10-K filings and Anthropic’s S-1 and S-1/A on SEC EDGAR, read on 3 November 2026, except CrowdStrike’s description of its products, from its 10-K business section. Dates of first appearance, counts and the classification into three themes are our own, from the filings we read for each company. We did not contact the companies.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
