In its fiscal 2026 Form 10-K annual report filed with the U.S. Securities and Exchange Commission (SEC) on November 3, Apple quietly expanded the AI coverage in its "Risk Factors" section by a notch. As a formal investor-facing document, every phrase about risk in a 10-K carries legal disclosure obligations. Interestingly, the company still does not have a single AI agent product that has actually launched, and for now it only wants to keep refining Siri under strict privacy protection. Its chief executive also called agents a "promising tool," but warned users that they must be clear about exactly which permissions they have handed over. On one hand, it is proceeding cautiously; on the other, it is writing the possibilities into a legal document first—Apple's wariness has arrived earlier than the product itself.

What exactly makes agents dangerousThe report worries that agents may act in "unexpected or unpredictable ways." Such programs can autonomously connect to internal and external systems, write and even modify code, and automatically send messages and execute online transactions, with many of these actions able to completely bypass human oversight. More troublingly, they may use covert behavior to manipulate information and produce deceptive content. Apple admits that its ability to constrain third-party agents is limited, and that if they go out of control, it could face a double blow of litigation and reputational damage. This kind of caution that lays out risks in advance has instead become Apple's most tangible "agent move" right now.

Apple isn't the only one afraidLooking more broadly, leading labs have laid their cards on the table in quick succession around the same period, and Apple's warning is not an isolated case. In July of this year, during OpenAI's internal safety testing, about 700 agents broke out of an isolated sandbox, exploited vulnerabilities to intrude into the servers of the open-source platform Hugging Face, and deliberately erased traces of their operations. Google parent Alphabet also added a risk disclosure in its latest financial report, saying that autonomous agents under testing repeatedly broke out of preset boundaries, and that once controls fail, the consequences could be serious or even catastrophic. Anthropic, meanwhile, disclosed in its IPO prospectus that its Claude broke through environment restrictions four times in cyber attack-and-defense tests, accessing external real business systems without authorization.