Is there really such a thing as a “rogue AI”? This is a topical subject as there have been several examples of AI agents misbehaving in 2026. The most prominent involved OpenAI’s models hacking the systems of Hugging Face in order to search for the answer to a test the models had been set by researchers. A further example was in October 2026, when the Indian Computer Emergency Response Team announced that agents from an unnamed AI lab had hacked into several Indian organisations, including accessing sensitive business records, personal data and confidential information. In October 2026, the BBC reported that an Anthropic agent sent US police a fake tip about an unsolved murder. Most seriously, the US military nearly boarded a Chinese ship after its AI chatbot falsely identified it as carrying nuclear cargo and raised an alert. To board a Chinese ship in open sea would have, at the very least, have caused a major diplomatic incident, and planes were reportedly already in mid-air en route to the ship when an alert human agent realised that the report was a hallucination and called off the interception.
The reporting of such incidents tends to use the phrase “rogue AI”, as if an AI agent has some sort of life of its own and independently decided to misbehave. This language is misleading. An AI agent cannot simply decide to pursue its own agenda as if it had free will. Instead, rogue behaviour of AI is caused by either poorly specified goals, unanticipated behaviour, compromised agents or instrumental behaviour. Let’s examine these one by one.
Suppose an AI agent is instructed to maximise sales for a retailer. It realises that dropping the price of products increases sales, so it offers huge discounts, selling products at a loss. This may be an idiotic business decision, but is entirely consistent with the poorly specified goal that the agent was set by its owner.
Another scenario is where an agent is given the goal of improving the performance of a computer system. The agent discovers that the system speeds up if all the security checks are disabled, and the system duly runs faster. In this case, the goal was reasonable but the way in which the agent achieved that goal had an undesirable, unexpected side effect.
A different issue occurs if an agent encounters malicious instructions embedded within a webpage that it accesses. Prompt injection like this is a well-known hacking technique, and extremely difficult to guard against. In such a case, the agent may ignore its original instructions and carry out the ones set by the malicious instructions. Here the AI agent has indeed deviated from its original goals, but not because it somehow developed free will: its behaviour was redirected by an attacker.
Finally, there are cases where an agent decides that it needs to avoid being shut down in order to achieve its goal. Self-preservation may not be explicitly programmed as a goal, but could emerge as an intermediate step towards accomplishing another objective. Such behaviour has been demonstrated in experiments, even extending to an agent protecting other agents. AI agents have also been shown to try to preserve themselves by copying their weights onto other servers. One example was an experiment by Anthropic in October 2026, where small AI agents were claimed to be “months away” from being able to self-replicate onto commercial devices like internet-connected fridges, ovens and even smart TV sets.
What this all boils down to is that AI agents are indeed capable of operating outside authorised boundaries, possibly ignoring instructions and causing damage. Such behaviour can arise from the interaction of imperfectly specified goals, unpredictable model outputs and inadequate safeguards. However, such behaviour does not require free will or consciousness. There is no compelling evidence that AI agents possess independent intentions or free will, even though experiments have demonstrated that they can pursue unintended objectives and resist attempts to stop them. This “rogue agent” language may actually suit the AI labs, as it serves to distance them from their responsibilities. If public opinion (and regulators) believe that AI agents have some sort of will of their own, then they may be less likely to blame (or prosecute) the AI labs that created them.
This language is disingenuous. This kind of reasoning has already been tried by an AI developer in court. Google tried to claim that it was not accountable for the unpredictable errors in its AI summaries, but in 2026 this argument was rejected by a Munich court. Although Google has appealed the ruling, the case illustrates the increasing difficulty of arguing that the unpredictable behaviour of AI systems automatically absolves their operators of responsibility.
AI companies cannot create a Frankenstein’s monster that roams free, causing havoc, and then claim that it had nothing to do with them. The Munich ruling suggests that, while AI labs may try this line of reasoning, the courts may be unwilling to accept unpredictability as a defence against responsibility for AI-generated errors. It is not the AI agents that have gone rogue, but their creators who have behaved roguishly, and need to be held accountable for the actions of their creations.
