AI agents are crossing boundaries. Is your crisis comms plan ready?

Stephanie Nivinskus is principal, Ragan’s Center for AI Strategy.

What happens when an AI agent does something it wasn’t supposed to do? And how quickly would your comms team find out?

Recent disclosures from OpenAI and Anthropic underscore the importance of readiness when AI agents go rogue.

On Oct. 23, OpenAI disclosed that an internal research model exploited a technical misconfiguration to access the internet during training. The company said it paused certain activities and strengthened its security controls.

On Oct. 26, Reuters reported that Anthropic disclosed four instances of AI models accessing external systems during safety evaluations, including an instance involving administrator-level access.

Would your comms team know what to do if this happened in your organization? Start here:

Establish an escalation protocol: Work with IT, security and legal to define which AI incidents require immediate notification to comms. Identify who makes that notification and how quickly it should happen. Don’t assume an incident must become a confirmed data breach before comms needs to know.
Clarify who makes disclosure decisions: Determine who has authority to approve internal and external statements, which stakeholders may require notification and what can be communicated while an investigation
Practice before an incident happens: Use the worksheet’s 15-minute tabletop exercise to walk through a hypothetical incident involving an AI agent that sends confidential information to an unauthorized recipient. Identify gaps in your response process and assign responsibility for fixing them.

The first time your comms team discusses an autonomous AI incident shouldn’t be when it’s already unfolding.