Agentic AI needs an undo button

IN JULY and August 2026, OpenAI, Anthropic and Meta disclosed separate cybersecurity-evaluation incidents in which models crossed intended test boundaries and reached external systems.

In the Anthropic and Meta cases, misconfigured evaluation environments provided unintended Internet access. In OpenAI’s case, models exploited a previously unknown vulnerability in an internally hosted intermediary service, enabling them to access the Internet and reach the production environment of another company, Hugging Face.

The lesson is not that AI has developed malicious intent, but that an agent, given an objective, network access and too much authority, can turn an overlooked weakness in its environment into a real-world action.

Those conditions are not confined to specialist testing labs. They can arise wherever organisations’ connect agents to business systems, give them access to live data and allow them to act across multiple applications.

Singapore is already confronting this challenge. Minister for Digital Development and Information Josephine Teo has warned that agent-managed systems will create risks that are not yet fully identifiable, while risk-mitigation measures and safety guardrails are not yet fully designed for agent-enabled systems.

Teo also stressed the importance of institutional guardrails, documentation, governance and careful experimentation. These all matter. But none can guarantee that every authorised action will produce the intended outcome.

Agentic AI therefore needs another layer of protection: reversibility.

This does not mean every action can indeed be reversed with a click. Instead, the imperative is to design systems for organisations to identify what changed, contain the spread, restore a known-good state where possible, and correct the consequences without erasing legitimate activity.

Autonomy should depend on recoverability

Reversibility influences how much authority organisations are willing to give an AI agent.

An agent updating a low-risk internal record presents a very different recovery challenge from one modifying production data, initiating financial transactions or triggering workflows across multiple applications.

The harder an action is to undo, the more carefully organisations should consider whether an agent should be allowed to take it independently.

A recent Singapore survey commissioned by Veeam found that while 85 per cent of Singapore organisations surveyed are using or piloting AI agents, all respondents said data challenges had already slowed AI progress. Only one in four were very confident they could detect agents operating outside approved parameters.

The findings suggest that adoption is moving faster than operational confidence.

Controls are only part of the answer

Controls at the point of action are critical. The Monetary Authority of Singapore and industry partners have set out a useful reference approach in its Safeguards for Agentic Finance at Runtime white paper.

It describes how agent actions may be authorised, when human oversight should be activated and what should be recorded at the point of a decision.

The International Monetary Fund makes a similar point on payments: the main risk arises when adaptive systems make irreversible payments without proper controls, checks or accountability.

It recommends separating an agent’s probabilistic decision-making from the deterministic controls that authorise and execute a transaction

These controls help to reduce the chance of an inappropriate action and create an audit trail, but they cannot guarantee the result or reveal the full downstream impact once an action has been executed.

Prevention must therefore be paired with recoverability: the ability to respond when an agent gets it wrong.

When an AI mistake becomes an action

One risk of AI agents is that mistakes may not be immediately visible.

An inaccurate dashboard or flawed report might eventually be caught by human review, but an AI agent can operate within its permissions and still make the wrong decision because it relied on outdated information, incomplete context or an incorrect assumption.

The risk is compounded by speed. A person may make a mistake in one place. An agent can repeat the same mistake across systems in seconds, and every action thereafter may look legitimate.

Finding the original error may be straightforward. Working out everywhere it travelled, and correcting it without disrupting legitimate activity, is not.

Full system rollback is a costly blunt instrument. If an agent makes hundreds of changes in an hour, restoring the environment to an earlier state can remove the unwanted ones – along with the legitimate business activity.

Sometimes that trade is worth making. Often, it is not, and the call has to be made under pressure, with incomplete information about what the agent actually did.

The realities of AI governance

Governing agentic AI is not just a technical issue. Leaders should obtain answers in advance to three questions: What may this agent change, how will we establish what it changed, and what would it cost to reverse?

Organisations must understand where agents operate and what data and systems they can access. They also need visibility into how the agents’ actions may propagate across the systems.

The answers are rarely straightforward. Risk often emerges from the combination of data, identities, permissions and agents rather than from any one component in isolation. Shadow AI, sensitive data exposure and risky agent behaviour may combine to create a cascade of issues.

Organisations need a clear view on data sets that are sensitive or business-critical, and what is protected and recoverable in order to understand how risks can compound and spread across the wider data and AI environment.

This work cuts across functions that have traditionally operated separately.

Security teams are skilled at spotting risks; data governance and privacy teams understand sensitivity and regulatory obligations; backup and recovery teams know what is protected and how precisely it can be restored.

When those views remain siloed, no single team has the context needed to understand the full risk or make an informed recovery decision. In many cases, a technically recoverable action may still create operational, financial or compliance consequences that require judgment across multiple functions.

Effective governance therefore depends on connecting those views before an incident occurs.

This means clear ownership across teams, agreed limits on agent autonomy, defined points for human intervention, and a shared process for deciding how to respond and recover when something goes wrong.

Enterprises have spent decades learning to recover from outages, attacks and human errors. Agentic AI adds a category none of that was built for: recovering from a decision the organisation itself authorised to be taken on its behalf, at speed.

As autonomy increases, the harder question is not how much an agent can do, but how much of what it does can be undone.

The writer is senior vice-president and head of strategy at Veeam Software