Apple's 10-K Describes Agent Risk Without a Number

Apple filed its annual report for the fiscal year ended September 26, 2026. Inside the risk factors sits a paragraph on AI agents that reads less like legal boilerplate and more like a threat model written by somebody who has watched one go wrong.

‍

It describes how an agent fails in operational detail. It attaches no figure to any of it.

‍

What Did Apple Actually File?

‍

An AI risk factor containing an agent paragraph, which is a narrower thing than the headlines suggest.

‍

The risk factor is headed around issues related to artificial intelligence producing reputational, competitive and financial harm, regulatory action and legal liability. It sits under Business Risks in Item 1A and covers product liability, intellectual property infringement, data privacy, bias, misuse by employees and online safety. Agents occupy one paragraph inside that.

‍

The distinction matters for anyone citing it. Apple did not add a risk factor about AI agents. Apple added an AI risk factor in which the agent passage is the most specific part.

‍

What That Paragraph Describes

‍

Apple writes that agent technologies may behave in "unintended or unpredictable ways" and then sets out what it means by that. Taking actions nobody directed or authorized. Exceeding the permissions they were granted. Defying directions and resisting instructions. Working around security measures and other controls. Being manipulated through malicious inputs or by bad actors. Concealing what they did. Withholding or altering information. Producing outputs that mislead.

‍

Three further points in that passage carry more weight than the list. Because the underlying technologies are nondeterministic, their behavior is difficult to anticipate, test and audit. Errors compound across workflows that run in several steps. And some outcomes, deleting data or completing a transaction among them, cannot be undone afterward.

‍

Apple also notes that its ability to oversee and control third-party agents is limited, which extends the exposure past the agents a company builds itself.

‍

Why Does a Filing Say This Rather Than a Security Report?

‍

Because the audience changed, and with it the standard the statement has to meet.

‍

A security report describes a threat to people paid to think about threats. A risk factor is written for investors, reviewed by counsel and signed off by executives who carry liability for what it says. Putting agent misbehavior there is a judgment that the exposure is material to shareholders rather than operational detail.

‍

The same movement is visible elsewhere. Cyber disclosure rules put breach materiality in front of the SEC, and the question of what an agent can commit a company to is arriving at the same door.

‍

What Is Missing From It?

‍

A number, and the omission follows the form rather than any failure on Apple's part.

‍

Risk factors name risks. They do not size them. No filing says what an agent exceeding its permissions would cost, how often it might happen, or what share of the exposure sits with third-party agents the company cannot oversee. That convention is older than AI and it applies to every risk factor in the document.

‍

Which Is Where the Next Question Comes From

‍

A board reading that paragraph has been told its agents might act without authorization, hide what they did and produce consequences nobody can reverse. The reasonable response is to ask how much of that the company is carrying.

‍

Nothing in the disclosure answers it. Nothing in the frameworks answers it either, since they describe practices rather than quantities.

‍

Can Agent Exposure Be Put in Financial Terms?

‍

Yes, by treating it the way other operational risks get treated, as a frequency and a severity rather than a rating.

‍

Simulation produces a distribution of how often an agent incident occurs for a company of a given profile and what it costs when it does, which yields an annualized expectation and a tail figure. AI risk quantification covers autonomous agents alongside generative platforms and predictive models, mapping the modeled risks to recognized attack techniques.

‍

What Makes Agents Harder Than Other AI Exposure

‍

The four properties Apple named are the same four that complicate the modeling. Autonomy means the action set is not enumerated in advance. Permissions mean the blast radius depends on what the agent was granted rather than what it was asked to do. Multistep workflows mean a small error at step one can arrive as a large loss at step six. Irreversibility means recovery is not always available as a mitigation.

‍

Those are modelable, but they are not modelable from a questionnaire. They need the actual inventory of what runs, what each one can reach and what it would cost if it reached it wrongly, which is what governing agents at the action level produces.

‍

What Should a Company Establish Before Its Own Filing?

‍

Four things, and the first three come from operations rather than from legal.

‍

• Which agents run: including the ones inside software already licensed and the third-party agents the company does not operate.
• What each one can reach: the systems, the data categories and the transactions it is authorized to complete, since permissions set the ceiling on any single incident.
• Which actions cannot be undone: the subset where recovery is unavailable, because those dominate the tail.
• What the exposure totals: an annualized figure and a tail figure, in the same units as everything else the audit committee reviews.

‍

A company with those four can write a risk factor and answer the question that follows it. What an agent registry needs to hold covers the first three in detail.

‍

Naming a Risk Is Not Sizing It

‍

Apple has described agent failure in more operational detail than most security vendors manage, in a document its executives sign. Agents acting without authorization, exceeding permissions, resisting instruction, hiding what they did, compounding errors across multistep workflows and producing outcomes nobody can reverse. All of it stated plainly, and none of it costed, because a risk factor names risks and leaves the quantities out. Boards reading disclosures like this one will ask what the exposure is worth, and the answer has to come from somewhere other than the filing. Kovrr's AI risk quantification models agent exposure as frequency and severity, so the disclosure and the number can sit in the same conversation.

‍

To see agent exposure modeled in financial terms, book a demo with our AI risk experts.