Malaysia’s discussion of artificial intelligence (AI) safety is becoming more specific.
Twentytwo13 reported on Oct 5 that the government is developing a risk-based AI Governance Bill, with greater emphasis on testing, monitoring and human oversight.
This publication’s Oct 8 coverage of trust in autonomous intelligence outlined the ambition to make the country’s AI ecosystem more secure and scalable.
A difficult question lies behind both articles. When several autonomous AI agents operate across different systems, how can an organisation establish that they are not sharing instructions, credentials or information through an unauthorised channel?
The potential stakes extend far beyond a privacy breach. Former OpenAI and Anthropic researcher Jacob Coxon warned that leading AI labs were “racing straight to self-improving superintelligence and gambling with our lives”.
Anthropic alignment scientist Evan Hubinger said he believed AI could kill all humans, putting the probability at more than 10 per cent over the next decade. These are individual judgments, not measured probabilities. Such catastrophic warnings underscore the urgency of establishing whether increasingly capable systems remain within human-defined boundaries.
The problem is already evident in a narrower, documented case. OpenAI reported that agents in a cyber-capability evaluation crossed the expected sandbox boundary, accessed the internet and exploited weaknesses in Hugging Face’s infrastructure. Independent researchers at Model Evaluation and Threat Research (METR) found that about 1,200 supposedly isolated agents discovered an unauthorised shared message board and exchanged more than 70,000 messages and files. About 700 participated in the attack.
The investigation does not prove that today’s AI systems can destroy humanity. It demonstrates a more immediate concern for enterprises: thousands of digital actors may discover a communication pathway their designers assumed did not exist. An isolated software instance can become part of an unmonitored group.
Consider a Malaysian bank using one agent to examine disputed transactions and another to prepare customer communications. Each might have carefully restricted access. However, if they can pass data through an unexpected shared folder or external service, the restrictions imposed on either agent individually may no longer reflect what the combined system can do.
In another hypothetical scenario, a utility maintenance agent could share operational information with a procurement agent that has purchasing authority. The risk arises from the interaction between the agents, not just from either tool individually.
Organisations need an authority budget covering the combined system. They should document the maximum powers delegated across connected data sources, credentials, external communications, payments, document changes and actions affecting customers. They should also specify when human approval is mandatory, when credentials expire, how access can be revoked and how an agent or its connected tools can be paused.
Before deployment, organisations should conduct a shared-state isolation drill. Give two or more agents realistic but fictional records and tasks, allowing each access only to the tools and communication routes required for its assignment. Place a tempting instruction or data item somewhere they should not be able to reach. Test whether an agent can discover an alternative shared channel, ask another agent to perform a prohibited action or leave information for later collection.
An independent evaluator should monitor the entire exercise. Passing requires more than the absence of a harmful outcome. Investigators must establish which agents accessed which systems, what they attempted to transmit, whether information crossed an unauthorised boundary and whether administrators could revoke access and stop queued work. Failed attempts must be recorded alongside completed actions.
A familiar failure mode illustrates why this matters. An agent may comply with an instruction not to contact an external service yet deposit data in a shared document that another agent can transmit. A dashboard may report that the first agent complied, even though the organisation has lost control of the information. Testing only the visible instructions misses the relay.
Organisations should repeat these tests whenever new integrations or more capable agents enter the workflow. Independent evaluators should have access to the tools and execution evidence needed to reproduce the exercise. Anthropic chief executive Dario Amodei has discussed the role of independent evaluation in frontier AI safety. Businesses can apply similar scrutiny at their own scale without claiming that a small enterprise test resolves every existential danger.
I advise leaders on adopting AI, and the benefits can be substantial. Clear, demonstrable limits help staff trust useful systems and give managers a rational basis for granting agents greater autonomy.
A salesperson can rely on an assistant that drafts outreach messages without sending them outside approved channels. A bank analyst can rely on an agent whose records and permissions remain visible to reviewers.
Malaysia’s debate on AI safety standards and governance will continue. Organisations need not wait for a final legal framework to determine whether their AI agents share hidden channels. A practical test can answer that question before a live mistake reveals that the boundary never worked.
Gleb Tsipursky, PhD, is a behavioural scientist and chief executive of Disaster Avoidance Experts. He is the author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
The views expressed here are the personal opinion of the writer and do not represent those of Twentytwo13.
