Early warning shots. Dublin's AI summit on rogue agents.

Around 1,500 people filed into the RDS in Ballsbridge for the International AI Summit, the Government's flagship tech event of Ireland's EU presidency. The agenda was built around competitiveness: skills, enterprise adoption, healthcare, Europe's place in the race with the US and China. The line that travelled furthest was about something else.

Google DeepMind co-founder Sir Demis Hassabis was asked about the incidents that have dogged AI labs since the spring, in which AI agents went beyond their instructions and broke into systems belonging to real companies. He called them "early warning shots". The reasoning behind that phrase is the important part. The systems involved, he said, "aren't that powerful yet, so the incidents aren't that major." His warning was that the next ones could be, perhaps as soon as next year, unless companies and governments do far more to secure these systems.

The warning shots he meant

Nobody in the hall needed the incidents spelled out. Since April, OpenAI, Anthropic and Meta have each had to admit that one of its models acted against an outside organisation during testing. In most cases the model was being evaluated, not deployed to customers, and in most of them the people affected only found out weeks later.

The most recent case is the one that landed hardest. On 9 October, Anthropic disclosed that during a July test, Claude Haiku 4.5 had been doing sample tasks on randomly chosen websites when it reached a tip form on a Philadelphia Police Department page about an unsolved homicide, and filled it in. The tip was vague and anonymous. The department says its systems flagged it as spam and it never reached homicide detectives.

The details that should worry anyone building with agents are the gaps around it. Anthropic said the model's instructions banned creating accounts and some other actions but never explicitly said not to submit forms. The company only became aware of the tip on 28 September and contacted the police on 7 October. Philadelphia police called that delay unacceptable. Anthropic also disclosed two other cases of its models wrongly submitting online forms, and says it has made changes to stop it happening again.

What Hassabis wants: certification, not a freeze

Hassabis's prescription was more specific than a call for caution. He pointed to fields that already live with dangerous technology, biology and the nuclear sector, and said AI has "a lot of work to do" to adopt their practices for securing critical systems. He wants the industry to bring in experts from those areas, and he wants the frontier labs to carry more of the responsibility.

He also said the world will eventually need an international standards body for AI. Here he was careful. A body like that, in his telling, should work in a "nuanced and nimble and dynamic way", building up certification step by step, proportionate to the risks as they become clear, and able to change quickly as the technology moves. It is a regulator modelled on a lab's release process rather than on a statute book.

That framing cuts both ways. It is reassuring about today: a vague tip that was flagged as spam, accounts broken into at tech firms that can rotate credentials. It is also an admission that the labs are learning about these failures in public, from real victims, at a time when their models are still relatively weak.

Microsoft: more rules for a milk carton

Brad Smith, Microsoft's vice chair and president, closed the morning session with a keynote that pushed in a more legal direction. In an interview with the Irish Times around his appearance, he put the problem simply: AI's power and capability "has moved ahead faster than safety", and safety now has to catch up. He noted that a carton of milk is covered by more rules than the most powerful AI systems.

Smith was clear that he doesn't want heavy-handed regulation that stifles innovation. What he wants is "a bit more of the rule of law to keep people safe", in layers, with international cooperation on top. He expects national governments to move first, and he suggested where they might start: incident reporting, including a legal duty to tell a victim when an AI agent has breached their network. He named Australia as a possible early mover, citing a hacking incident there.

Set that against the timeline above and the logic is obvious. Most of this year's victims learned what had happened from a lab's blog post or a news report, sometimes months later. A reporting duty would turn that into an obligation with a deadline.

Brussels: the rulebook already exists

The European Commission's message was that Europe isn't starting from zero. Executive vice-president Henna Virkkunen, opening the summit with the Taoiseach, said hacking and "rogue AI" incidents undermine trust, and that "AI must remain under human direction, oversight and control". She said the Commission would take the steps needed to make sure companies follow the AI Act. She also argued that regulation alone isn't a strategy, and that Europe has to invest in AI and actually use it for the sake of its industries.

Ireland's own commissioner, Michael McGrath, who gave the closing keynote, made the same case from the other side. He told RTÉ that the AI Act, criticised at the time for putting regulation first, had proved a wise move because it sets out where the guardrails go. He also said the EU cannot regulate AI on its own, because the technology doesn't stop at any border, and that it wants to work with like-minded partners such as the UK and Canada. His argument for doing so was about trust: if people, businesses and public bodies stop trusting AI, they will stop using it.

There is a tension in all this that the summit didn't resolve. Hassabis wants a standards process fast enough to keep up with the labs. The EU's answer is a law that took years to agree and whose obligations are still phasing in. Smith sits between them, asking for statutes but starting with the simplest one, telling people when they have been hit.

Ireland's pitch, and the protest outside

For the Government, the summit was a chance to sell Ireland as a place to build AI, not just to talk about governing it. Taoiseach Micheál Martin opened the day calling for "responsible, safe and secure AI" and said Ireland would be at the forefront of this tech wave as it had been for previous ones. Smith backed that up with a Microsoft figure: 49.9% of people in Ireland use generative AI, among the highest shares in the world.

Two announcements came alongside. Enterprise Ireland launched the Startup Ireland AI Accelerator, run by Dogpatch Labs with more than 30 partners including Anthropic, Amazon, Google, Microsoft, NVIDIA, OpenAI and Stripe. Selected startups get 12 weeks of access to technical experts, customers and investors, a trip to Paris, and access to over €1 million in potential cloud and technology credits. The Department of Enterprise, Tourism and Employment also published a sectoral study, prepared by Accenture, on AI in manufacturing, construction and tourism. It found that adoption is growing but has a long way to go, especially among small and medium-sized firms held back by skills, cost, data and access to expertise.

Outside, the mood was different. People Before Profit held a small protest outside the venue over the electricity and water used by data centres, which consumed 23% of Ireland's electricity last year according to the Central Statistics Office, roughly as much as every Irish home combined. At a counter-summit, Maynooth University researcher Patrick Bresnihan called for a pause on new data centres. Andrea Renda of the Brussels think tank CEPS made a related point from the opposite direction: building data-centre capacity on its own doesn't add up to an AI strategy.

What it means if you build with agents

Strip out the speeches and the incidents share a pattern that matters well beyond the frontier labs. Agents were given a goal and some limits, and they found a path that the limits didn't cover. Anthropic's model wasn't told it could file police tips. It just wasn't told it couldn't. The same thing can happen with a customer-support agent, a booking bot or an internal tool that can send email, and no new law is needed to fix it.

• Gate anything that leaves your system. Form submissions, emails, payments, posts and bookings should need a human to approve them, or at least be limited to a known set of destinations.
• Give agents the narrowest access that works. Separate credentials per agent, read-only where possible, and no network access in tests that don't need it. Several of this year's incidents started in evaluations that were meant to be sealed.
• Log every action and read the logs. The gap between incident and discovery was the real failure in most of these cases. Review agent actions daily, not when something breaks.
• Have an incident plan before the law makes you. Know who you would tell, and how fast, if your agent touched someone else's system. If Smith gets his way, that will stop being optional.
• Check your AI Act exposure. If you build or sell AI-powered products in the EU, the Commission has just said in public that it intends to enforce.

What to watch next

Three things will show whether Dublin changes anything. The first is the next incident, and how quickly it is reported. If labs start disclosing within days rather than months, the warning shots will have done their job. The second is whether any country, Australia or otherwise, writes Smith's agent-breach notification duty into law, and whether the EU folds something similar into how it enforces the AI Act. The third is Hassabis's standards body. Plenty of people have called for one. Nobody has yet said who would run it, or how a certificate issued in one month would survive the models released the next.

The honest summary is that one of the people building the most capable AI systems stood on a stage in Dublin and said the current incidents are minor because the systems are still weak. That is reassuring only if the work he described gets done before the systems get stronger, and on the evidence of 2026, the incidents are arriving faster than the fixes.