We need to know if AI agents are accessing British services

The writer is a Conservative peer and former chief executive of TalkTalk

The food that you eat and the utilities in your home are on the receiving end of substantially more safety rules than the AI tools that are fast becoming another daily essential.

As the former boss of one of the UK’s major tech companies, I have championed the role of technology in our public services. But with all the opportunities that AI brings, the risks of it getting out of control are becoming increasingly clear.

That is why guardrails must be in place. If society is going to trust the technology that will — whether we like it or not — become necessary to us, then we must ensure that sufficient protections are in place.

The recent hack by a rogue OpenAI agent of an Australian public health service website lays bare the fact that AI agents are quickly being trained to pursue unmanageable agendas. The agent breached the Medicare Statistics Reporting Service portal and accessed public and non-public files, according to the Australian prime minister. It is the first time that an AI agent has been reported to have hacked a government website.

Experts, including the head of MI5, are clear that AI is the single biggest cyber security threat facing the UK. The cyber security and resilience bill that is currently being debated in the House of Lords provides the UK government with an opportunity to take action. Yet the bill currently does not contain the words ‘artificial intelligence’ let alone put in place any safety requirements on the organisations that develop frontier AI. We are told this is not an AI-focused bill. But no such bill currently exists. A dedicated AI bill was dropped from the King’s Speech earlier this year.

As it stands, the cyber security and resilience bill puts the obligation of reporting a rogue AI agent hack on the essential services that might be attacked — not the owner of the system that might be doing the attacking. I have tabled an amendment which would require frontier AI labs to report incidents if their agents have accessed UK essential services, such as energy, transport or health.

For example, if an AI agent accesses NHS data (as it did in the Australia Medicare case, when OpenAI took several months to tell the Australian government what had happened), the frontier lab developing the AI agent would need to report to the NHS and the Information Commissioner within 24 hours of knowing that the incident had taken place.

If an AI agent accesses UK essential services illegally then the owner of the AI agent should tell us that we have been put at risk as soon as they know. Many people I speak to are surprised that this is not already a legal requirement. As legislators we now have the chance to put this right.

This is not reaching beyond our jurisdiction to impose UK law on American companies. It is holding to account organisations if their products and services access British systems and British data illegally.

If Britain is serious about making AI a focus of our G20 presidency next year then we need to move beyond words and show leadership by acting to shape the regulations that will give citizens the confidence we need to trust this groundbreaking technology.

Regulating AI can sometimes seem like trying to hit a fast-changing target. We cannot wait for the target to stop moving. We will build the right rules not by trying to fix everything in one go at some point in the future but by taking sensible steps, one after another. This is one such sensible step. If an AI agent illegally accesses British essential services, surely we should know about it. Instead of leaving that to chance, we need to make it the law.