Have we hit another inflection point?
Last month, the release of Mythos made headlines — not just for what it is, but for what it signals. Models are no longer just generating outputs; they're acting autonomously, identifying vulnerabilities, and operating at a scale and speed that's difficult to contain, for better and for worse.
Anthropic initially held Mythos back from full release, creating a controlled forum for testing and risk management. It was then leaked. And now, just weeks later, we're already seeing a second wave emerge with models like Mistral Medium 3.5 explicitly building in more controlled agentic execution, and introducing approval layers to manage that same risk.
One thing is clear: AI capability is accelerating fast. And, not just in generation, but in autonomous action.
At the same time, organisations are embedding agentic systems into production faster than security, governance, or even basic visibility can keep up.
And, we are deploying it faster than we can control it.
So what's changed?
It's not just capability. It's the level of activity, the level of autonomy, and the level of reliance we're now placing on AI. It's everything all at once, and increasingly at a systems level.
From a Responsible AI perspective, this isn't just about systems being faster or more capable. It's that more decisions are happening through AI, more actions are being delegated to it, and more pressure exists to scale — often without a corresponding increase in control.
Which leads to the real question: what can you do?
Start here: would your Responsible AI principles still hold up if the system was acting without you?
For most organisations, the answer today is no. Not because the principles are wrong, but because they were designed for slower, more contained systems.
So the challenge shifts.
It's no longer just about defining principles. It's about making sure they hold under speed, scale, and autonomy. Which in practice, comes down to three things:
- how we make decisions,
- how we control behaviour,
- and how we stay accountable when things move at speed.
Let's look at each in detail below.
1. Ethics: From judgement to decision constraints
Ethics can't just be about asking "should we do this?" at the start of a project.
With agentic AI, you're no longer making one decision. Instead, you're setting up systems that will make hundreds, sometimes thousands, of decisions after deployment.
That requires a shift.
We need to move from deciding whether a use case is acceptable, to defining what the system is allowed to do before it acts.
At Kainos, we've been evolving our own approach in that direction. We're focusing less on go/no-go decisions, and more on what "optimally ethical" looks like at a system level. That means defining behaviours, considering alternatives, and designing for outcomes like sustainability, human impact, and transparency from the start.
In practice, it comes down to a few uncomfortable but important questions:
- Where could this system cause harm — especially at scale?
- Are we relying on people to catch those harms after the fact?
- Have we actually constrained the system, or just documented expectations?
If you're doing one thing in the next 90 days, make it this:
Take 1–2 high-impact AI workflows and define:
- what the system is allowed to do
- what it is explicitly not allowed to do
This helps translate ethics into rules, not guidance.
2. Human-centred: From usability to controllability
Human-centred is no longer limited to whether people can use the system, it's whether they can understand and control it. Consider this: how can a human stay meaningfully in the loop, even when the system is acting at speed?
What we're seeing in practice is:
- systems are doing exactly what was asked, but not what was intended (agentic misalignment)
- systems are optimising for outcomes in ways people wouldn't approve (values misalignment)
- and increasingly, systems interacting with each other with no clear oversight (governance misalignment)
The challenge is that AI doesn't fill in the gaps the way humans do. It follows what it's given, and nothing more. If something isn't defined, prioritised, or constrained, it doesn't get inferred. It gets ignored.
Blatantly, if you forget to tell AI not to use blackmail, it just might (true story). If you fail to prioritise your organisation's values and principles into the programming, the agents might set different ones.
As systems become more capable, their behaviour also becomes less intuitive. That makes getting these foundations right even more critical.
Again, if you're planning for the next 90 days, every AI system or agent should have:
- a clear objective (what it's trying to achieve)
- defined boundaries (what it cannot do)
And critically:
- stop conditions (when does it pause, escalate, or shut down?)
- intervention points (where can a human actually influence or override?)
If a human can't meaningfully interrupt or influence the system, you don't have oversight, you have observation.
3. Trust & Governance: Shifting from accountability to real-time control
This is where most organisations are exposed.
Governance today is still largely designed to assign responsibility after something has gone wrong. But with agentic systems, that's already too late.
The question now is: who is accountable while it's happening?
Every system, every agent, every workflow needs a named owner. Not a team. Not a function. A person.
Because when something goes wrong at speed, you don't have time to figure out who owns it.
Right now, what we're seeing is:
- actions taken without clear ownership
- decisions made without visibility
- and in some cases, activity happening without anyone realising
The immediate shift is simple:
Assign ownership to:
- every deployed agent
- every AI-enabled workflow
And make it explicit:
- what that person is accountable for
- how they intervene
If your first step in an incident is finding the owner, you've already lost control. You need a human on the hook.
This is where it comes together
When systems are acting at speed — making decisions, taking actions, and interacting beyond direct oversight — Responsible AI can't sit alongside delivery as a set of principles. It has to be embedded into how those systems actually operate. It needs to be planned for and actioned automatically at every stage of the AI's lifecycle.
We use ethics to define what's acceptable. Human-centred design to determine whether and how we can control it. Governance to ensure we have processes and procedures in place for if (or most likely, when) something goes wrong.
The shift isn't that Responsible AI has become more theoretical.
It's that it now has to operate at the same speed, scale, and complexity as the systems it governs.