Expert: AI agents aren't rogue actors — responsibility lies with the people behind them
Estonian commentator Kaimar Karu argues that much of the public debate over AI agents is misguided, since such systems are software without morality, and that humans — not the technology — bear responsibility for harmful outcomes.
Recent weeks have brought intense public and political debate over AI agents, fueled by statements and open letters from prominent figures and by reports of a so-called "hack" of Australian health data. Commentator Kaimar Karu argues that much of this discourse misrepresents what is actually happening.
He rejects the framing of AI agents as rogue entities that break into systems on their own initiative. In reality, these are automated applications built by someone for a specific purpose, often given vague instructions and insufficient constraints. Such software has no morality or understanding of legality — it follows probabilistic patterns that can lead to outcomes a human would see as absurd or dangerous.
The Australian incident
Regarding the Australian healthcare data case, Karu stresses there was no "evil AI hack." Instead, an automated application either used an unexpected method to reach publicly accessible data, or exploited an existing security flaw. Either way, the root cause lies in poorly designed system architecture or inadequate security testing — not in the AI itself.
Karu compares blaming an AI agent to blaming a hammer or an axe for an accident: the tool doesn't choose to act, but someone placed or used it carelessly. What sets AI agents apart, he notes, is their growing ability to act and adapt without a human directly overseeing every step, using external tools to keep pursuing a goal.
Regulation and public fear
Karu is skeptical that new regulations on AI development would be effective, since the technology can keep advancing covertly, and states with different political systems are unlikely to comply. He also warns against unfounded statistical claims about AI risk and highlights a widespread "AI psychosis" — a mix of exaggerated fear and naive belief in marketing promises.
As practical steps, he calls for making digital systems more resilient, investing in better monitoring, and preparing clear response plans for when security breaches occur.
