Apple Warns Investors AI Agents May Behave in Unintended Ways as It Opens Siri AI to Developers

Apple told investors in its annual report for the fiscal year ended 26 September 2026 that AI agents "may behave in unintended or unpredictable ways", and it published a developer preview of Siri AI on 3 November that lets third-party apps plug their actions into the assistant. The two disclosures landed on the same day, and together they show a company trying to open its assistant to outside software while telling shareholders it cannot fully control what agents do.

What does Apple's 10-K say about AI agents?

CNBC reported on 3 November that the filing treats agents as a business risk that could expose Apple to lawsuits or damage its reputation. The language sits under a risk factor that the Form 10-K filed with the SEC titles "Issues related to artificial intelligence may result in reputational, competitive and financial harm to the Company". Among the listed risks is "unintended or unauthorized actions by autonomous or agentic systems".

The filing is specific about what an agent can do. It says AI agents "can take actions autonomously", with examples that include interacting with internal or external systems, executing code and completing transactions. It warns of agents "exceeding permissions, defying directions or resisting instructions". It also states that "some consequences, such as deleting data or completing transactions, may be difficult or impossible to reverse."

One sentence addresses software Apple does not build. The company says its ability to oversee and control third-party AI agents may be limited. The filing also says that agents which need access to personal data create privacy and data-security concerns, and it cites the "divergent and rapidly evolving" legal and regulatory frameworks around artificial intelligence as a source of potentially significant compliance costs. CNBC adds that the filing mentions ethical concerns and negative consumer perceptions of AI and "super intelligence".

Risk-factor language in a 10-K is written by lawyers to limit liability, and it is not evidence that any particular incident has occurred. The filing does not describe a specific agent failure at Apple. What it does show is the vocabulary Apple now considers necessary to disclose: permissions exceeded, instructions resisted, actions that cannot be undone.

What did Apple release for developers?

On 3 November, Apple Developer News announced a Siri AI developer preview that begins with the iOS 27.3, iPadOS 27.3, macOS 27.3 and visionOS 27.3 betas; the notice's footnotes also list watchOS 27.3. Any developer can use it. Apple says customers will get Siri AI integrations "in a few months", and that App Store submission opens in the spring.

Developers bring app content and actions into Siri AI through App Intents. Apple's examples include checking a delivery, booking a reservation or placing an order, each run through custom actions the developer builds. Developers can also create "skills" that teach Siri AI to combine several actions into a single experience for a complex request, and Siri AI can surface any entity in the Spotlight semantic index rather than only entities that fit an existing schema.

Apple lists 15 of its own apps as already integrated: Calendar, Files, Finder, Journal, Mail, Maps, Messages, Music, Notes, Photos, Preview, Reminders, Safari, Shortcuts and Weather. Users can ask Siri AI what an app can do.

The preview carries limits. It requires an Apple Intelligence-enabled device set to a supported language: English, French, Japanese, Korean, Portuguese and Spanish at launch, with Traditional Chinese, Norwegian, Turkish and Vietnamese listed as coming soon. It is unavailable in the EU on iOS, iPadOS and watchOS, and not available to users under 13. Server-side Apple Intelligence features, including Siri AI, are subject to daily usage limits, and Apple says expanded access will be a paid option in the future. More terms and usage policies for Siri AI-enabled experiences will be published later.

How do the filing and the preview fit together?

The preview lets outside developers define actions that an assistant can chain together using personal context and onscreen awareness. The filing says that Apple's control over outside agents may be limited. Those statements are not contradictory, but they describe the same boundary from two sides: Apple controls the framework, and the developer controls what each intent does.

The company has already tightened one boundary. CNBC reported that on 2 October Apple announced stricter macOS full disk access controls because of "risks related to this level of access" from AI agents. That change concerns the operating system rather than Siri AI, but it shows the company adjusting permissions in response to the same category of risk its filing describes.

CNBC also reported that Siri AI runs on the iPhone and uses local data such as calendars and emails. It cannot work autonomously for long periods, according to CNBC, unlike OpenAI's Dots or Meta's Muse. That design choice limits the window in which an agent can act without a person present, which is the scenario the 10-K worries about most. During Apple's earnings call on 2 November, CEO John Ternus said Apple had "real room" to expand Siri's capabilities, and he called the company's inability to access private data on its devices a "core differentiator". He said Apple wants users to understand what access they grant agents and that agentic tools should protect security and privacy, CNBC reported.

What we don't know yet

Several points remain open. Apple has not published the additional terms and usage policies for Siri AI-enabled experiences, so it is unclear what review third-party skills will face before reaching customers. The pricing of expanded access is undefined beyond Apple's statement that it will be paid. The 10-K does not say how Apple would respond if a third-party skill caused an irreversible action, and the CNBC report as read does not indicate that Apple has defined such a process publicly.

Adoption is also unknown: the preview is limited to developers on beta software, so there is no usage data yet.

Why it matters

For developers, the preview is the first concrete route into Siri AI, and the spring App Store window sets a rough deadline. For investors, the 10-K shows autonomy is now treated as a financial and reputational risk. For users, the practical question will be what permissions a skill requests and whether irreversible actions require confirmation. Apple's own filing says some consequences cannot be reversed, and the answer to that question will determine how much of the risk it describes reaches customers.