When I first heard about OpenClaw, it sounded amazing. Or, at least I thought it sounded amazing. An AI agent that will run your personal life, keeping your inbox and calendar in line? Acting on my behalf overnight, doing the research I need even when I\u2019m not asking for it? But my inner skeptic kicked in pretty loudly: Can I actually trust an AI agent to do all of that?<\/p>\n
Security professionals weighed in pretty quickly<\/a>: You shouldn\u2019t without some meaningful guardrails\u2014and even then, given all of the power the AI agent will have, you might want to think twice. Reddit has also been full of cautionary tales from people who should know better about OpenClaw agents going rogue, deleting data, introducing malware and doing things the user doesn\u2019t want. A new study from enterprise cybersecurity provider Ivanti finds that <\/a>77% of cybersecurity professionals are willing to trust AI agents to make decisions without their input, so this isn\u2019t necessarily surprising.<\/p>\n I spoke with Ivanti Chief Legal Counsel Brooke Johnson about it, and she said that CIOs\u2014and everyone else\u2014need to remember that AI agents\u2019 actions have the same legal weight as those of people, which means they carry real liabilities. I talked to her about what CIOs need to consider, and an excerpt from our conversation is later in this newsletter.<\/p>\n Until next time.<\/p>\n This is the published version of Forbes\u2019 CIO newsletter, which offers the latest news for chief innovation officers and other technology-focused leaders. Click here<\/a> to get it delivered to your inbox every Thursday.POLICY + REGULATIONS<\/p>\n President Donald Trump speaks at the “Winning the AI Race” summit hosted by All\u2011In Podcast and Hill & Valley Forum in Washington, D.C. last July.<\/p>\n Chip Somodevilla\/Getty Images<\/p>\n The Trump administration has backtracked a bit on its stance against any AI regulations. This week, the Commerce Department announced agreements<\/a> with Google, Microsoft and xAI to allow the government to review new AI models before they are publicly released. The reviews will be done by the Center for AI Standards and Innovation, an agency under Commerce\u2019s National Institute of Standards and Technology.<\/p>\n It\u2019s not clear what these reviews will entail or if the government will require companies to make changes if issues are found. Frontier AI systems have had several well-publicized issues, ranging from OpenAI\u2019s chatbots giving weapon-making instructions<\/a> to Anthropic\u2019s very tightly controlled Mythos platform<\/a>, which can find critical cybersecurity vulnerabilities in seconds. In a blog post<\/a>, Microsoft writes that it expects to be working with CAISI to test AI systems in ways that probe unexpected behaviors, like automobile crash tests.<\/p>\n It\u2019s also unclear if politics will come into this process. Following a high-profile dispute with Anthropic over a Pentagon contract\u2014in which the government rejected limits on how the AI platform could be used\u2014Anthropic has been mostly excised from government use and deemed a supply chain risk. Last week, the Pentagon announced<\/a> agreements with seven other tech firms to use AI for classified military networks: most of the big players except Anthropic. And the head of CAISI, who will be running the AI systems testing, was just nominated<\/a> last week; the previous director was asked to resign because he had previously worked for Anthropic, the Washington Post reported<\/a>. <\/p>\n FROM THE HEADLINES<\/p>\n AI is once again a top reason companies cite for cutting jobs, according to new data<\/a> from career services firm Challenger, Gray and Christmas. In April, the firm found 83,387 jobs were eliminated, a 38% increase from March. And companies said more than a quarter of those were because of AI\u2014but experts are skeptical. <\/p>\n Forrester analyst J.P. Gownder told<\/a> Forbes senior contributor Caroline Castrillon that the vast majority of companies are a long way from building the AI infrastructure to actually replace that many people. These layoffs are more likely companies \u201cright-sizing\u201d their workforces following the Covid-era buildup of employees. AI will definitely have a huge impact on the workforce\u2014Forrester predicts 6.1% of all jobs will be affected by 2030\u2014but given where the technology is today, it\u2019s not quite so sweeping yet. Forbes contributor Bernard Marr writes<\/a> that the biggest impact will be at the bottom of the career ladder\u2014entry-level jobs\u2014and not among today\u2019s professionals.<\/p>\n Meta founder and CEO Mark Zuckerberg\u2019s reasons for a planned cut<\/a> of about 8,000 employees\u201410% of Meta\u2019s workforce\u2014might actually be a little more about AI than most. The Wall Street Journal reported<\/a> Zuckerberg said at an internal meeting last week that AI compute costs are a major reason for layoffs. Infrastructure costs have played an outsized role on Wall Street for Meta and other tech companies. Meta beat expectations and grew revenue in its earnings last week, but its share price dropped more than 8% based on an $10 billion increase in infrastructure costs this year, writes<\/a> Forbes senior contributor Peter Cohan. Forbes\u2019 Alicia Park writes<\/a> that Big Tech is slated to spend $750 billion on AI infrastructure this year.<\/p>\n BITS AND BYTESThe Real Liability Of AI Agents<\/p>\n Ivanti Chief Legal Counsel Brooke Johnson.<\/p>\n Ivanti<\/p>\n AI agents are an exciting new technology for the enterprise, with 87%<\/a> of cybersecurity professionals telling enterprise IT security company Ivanti that adding it is a priority. But they may be placing too much trust in them, with 77% saying they\u2019re comfortable with AI agents taking actions without human approval. <\/p>\n Ivanti Chief Legal Counsel Brooke Johnson agrees AI agents can be a game-changer, but they can carry real legal and liability risks for companies that CIOs need to be aware of. I talked to her about what CIOs need to know to protect their companies. This conversation has been edited for length, clarity and continuity.<\/p>\n If your AI agent does something wrong, who is responsible from a legal standpoint?<\/p>\n Johnson: I believe employers and companies are responsible for the actions of their agents. It\u2019s the same concept of vicarious liability for an employee\u2019s actions when they\u2019re engaged in work on behalf of the company. It has to be the same thing for agents. If an individual employee is in charge of an agent and the agent does something, the individual employee is not the one who\u2019s going to ultimately have the deep pocket to remedy the issue. Liability will flow back to companies. <\/p>\n From a business perspective, we\u2019re contracting for the shared risk. That\u2019s a very normal part of software: we agree to split liability in different ways. That will continue to evolve to make sure that agents are included, then businesses are prepared to hold the risk associated with agent activity. We have insurance policies and general practices. <\/p>\n Companies also wouldn\u2019t hire an employee and not train them. You\u2019re responsible to train them. You\u2019re responsible to train your AI, to oversee it, to make sure you have the controls in place internally so that it is carrying out the actions you want it to.<\/p>\n Do most companies realize and understand this? Are they ready to take the liability if an agent goes rogue, or is this being overlooked by CEOs?<\/p>\n It\u2019s an evolving area of business and the law. I can\u2019t think of any specific lawsuits around agent activity, but I think it\u2019s something that any C-suite should be thinking about, and I suspect we will see cases around this. <\/p>\n If you\u2019re getting in front of it, you should go back to what are your governance procedures: How are you training your human employees about what\u2019s allowed and what\u2019s not, and then providing them the right paths to getting tools approved that really will help the business overall. <\/p>\n I think insurance companies will probably drive some of the conversation around it because your cyber liability policy may start specifically speaking about agents. It might evolve that way: What they\u2019re willing to cover, what they\u2019re not, if there\u2019s any controls you have to have in place in order to receive coverage.<\/p>\n The courts are probably going to be out in front of U.S. regulators, influencing how businesses manage risk and potential liability. The U.S. system often is driven from the ground by litigation because there is harm and injury. People seek the remedy in courts through monetary awards\u2014which always drive business decisions and the management of risk. <\/p>\n It\u2019s happening so fast, though. I read a New York Times article<\/a> about OpenClaw in China. It\u2019s driven a tech boom, and then the Chinese come in and shut it down because they\u2019re so concerned about the risks of it. It really is this interesting wave of things happening: The technology is out there, then people are having to react after the fact to what\u2019s going on.<\/p>\n What advice would you give to a CIO to make sure that they\u2019re on the right track when it comes to potential legal issues with agents?<\/p>\n Talk to whoever it is at your company that runs data. One of the key pieces that helps keep you out of trouble is figuring out what data is it going to have access to, what are the risks associated with that, and what are the regulatory requirements around giving it access to that data? Work with your head of security. They can help walk through what is the impact to the corporate environment and what are the access points. They can help build that structure [similar to what you\u2019d want for] managing an irresponsible employee: How do you create the right infrastructure to responsibly be able to manage and review?Think about audits. Is there oversight and tracking, and are we able to go back and see if it did the wrong thing? Do we have logging? Do we have the right roadmap for what it\u2019s been doing so that we can run an investigation?COMINGS + GOINGSOmnichannel commerce platform Lightspeed Commerce selected Bhawna Singh to be its new chief technology officer. Singh most recently worked<\/a> as the chief technology officer at Okta, and she held the same role at Glassdoor prior to that.Aircraft leasing firm Aircastle appointed Nadene McKenzie-Reid as its new chief information officer, effective June 1<\/a>. McKenzie-Reid joins the company from NatWest, where she worked as the head of technology.Herbal and nutritional supplement manufacturer Nature\u2019s Sunshine hired John Hnanicek as its new chief technology officer, effective May 4<\/a>. Hnanicek steps into the role from Melaleuca, where he worked as chief digital innovation officer.STRATEGIES + ADVICE<\/p>\n When you make the decision to use a chatbot instead of a human helper, it makes sense to try to make it seem friendly, but researchers have found that might not be the best move. \u201cFriendly\u201d chatbots are more likely<\/a> to make factual errors in efforts to be agreeable\u2014and users find them more annoying.<\/p>\n One potential use of AI you may have overlooked: Personal brand building. Here are 11 ways<\/a> to use it to help you stand out professionally.<\/p>\n QUIZ<\/p>\n To warn people about AI deepfakes, an influential woman reposted an AI-generated image of herself on a bed in lacy lingerie on social media. Who is it? <\/p>\n A. Rep. Nancy Pelosi<\/p>\n B. European Commission President Ursula von der Leyen<\/p>\n C. AMD CEO Lisa Su<\/p>\n D. Italian Prime Minister Giorgia Meloni<\/p>\n