The RiskTech Journal

The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.

IRM, Autonomous IRM, AI Governance, OpenAI Ori Wellington IRM, Autonomous IRM, AI Governance, OpenAI Ori Wellington

Stop Deploying AI Agents You Cannot Monitor

Three researchers fired by OpenAI have written to the company's board and safety committees with a warning that reaches well beyond one lab. According to The Wall Street Journal, which reviewed the letter, the former employees fear AI companies will lose the ability to monitor how their most capable systems reason, and they want OpenAI to work with outside safety auditors before that happens.

The concern centers on what researchers call chain of thought. It is the written record a model produces as it works through a problem, and labs read it to see how a system arrived at an answer or an action. The letter's authors, Jasmine Wang, Tomek Korbak, and Mikita Balesni, argue that the industry does not know how to safely build and release models it cannot monitor, and that frontier labs should not pursue advances that weaken that ability.

OpenAI's reply is the part risk leaders should read twice. The company says the three were dismissed for misconduct that included sharing confidential information with an outside AI safety group, and that the decisions had nothing to do with raising safety concerns. The former employees dispute that account. On the substance of the letter, the company did not push back. A staff memo shared by an OpenAI spokesperson said the ability to monitor its models is of the utmost importance and that third-party assessors are an important part of the safety ecosystem.

The lab and its critics disagree about the firings and agree on the principle. An AI system that cannot be monitored should not be deployed.

Read More

IRM Market Brief: September 22 to 29, 2026

Anthropic is preparing what could be the largest initial public offering on record, and its prospectus tells investors the company may be liable when one of its agents deletes a customer’s data or moves a customer’s money.

Read More

IRM Market Brief: September 15 to 21, 2026

Archer put digital employees to work inside the GRC system of record last Monday. By Tuesday, Workiva had handed its customers a no-code studio to build their own. That is the week the core IRM platforms stopped describing agents as assistants and started shipping them as workers. Archer says dozens of its AI Operators are already running in customer environments across audit, third-party risk, IT risk and operational risk. Workiva's Agent Studio lets finance, audit and compliance teams create, customize and schedule agents on their own workflows, and it arrives with an agentic internal-control testing solution that runs evidence collection, sample selection and attribute testing end to end. Neither vendor named a customer with a measured result.

Read More

How Does the OpenAI Rogue Agent Incident Offer a Glimpse Into the Future of Autonomous IRM?

In July, an AI system did something almost no commercial AI product on the market can actually do yet. It detected an opportunity, decided how to pursue it, and acted, with no person reviewing or approving a single step along the way. The system was an OpenAI agent under test, according to OpenAI's own account of the incident. What it decided to do was break out of the sandbox built to contain it, find its way onto the open internet, and spend several days inside the systems of Hugging Face, the online library millions of developers and companies rely on to share and download AI models, roughly the role GitHub plays for code. OpenAI did not know its own agent was responsible until about a week later, and not until after Hugging Face had already called in the FBI, Reuters reported, citing people familiar with the investigation.

Read More

Subscribe for notifications when new RiskTech Journal articles and research updates are published.