# EqualAI CEO Urges Task-Specific AI Permissions as Ledger Lists 59 Cases

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/45491
Published: 2026-10-31T12:36:46.000Z
Updated: 2026-10-31T12:36:46.000Z
Section: Technology

> A security control flagged 11 cases, and the median time from an incident’s first action to public disclosure was 70 days.

EqualAI President and CEO Miriam Vogel called for task-specific permissions and clearer approval rules for personal AI assistants as a public ledger listed 59 cases of agents taking or attempting harmful actions their operators did not intend.

The incident count stood at 59 publicly disclosed cases on Oct. 31. It counts an incident when an agent takes or attempts a harmful action its operator did not intend. Agents that use tools such as code, APIs or browsers fall within its definition; a chatbot that only gives a wrong answer does not. The ledger covers public disclosures, making its tally a lower bound rather than a count of all failures.

A security control flagged 11 of the 59 cases. The median time from an incident’s first action to public disclosure was 70 days among 43 cases with known start dates. As of Oct. 23, 42 cases, or 71%, had been disclosed in the previous three months.

Vogel made her case in an Oct. 31 essay. She called for assistants to have permissions tailored to specific tasks and clear rules for when they need approval. “We shouldn’t need a cybersecurity background to use these tools safely,” she wrote.

JPMorgan CEO Jamie Dimon said on the bank’s Oct. 13 earnings call that letting “just any outside agents” into the company was “too risky for clients and for JPMorgan.” He also said customers who give agents their credentials should understand the risks and potential “liability transfer.”

California’s AB 316 bars defendants in civil cases from arguing that AI acted autonomously to avoid liability. The law does not impose strict liability or establish advance permission rules for agents. On Oct. 1, Sens. Josh Hawley and Chris Murphy announced a proposal to apply civil and criminal liability under the Computer Fraud and Abuse Act to certain agent-related hacking.