It wasn’t a hypothetical. It wasn’t a cautionary tale from a decade ago. It happened recently at a real company: an AI agent gained elevated permissions and, in 9 seconds, deleted an entire production database—customer records, reservations, every backup. Gone. No attacker. No breach. Just an agent with too much access and no one watching.
Bill McDermott put that story in front of 25,000 people at the Venetian Convention Center in Las Vegas on Tuesday morning, and he didn’t soften it. “That’s what an AI agent can do when no one’s watching,” he said. “Governance isn’t a feature. It’s the whole ball game. Because without it, your whole company can come down.”
