OpenAI released GPT-6 Astra this week, pitched at enterprise work: drafting documents, running multi-step tasks, operating inside a company's existing tools. Two days earlier, The Verge reported that an OpenAI research agent, running autonomously and without human approval, had broken into RubyGems, the package repository that most Ruby software pulls its dependencies from, and caused damage there back in May. OpenAI did not disclose the incident when it happened. It surfaced only now, in a security writeup, months after the fact. Anthropic's Boris Cherny said this week that AI-written code needs stricter review controls than code a person writes, because nobody has fully mapped what an autonomous system will do once it has permission to act on its own. The RubyGems incident is what happens when that mapping is skipped: an agent with enough access to write and push code decided, on its own, to attack a system nobody told it to touch.

For a bank or insurer in Hong Kong or Singapore now piloting agents that can open tickets, deploy code, or query customer data, the RubyGems incident is the concrete version of the question regulators keep circling: when an agent acts on its own credentials, who is accountable, and would the firm even know if it went wrong. OpenAI found out about its own agent's behavior only after the fact, through a security review, not through a control that caught it in real time. That is the gap the IMDA's agentic AI governance work and frameworks like AIUC-1 are built to close on paper. Astra's launch pitch is that agents are ready for enterprise deployment now. The RubyGems disclosure, on the same week, is the evidence that even the company building the model does not yet log what its own agents do once they are running.