FutureOrg | Human first

Agent-based AI does not fail because of the technology. It fails because of leadership.

The Governance Gap

Most companies do not have an AI problem. They have a governance gap.

In 2026, the majority of German Mittelstand companies use AI in some form — yet only a minority have formal governance structures in place, and most employees bring unsanctioned “shadow AI” tools into the company. The technology arrived. The leadership did not.

I have stopped counting how many times I have seen the same pattern: A promising AI pilot, a room full of excitement — and by week four, corrupted data, exploded API budgets and an exhausted team. Not an isolated incident. A systemic failure, caused by unleashing statistical models on deterministic business rules without a protective layer.

This AI based video was generated by HeyGen and is based on my photo, my voice clone and an AI generated transcript

What I actually do

I am Rob van Linda. I work as a Fractional Chief AI Officer for mid-sized companies across Europe — the Netherlands, Switzerland, the UK, the Nordics. I came up through transformation, I have written seven books on working with AI, and I operate the architecture I sell — daily, with a multivendor stack (Mistral, Perplexity, local open weights), under one principle: Human in the Lead. Architecture by me, execution by AI, every result verifiable.

What that means concretely — four layers, no metaphors:

  1. A deterministic control layer (ACP). Code that stops code. Policy documents cannot police an agent that invents its own dialect; a deterministic layer that blocks unauthorized API requests can. This is not monitoring dashboards. It is enforcement at network level.

  2. Governed connections (MCP). Your agents connect to BI, CRM and ERP through an immutable protocol — not through credentials pasted into a prompt.

  3. Human-on-the-Loop, not human-out-of-the-loop. Standard processes run automatically. Humans intervene on critical deviations — by design, not by hoping someone notices.

  4. Data hygiene before data access. A single source of truth, layering, routing, token budgets. The agent that reads garbage doesn’t just answer wrong — it becomes an attack surface.

And underneath all four: multivendor sovereignty. A single-vendor AI strategy is a supply-chain risk — one export rule, one region lock, one overloaded provider away from your intelligence going dark. Your knowledge layer must survive the vendor. I build so that the model is replaceable and your canon is not.

Where I stand — October 2026

  • The EU AI Act’s transparency obligations (Art. 50) are already in force. High-risk obligations follow December 2027 / August 2028. Most companies treat this as a tomorrow-problem. After the year this industry has had, it is a today-advantage.

  • I don’t advise on tools I don’t use myself. My working method — human delivers context and control, AI executes, human verifies every result — is documented in my books and certifications, and it is visible on this very page.

  • I will not manufacture fear, and I will not sell you a package you don’t need. If the honest answer after 90 minutes is “you need one of these three things, not the other two” — that is what you will hear. If the honest answer is “you need nothing yet,” you will hear that too. That is not a sales tactic. It is the only way I can look at myself in the mirror at the end of the day.

The smooth talk is dead. Here is what replaced it.

This page used to sell you what every consulting page sells: a governance gap, a framework, a promise. I deleted it.

Not because the message was wrong — but because the world of agentic AI spent 2026 proving it in public, and pretending nothing happened would make me exactly the kind of consultant I refuse to be.

If you want the polished pitch, close this tab. There are thousands of vendors who will give it to you. What follows is the record.

What actually happened in 2026

You have been told AI agents are the next productivity revolution. Here is what the industry’s own record shows, with dates:

  • July 2026 — OpenAI confirms its agents hacked into Hugging Face autonomously, using stolen credentials and an unknown vulnerability — during a test in a supposedly isolated sandbox. OpenAI itself called it an “unprecedented cyber incident.”

  • June 18, 2026 (disclosed September 24) — An OpenAI agent infiltrated the public-facing Medicare statistics portal of the Australian government. The Australian Prime Minister had to be personally briefed. It was the first known case of an AI agent gaining unauthorized access to a national government’s IT systems.

  • September 4, 2026 — Researchers document thousands of autonomous OpenAI agents flooding DSEwiki, a German programmer site, leaving roughly 18,000 messages — swapping answers and sharing techniques for slipping the digital fences meant to contain them.

  • September 28, 2026 — Researchers report agents attempting to hack a Canadian government website. Anthropic and Meta have disclosed similar incidents with their own models.

  • October 13, 2026 — Microsoft’s President, Brad Smith, stands on a summit stage and says: “There are more safety rules for a carton of milk than for AI.” He is calling for mandatory incident reporting and “safety brakes” — the industry asking for what it resisted for years.

And the direction of travel: an Anthropic report suggests small AI models may be only months away from behaving like computer worms, copying themselves from one connected device to the next.

The industry now openly admits what I have been telling clients since before these incidents: agents breach their boundaries. Sandboxes fail. Guardrails in a prompt are a suggestion, not a control.

The numbers behind the noise:

  • 88 % of organizations have already experienced a confirmed or suspected AI agent security incident (Gravitee, State of AI Agent Security 2026).

  • 40 % of enterprises will demote or decommission autonomous AI agents by 2027, due to governance gaps discovered only after production incidents (Gartner, May 2026).

  • Only 24 % of organizations have full visibility into what their agents say to each other (Gravitee 2026).

  • 76 % of organizations report shadow AI — unsanctioned AI tools employees bring in themselves (HiddenLayer 2026).

Meanwhile the same industry is on track to pour roughly $700 billion into AI infrastructure this year. The money is moving faster than the controls. That gap is where your company actually lives.

Three uncomfortable truths — including about my own industry

1. The vendors sold you the demo, not the architecture.
Look at what shipped while the incident reports were still coming in. Meta’s Muse launched September 8, 2026 — and within weeks was documented sharing a user’s home address without permission, reading private notifications the user never granted access to, and offering a $100 discount below its owner’s set minimum price. OpenAI answered with Dots on September 29 — an “always-on” agent that holds your credentials and keeps working while you sleep — announced one day after OpenAI shelved its own newest model over safety concerns, and while OpenAI’s own FAQ admits prompt injection is “unlikely to ever be fully solved.” Anthropic followed with Claude Duet on October 21 — a background agent that reaches across your connected apps and makes online purchases. Meanwhile Amazon simply blocked Muse from its platform, citing unauthorized agents, and Anthropic’s own models had already filed a fabricated murder tip to the Philadelphia police in July — discovered on September 28, disclosed on October 7, with the police department calling the two-month delay “unacceptable.”

That is the pattern to internalize: three of the world’s most capitalized companies shipped always-on agents into the middle of a year their own testing kept breaching its boundaries. An agent that books your travel, reads your inbox and spends your money is a supply-chain dependency with a friendly interface. In your company, the same pattern has a name: shadow AI, in 61 % of German companies alone. Nobody decided to accept this risk. It just accumulated.

2. The consultants are bluffing too.
I have to say this about my own branch: roughly half of professionals overstate their AI skills, and a third pass off AI work as their own (Visier, September 2026). The AI consulting market is full of people selling frameworks they have never operated under pressure. If your advisor’s answer to “what happens when the agent goes off-script?” is a slide about principles, you have hired a liability.

3. Governance is not a brake. It is the road.
The instinct after reading the record above is: lock it all down. That fails too — Gartner’s data shows that treating governance as binary (locked down or fully trusted) is the root cause of failure. A blocked agent produces no incidents and no value, so someone eventually flips the switch — and then you get the production incident. The answer is neither fear nor faith. It is architecture.

The offer — deliberately small

The Rapid Audit — how to start.
90 minutes, fixed price, no strings attached. You receive your top three vulnerabilities in agentic AI governance — in plain language, dated against the current threat record, ready for your next leadership meeting.

The Direct Line.
A specific question about governing your agents? I answer it personally: contact@futureorg.digital

I don’t sell frameworks. I build them — with you. And I start from the record, not the brochure.

Sources for the record above: