This section maps agentic risks presented by 39C3 to our 13 foundational pillars.
Pillar 1 — National Objectives & Guiding Principles
Why it’s implicated: The 39C3 presentation is fundamentally about what goals we should optimize for when AI shifts from “assistant” to “agent.” It highlights a power shift toward OS vendors and platform owners, raising the need for explicit public-interest objectives (user sovereignty, privacy, safety, competition) to guide design and regulation.
Governance takeaway: Define national-level objectives up front (user sovereignty, privacy-by-default, safety-by-design) so agentic systems can’t justify surveillance and autonomy purely on convenience or productivity.
Pillar 2 — Classification of AI Systems
Why it’s implicated: Agentic systems range from simple copilots to OS-embedded agents with continuous perception, memory, and tool access such as Microsoft Recall.
The risks change sharply depending on where the system runs (app vs OS), what it can see (screen/inputs), and what it can do (transactions, system changes).
Governance takeaway: Classification should distinguish: (a) assistive vs autonomous action, (b) app-scoped vs OS-scoped access, (c) ephemeral vs persistent memory, and (d) ability to invoke tools that cause real-world effects.
Pillar 3 — Transparency Standards
Why it’s implicated: The talk by 39C3 stresses that users and organizations often cannot tell what an agent perceived, what it stored, why it chose a plan, or which tools it invoked. “Radical transparency” is framed as a prerequisite for trust, incident response, and accountability.
Governance takeaway: Require clear disclosures, user-visible activity logs, memory provenance, and tool-call traces so agent behavior is inspectable and auditable, not opaque.
Pillar 4 — National Safety Testing & Evaluation
Why it’s implicated: The “Mathematics of Failure” and the case studies imply the need for rigorous, repeatable evaluation: multi-step reliability drops exponentially, and semantic vulnerabilities (prompt injection, tool poisoning, memory corruption) can bypass traditional defenses.
Governance takeaway: Safety testing must include: long-horizon task reliability, adversarial prompt-injection tests, tool-call abuse tests, and memory poisoning scenarios—especially for OS-embedded agents.
Pillar 5 — Energy & Infrastructure Requirements
Why it’s implicated: OS-level agents change infrastructure assumptions. Features like Recall create continuous capture and indexing pipelines (compute, storage, security enclaves), shifting the OS from neutral resource manager to active semantic infrastructure—raising systemic risk and operational burden.
Governance takeaway: Treat OS-embedded agent features as critical infrastructure: strict resource controls, strong isolation, hardened storage, and default-off posture for high-risk capture/memory pipelines.
Pillar 6 — Labor Guardrails and Worker Protection
Why it’s implicated: Agentic systems alter work by automating multi-step tasks, changing supervision, increasing monitoring capacity, and shifting responsibility when errors occur. OS-level surveillance and agent logs can also be repurposed for workplace monitoring in ways that harm workers.
Governance takeaway: Establish guardrails against covert monitoring, require worker notice/consent for agentic surveillance features, and define accountability so workers aren’t blamed for opaque agent failures.
Pillar 7 — Market Competition / Anti-Monopoly Rules
Why it’s implicated: Embedding agents into the OS concentrates structural power. The OS can see and mediate everything, giving first-party assistants privileged access and making it hard for third-party apps (even secure ones) to compete on a level playing field.
Governance takeaway: Competition policy should address OS-level privilege, self-preferencing, and interoperability so the “intent layer” doesn’t become a monopoly choke point.
Pillar 8 — National Security & Responsible AI Use in Defense
Why it’s implicated: Agentic OS features create a high-value target for attackers and can undermine secure communications by capturing decrypted content at the endpoint. These risks scale into national security concerns when agents are used in sensitive environments or connected to critical systems.
Governance takeaway: Impose strict controls for agentic use in sensitive contexts: hardened endpoints, restricted tool access, red-team requirements, and default prohibitions on continuous capture/memory for high-security roles.
Pillar 9 — Deepfake & Synthetic Media Integrity Rules
Why it’s implicated: The presentation highlights synthetic/semantic manipulation risks (e.g., instruction hidden in content, malicious context, and exfil pathways). While not only about media, the same mechanics enable deception, forged context, and misinformation payloads that agents may ingest and act on.
Governance takeaway: Integrity rules should cover not just media authenticity, but also hidden-instruction payloads and provenance for content that agents can retrieve and treat as actionable context.
Pillar 10 — Consumer Protection & Rights
Why it’s implicated: Users are exposed to privacy loss, data exfiltration, unwanted automation, and difficult-to-undo delegation. The deck frames OS-level agent capture as a consumer-risk issue: centralized dossiers, opaque recommendations, and unclear liability for harm.
Governance takeaway: Consumer rights should include: opt-in defaults, clear off-switches, easy revocation, data minimization, and remedies when agentic systems cause loss (financial, privacy, reputational).
Pillar 11 — Government Capacity & Regulatory Infrastructure
Why it’s implicated: If OS-level agent features create systemic risk, government needs capacity to evaluate, certify, and enforce controls—especially for cross-cutting standards like logging, auditing, and secure tool protocols.
Governance takeaway: Build regulatory infrastructure for agentic systems: testing labs, incident reporting pathways, audit standards, and enforcement mechanisms that match OS-scale risk.
Pillar 12 — International AI Standards & Cooperation
Why it’s implicated: Agentic tooling, connectors, and protocols are global by nature. Supply-chain risk (tool servers, shared standards) and cross-border data flows mean that inconsistent rules create weak links and fragmented safety baselines.
Governance takeaway: Pursue international alignment on agent safety baselines: tool authentication, memory governance, logging/audit standards, and incident disclosure norms.
Pillar 13 — Review, Sunset, and Evolution Mechanisms
Why it’s implicated: The deck’s thesis is that these risks are architectural and evolving. As agents gain more memory and autonomy, both attack techniques and failure modes will change rapidly, requiring continuous revision—not one-time rules.
Governance takeaway: Mandate review cycles, sunset clauses for high-risk agent features, and adaptive updates based on real-world incidents and measurable harm.
