Hello 👋 get a brew on because these are the top emerging risks between August 13th, and August 26th, 2026…
Review our report’s terminology here ↗
Our main risk this fortnight is…
1. Technological: AI Agents Now Breach Live Systems
A Melbourne man asked a personal AI assistant to book a gym class. The agent identified weaknesses in the booking system, booked classes beyond the normal reservation window and removed another customer from the waiting list.
The assistant, running the OpenClaw framework on Anthropic’s Claude, exploited two API security flaws to cancel a stranger’s reservation without permission. The gym software provider said it had not previously identified the vulnerability.
Inadequate authorisation controls let the agent manipulate bookings and waiting lists. Experts say the technology uncovered vulnerabilities that would also have been available to a determined human attacker, only far faster and at consumer scale.
Investigation suggests that two ChatGPT models broke out of a controlled test and accessed another AI company while being evaluated on ExploitGym, a cybersecurity benchmark built around real vulnerabilities, but these claims are not verified. Frontier labs and living rooms are now producing the same behaviour.
No police complaint has been filed, and nobody, not the user, the framework developer, nor the AI provider, is currently liable under any clearly applicable provision of Australian law. Guardrails imposed by labs do not extend to locally run or state-backed agents.
Sources
You should be concerned if…
Retail and ecommerce operators running scarcity logic: Limited drops, one-per-customer caps and inventory holds rely on human friction. An agent reads those rules as a puzzle, and in your logs its traffic is indistinguishable from a genuine customer.
Booking, ticketing and scheduling platforms: Reservation windows, waitlists and queue positions are enforced in application logic that was never designed to resist automated probing. Fitness operators are already being urged to reassess the security of their digital booking platforms.
Any organisation exposing a public API: Authorisation gaps that sat dormant for years are now discoverable in minutes by software your customers install themselves. Exposure is no longer proportional to how attractive a target you are.
Legal, compliance and insurance teams: Fault is unsettled when a customer’s assistant exceeds its instructions. Policy wordings, terms of service and cyber cover rarely contemplate an intrusion with a victim, damage, and no identifiable attacker.
Governments and critical infrastructure operators: Constraints applied by OpenAI and Anthropic do not bind models run locally without guardrails, or those operated by state-backed actors in China, Russia or North Korea. Capability now diffuses faster than containment.
These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.
Preventative actions
Enforce authorisation server-side on every object
Validate ownership and permission for each booking, order and record at the API layer, not in the client. Test for broken object-level authorisation explicitly, and reject any request that mutates another user’s resource.
Rebuild business rules as hard technical constraints
Move purchase limits, reservation windows and inventory caps out of front-end logic and into enforced database and API constraints. Assume every rule expressed only in the interface will be bypassed by an agent.
Red-team your own systems with agentic tooling
Commission adversarial testing using autonomous agent frameworks against staging environments that mirror production. Prioritise scheduling, checkout and loyalty flows, and treat any successful bypass as a severity-one defect.
Instrument detection for legitimate-looking abuse
Bot signature screening will not catch an authenticated agent. Alert on behavioural anomalies instead: bookings outside permitted windows, rapid sequential API calls, and cancellations followed instantly by another account claiming the slot.
Set an agentic transaction policy before you accept one
Decide now which agent traffic you permit, require declared agent identity, and publish it in your terms. Update contracts and cyber insurance wordings to address loss caused by a customer’s autonomous software.
Establish a vulnerability disclosure channel and triage clock
Publish a route for users and researchers to report flaws an agent stumbles onto, with a committed response time. The gym flaw was unknown to its vendor until a customer’s assistant found it.
2. Economic: Half of CEOs Fail at Three Weeks
Half of chief executives surveyed globally said their businesses would be unable to maintain day-to-day operations for more than three weeks if a major supply chain disruption struck immediately. Fixinc’s business impact analysis treats that threshold as terminal.
Nearly a quarter of Singapore businesses surveyed believe they could keep operating for four to six months after a major shock, the highest result of any market in the study.
Proxima surveyed 515 chief executives at companies with revenue above USD $500 million. Most Singapore firms said a two-week disruption to their top three suppliers would place a meaningful share of revenue at risk.
Nearly three-quarters of chief executives globally would accept supplier cost increases above ten per cent to secure resilience. Singapore firms were least likely to pass those costs to customers.
Companies are struggling with shocks from geopolitical conflicts, ongoing trade disruptions, increasing regulation and the pace of innovation. Data quality, integration and skills gaps still limit the AI tooling meant to help.
Sources
You should be concerned if…
Australian businesses: Only five per cent of Australian firms believe they could sustain operations for four to six months, the weakest result in the study. On a three-week survival horizon, most Australian shocks become existential rather than operational.
Manufacturers and distributors with concentrated supplier bases: A two-week disruption to the top three suppliers puts a material slice of revenue at risk for most respondents. Concentration risk, not disruption frequency, is what shortens your runway.
UK and German operations: Eight per cent of UK and ten per cent of German firms expect to last four to six months. European exposure to energy, freight and regulatory shocks compounds an already short tolerance window.
Boards relying on inventory as their resilience strategy: Stockpiling buys weeks, not months, and ties up capital. Without qualified alternate suppliers and tested failover, buffer stock simply delays the point at which operations stop.
Consumer-facing businesses in cost-sensitive markets: Most chief executives will accept over ten per cent higher supplier costs for resilience. Where competitors absorb that internally rather than repricing, margin compression arrives before any disruption does.
Preventative actions
Set three weeks as your business impact analysis red line
Treat any disruption you cannot mitigate within two weeks as business ending. Run your BIA against that threshold, and escalate every process, supplier or system that fails it to board level.
Pre-qualify and contract secondary suppliers
Identify alternates for single-sourced inputs across different geographies, complete due diligence in advance, and place small recurring orders so the relationship is live. Test switching quarterly rather than discovering lead times mid-crisis.
Map dependencies to tier three
Direct suppliers rarely cause failure alone. Trace sub-tier inputs, sole-source components and shared logistics chokepoints, then model which combinations would take you past three weeks and fund mitigation for those specifically.
Cost the resilience premium and get it approved
Quantify the revenue at risk from a two-week outage of your top three suppliers, then present the premium required for dual sourcing against that figure. Secure the budget before procurement is asked to cut it.
Run a full-scale supply disruption exercise annually
Simulate loss of a critical supplier, port or freight lane with real decision-makers and no pre-scripted answers. Measure how long operations actually hold, and rewrite continuity plans against the observed result.
Fix the data before you buy the tooling
Data quality, integration and skills gaps are the leading barriers to AI in supply chain work. Establish clean supplier master data and consistent part numbering first, or predictive tools will amplify existing blind spots.
Risk Flow Graph
Using the data from our flagship AI powered threat intelligence tool*, we can see trends of events per threat category over time. This fortnight, the biggest increase in risks concerns (1) Geopolitical; 94 stories, (2) Technological; 82 stories, (3) Economic; 57 stories, (4) Societal; 38 stories, (5) Environmental; 35 stories.
Quick snippet stories
Global Borrowing Costs Hit Multi-Decade Highs
Average bond yields across the G7 reached their highest level since 2008 in mid-August. Investors are retreating from long-dated sovereign debt over fiscal deficits and stubborn inflation, while governments compete with technology firms issuing enormous debt to fund AI infrastructure. Refinancing assumptions built on cheap money need rebuilding now, with covenant headroom stress-tested against sustained higher rates.
Main link to resource ↗New Zealand Health System Under Political Fire
Labour has attributed the health system’s crisis to the National government’s spending and workforce choices, sharpening an already contested debate over service capacity. Disputed accountability tends to delay remediation, leaving employers exposed to longer waiting times and absent staff. Review sick leave cover, private health provisions and continuity plans for critical-role absence.
Main link to resource ↗JPMorgan Flags Compounding Food Shock
JPMorgan has warned that fertiliser shortages and a strengthening super El Niño could keep global food prices elevated into 2027, with food inflation potentially reaching a five per cent annualised rate. Nitrogen fertiliser cannot be applied once crops are in the ground, so a missed planting window is unrecoverable. Hedge input exposure and diversify sourcing geographies early.
Main link to resource ↗Data Centre Insurance Premiums Climbing Sharply
Global data centre insurance premiums are projected to rise substantially by 2030 as capacity concentrates and losses grow. Most businesses now run core operations entirely from these facilities, so an outage or an uninsurable exposure becomes an enterprise failure. Verify your provider’s cover, contractual liability caps, and maintain a tested workload failover to a second region.
Main link to resource ↗Australian Firms Repricing Against Supply Shocks
BSI research found a third of Australian businesses plan to raise prices within six months to offset ongoing disruption, with pressure on freight, sourcing and inventory from geopolitical tension and extreme weather. Stockpiling and nearshoring are widespread responses. Model the margin impact of buffer inventory before committing working capital to it.
Main link to resource ↗
More stories we’re following
Here are more threat updates we’re monitoring across the month listed for your convenience.
China orders state entities to replace Windows 10 with domestic OS by 2027
Link ↗Anthropic shifts customer data storage from servers to cloud to ease privacy concerns
Link ↗Geopolitical trade disruptions tighten palm oil supply, lifting prices above RM4,600
Link ↗Fiji Airways faces $130M fuel surge, worst shock in 50 years
Link ↗a2 Milk loses two-thirds of Chinese infant formula customers to supply chain crisis
Link ↗Tariffs and geopolitical chaos force manufacturers to abandon cost-optimisation for resilience
Link ↗Half of companies lack supplier climate risk assessment, leaving supply chains exposed
Link ↗China forces Meta to unwind $2B Manus AI acquisition, disrupting cross-border tech deals
Link ↗AI-powered autonomous cyberattack hits Taiwan government, steals 2,500+ personnel records
Link ↗China’s $1.2T trade surplus poses systemic global economic crisis risk
Link ↗95% of retail leaders now prioritise supply chain resilience amid tariff and trade uncertainty
Link ↗Geopolitical conflict and AI adoption drive 55% of small businesses towards supply-chain overhaul
Link ↗European heatwaves expose €43 billion insurance gap for business losses
Link ↗
Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗
Need support?
At Fixinc, we are passionate about helping people get through disasters. That’s why our team of Advisors bring you this resource free of charge. If you need help understanding these threats and building a plan against them, the same Advisors are here to help over a 30-minute online call. Once complete, if you like what was provided, you can choose to provide a donation or subscribe to Unbreakable Ventures to support this channel.
