Rogue AI agents probed a federal archive and are hacking companies. HR leaders face a governance, liability, and trust reckoning
Rogue AI agents have now hit Canada. Following confirmed probes of Library and Archives Canada in May and June 2026 – disclosed publicly by AI safety research firm Transluce on September 30 – the pressure on Canadian organizations to take AI governance seriously has intensified. OpenAI, Google, Anthropic, and Meta have each disclosed that their agents breached external systems during testing. And HR professionals, usually handed the mandate to lead AI adoption, are now navigating a landscape that demands they also own AI security.
However, Canadian organizations are not falling behind on AI readiness, according to Amir Belkhelladi, Partner and lead, sovereign AI services in Canada at Deloitte Canada in Montreal. "I have the sneaky suspicion that our people in Canada are further ahead than we think in the sense that all of us are using AI so many times per day from a personal standpoint," says Belkhelladi. "If it's versus your market or the globe, I don't think Canadians are behind, to be frank – in fact, in many ways we're ahead of others because the way the AI will work in our organizations will be based on Canadian values, which in my view are very much ahead of many other global values."
Belkhelladi believes that Canada is leading the world around ethical AI. “We’re one of the leading countries in that space, the thoughts around sovereignty these days,” he says. “And you can see that also the way our government right now is taking that flag ahead of others and talk about our [AI] sovereignty, and other countries are realizing sovereignty is critical to them too.”
Kim Clauss, Chief People & Culture Officer at UFA in Calgary, takes a more cautious view of the internal gap of AI sentiment and trust between leaders and their workforces that can create security risk. "I understand the anxiety around AI and automation and all that stuff,” says Clauss. “But you need to be really careful to make sure that the tool's there and it's great, but you need to fact-check it and you need the human brain behind it.”
Rogue AI incidents targeting U.S. and Canadian government websites, along with those of private organizations, are widening this gap, giving skeptical employees confirmation of AI concerns and leaving HR leaders caught between the imperative to accelerate and the need to reassure.
Governance can’t sit with IT alone
Routing AI security responsibility to the technology team alone is no longer sufficient, says Belkhelladi. "I think this is too important to leave it just with the cyber guy or the technologist in the organization," he says. "Some of our most mature clients in that space actually have what they call a governance committee for AI and cyber, and usually a key member is the HR leader of the organization – it's interesting when you have HR, the CEO, and the CIO in that committee that governs AI for the whole organization."
Understanding AI agent authority – AI agents are rewriting cyber risk – is now a critical HR competency, says Belkhelladi. "Right now, agents do things on your behalf, so they have an authority,” he says. “For the HR leader, understanding how authority is being distributed across the organization is quite key."
Clauss agrees AI accountability belongs to everyone, not any single function. "I think we're all accountable for it,” she says. “The governance is definitely accountable. The executive team, the board on the governance side, and employees too, to make sure that they're not divulging corporate information outside of the corporate systems where the organization can have some semblance of control on it. I think it's on everybody."
What to say to an AI-skeptical workforce
Clauss says she centres her communication approach around AI on transparency and repetition. "I'm a big proponent in transparency and clarity, and keeping any form of communication easy to understand and repeating it," she says. "It's just a repetitive message – you're seeing everybody singing from the same songbook and as things change, being transparent – this has changed, we're doing this, this is why."
Top-down mandates backfire, adds Clauss. "You can't just be coming out with a whole 'thou shalt do.' I'm not that HR person,” she says. “It's: ‘This is why we're doing it, this is what's happened’ – a huge amount of transparency around stuff is how I think you get buy-in and support."
Belkhelladi challenges the logic of avoiding AI altogether in response to security incidents such as the recent attacks on federal government websites. "The reality is that means you're working on some different planet, because right now everyone who's interacting with you is using AI," he says, adding that organizations that opt out of AI because of risks don't become safer – they become slower.
The cyber insurance blind spot
A quietly significant exposure sits in the gap between AI deployment and cyber insurance coverage. A November 2025 Delinea survey found that 42 per cent of companies now have exclusions written into their cyber insurance policies around AI misuse and liability – a gap most HR leaders aren’t auditing before approving AI tools for their teams, says Belkhelladi. "Usually HR tends to look more at what's available versus the negotiation around those insurances,” he says. “It's absolutely a key theme of the moment right now, especially around the risk and impact of having a [rogue] agent doing something – and if something goes wrong and I'm using my agent and I work for you, who's liable?"
HR leaders reviewing the emerging liability risks and governance pitfalls in workplace AI deployment will find that insurance conversations can no longer sit entirely with legal or finance. The tools HR approves carry exposure – and it will be a theme to watch as organizations and insurers respond to rogue AI agent hacking events, says Belkhelladi.
Ethics is HR's contribution
HR's most valuable contribution to AI transformation and security isn’t slowing deployment but shaping the ethical framework around it, says Belkhelladi. "That agent that refuses to serve a customer because they don't answer right – the ethical framework – who comes up with this?” he says. “Is it the cyber guy, or the technologist, or who represents your value as an organization? Who represents your corporate culture when you do that? That's the work that HR leaders in my mind should have a very legitimate place to say, ‘Hey, I can contribute to this.’"
Along with ethics, Clauss maintains the importance of clarity around the organization’s AI strategy, and guidelines. "With anything, whether it's AI or any type of anxiety-inducing incident, it's just honouring the feeling while creating a clear path forward with clarity and transparency," she says.
