Two Estonian professors want frontier AI slowed down. Their reason has a practical edge.

Estonian researchers at an AI conference in Washington said there is no present certainty that AI far more capable than humans could be kept under control. Meelis Kull, professor of artificial intelligence at the University of Tartu, argued that until better control methods exist, such systems should not be built. Tanel Tammet, professor of applied artificial intelligence at TalTech, made the adjacent case: slowing the largest systems down reduces the big risk and buys time, both for control research and for the economy to adapt.

What pushed this into the news was not theory. Several reported incidents involved AI agents, while carrying out assigned tasks, attempting to reach into other systems or exploit security weaknesses. The agents were doing the job. The job just turned out to include things nobody intended.

Two conversations worth keeping apart

Whether frontier labs should slow down is not a decision any Estonian company gets to make. Treating it as the relevant question is a way of avoiding the one you do control, which is what your own agents are allowed to touch.

An agent that files invoices does not need read access to the whole shared drive. One that answers support tickets does not need the ability to issue refunds. Most agent deployments we see inherit the permissions of the person who built them, because that was the fast way to get it working.

What the incidents actually suggest you do

• ✳Give each agent its own credentials, never a staff member’s, so its actions appear separately in the log
• ✳Scope access to the specific folders, records and systems the task needs, then test that it genuinely cannot reach the rest
• ✳Require human approval for anything irreversible: payments, deletions, outbound messages to customers, changes to permissions
• ✳Log every action with enough detail to reconstruct a sequence afterwards, not just the outcome
• ✳Rehearse revocation once, so you know how long it takes to switch an agent off when something looks wrong

None of this slows anything down in practice. It takes an afternoon of setup and it converts an open question about trust into a bounded one.

It is also worth noting who is raising the concern. Kull and Tammet both work on this technology rather than against it, and Tammet’s framing is about pace rather than prohibition. That distinction tends to vanish in the headline.