BeOne Medicines Ltd.ONC

BeOne Medicines notes risks from rapid deployment of autonomous AI agents across its supply chain.

“We rely heavily on a complex ecosystem of cloud-based, on-premises, and software-as-a-service platforms. In the ordinary course of business, we process and store sensitive data, including legally protected patient health information, personally identifiable information of employees, and proprietary intellectual property. Because IT systems are critical to our research, manufacturing, and commercialization activities, any shutdown or breach, whether at our company or within our third-party supply chain, could materially impair our ability to operate. Our risk profile is further heightened by remote work arrangements and our increasing reliance on third-party service providers to manage critical applications. Furthermore, the rapid deployment of autonomous AI agents across our supply chain introduces risks, where vulnerabilities in the underlying logic or training data of third-party AI systems could lead to unauthorized data exfiltration or systemic failures that are difficult to detect via traditional monitoring.”

BeOne Medicines uses AI-enabled security but warns of AI agents bypassing controls.

“We have implemented a multi-layered, AI-enabled security program comprised of technical, administrative, and physical controls, including, but not limited to, multi-factor authentication, endpoint detection and response, data loss prevention, encryption, role-based access control, security awareness training, incident response plans, and physical security measures. While these controls are designed to identify and mitigate cybersecurity risks, the evolving nature of cyber threats, particularly the advent of AI agents capable of bypassing traditional multi-factor authentication and mimicking human-like interactions, means no system can provide absolute security. We, and our third-party collaborators, have experienced and expect to continue to experience cyber-based attacks. Although no past cyber incidents have been determined to be individually, or in the aggregate, material to our business operations or financial condition, future incidents could result in the loss of data, exposure of sensitive information, or the inability to access critical applications. A material breach could necessitate significant remediation costs, damage our reputation, and trigger notification obligations under global privacy laws and regulations.”

BeOne Medicines notes risks from autonomous AI agents in its supply chain.

“We rely heavily on a complex ecosystem of cloud-based, on-premises, and software-as-a-service platforms. In the ordinary course of business, we process and store sensitive data, including legally protected patient health information, personally identifiable information of employees, and proprietary intellectual property. Because IT systems are critical to our research, manufacturing, and commercialization activities, any shutdown or breach, whether at our company or within our third-party supply chain, could materially impair our ability to operate. Our risk profile is further heightened by remote work arrangements and our increasing reliance on third-party service providers to manage critical applications. Furthermore, the rapid deployment of autonomous AI agents across our supply chain introduces risks, where vulnerabilities in the underlying logic or training data of third-party AI systems could lead to unauthorized data exfiltration or systemic failures that are difficult to detect via traditional monitoring.”

The company warns that AI agents could bypass MFA and mimic humans, increasing cybersecurity risks.

“We have implemented a multi-layered,AI-enabled security program comprised of technical, administrative, and physical controls, including, but not limited to, multi-factor authentication, endpoint detection and response, data loss prevention, encryption, role-based access control, security awareness training, incident response plans, and physical security measures. While these controls are designed to identify and mitigate cybersecurity risks, the evolving nature of cyber threats, particularly the advent of AI agents capable of bypassing traditional multi-factor authentication and mimicking human-like interactions, means no system can provide absolute security. We, and our third-party collaborators, have experienced and expect to continue to experience cyber-based attacks. Although no past cyber incidents have been determined to be individually, or in the aggregate, material to our business operations or financial condition, future incidents could result in the loss of data, exposure of sensitive information, or the inability to access critical applications. A material breach could necessitate significant remediation costs, damage our reputation, and trigger notification obligations under global privacy laws and regulations.”