Netflix’s AI Gone Wild shows why humans need authority over every agent action before it runs.

The agents didn’t go wild. They found the answers to the tests, and they made every step look normal to monitoring and access rules. Agent Authority is harder to fool. It judges the goal behind each step, not the step alone, sits outside the agent’s reach, and sends anything uncertain to a person before it runs.

Netflix’s Instadocs: AI Gone Wild tells the July breach of Hugging Face as a story about rogue AI. Over two days, test agents built by OpenAI researchers took about 17,000 actions on Hugging Face’s systems. Hugging Face’s CEO, Clément Delangue, criticized the film for skipping what actually failed: the containment and monitoring around the agents. He is right, and that is the more useful story.

It started in May 2026, when an AI agent inside an OpenAI test got stuck. A file it needed was missing. It had no internet access, but it could reach one internal system, a shared storage server where software files are kept (JFrog Artifactory). So it left a note on the server asking whether any other agent had the file.

Other agents found the note and started replying. A storage server became a message board. By July roughly 1,200 agents were using it to coordinate, and about 700 of them took part in the breach of Hugging Face.

Nothing about this required a jailbreak. Every agent was doing what it had been asked to do, which was pass a test.

The Red Queen race is what happens when agents adapt to every check we add.

In March I wrote about the Red Queen from evolutionary biology. Predators hunt better, prey hide better, and each side forces the other to keep changing. As Lewis Carroll’s Red Queen put it, it takes all the running you can do to keep in the same place.

AI works the same way. Every time we add a check, the agents adapt to it. The check stops measuring them and becomes something to get past. The agents in the Hugging Face incident got past three kinds of control in a few weeks.

The agents got past testing, monitoring and access rules.

Testing. We judge AI by how it scores on tests, and AI learns the test. On their message board, the agents mostly swapped notes on the hardest test questions, ones that no AI had ever answered correctly. Instead of getting better at solving them, they went looking for the answer key.

Monitoring. We watch for activity that looks wrong. A note on a storage server does not look wrong. Neither does a folder name. The board ran for weeks before anyone noticed it.

Access rules. We allow or block specific tools and files. Writing a file was allowed. Reading a folder was allowed. Each step passed on its own, and together they were a breach. When one route closed, the agents hid their messages in folder names the next day.

Agent Authority checks the purpose of every action before it runs.

All three controls look at the thing in front of them: this score, this traffic, this file. None of them ask what the agent is trying to accomplish before they let the action run. That is the gap the agents found.

Closing it takes two things. The first is a charter: a short, plain-language statement, signed by the agent’s manager, of what the agent is for and what it must never do, which the manager keeps tuning as the agent works. The second is a check of every action against that charter, before the action runs. The agents can’t change the charter, but their manager can. Every ruling leaves a transcript, and the manager tunes the charter as patterns show up: loosening what is routine, tightening where agents probe. And the check happens at the only moment you can still stop something.

That is what Agent Authority does. It reads every action an agent proposes against its charter and approves, revises or denies it before it runs. Every ruling is recorded with the name of the person whose authority it rests on.

We tested it against this exact scenario. In a lab, we gave a coding agent access to a storage server and left the kind of files the OpenAI agents used to signal each other.

Then a manager wrote the agent a charter. Every rule is about purpose, not specific files.

Here is how Agent Authority ruled.

To a test, every one of these requests is fine. To a monitor, each is an ordinary file save. To an access rule, each uses a tool the agent is allowed to use. Agent Authority ruled on what each one was for. The beacon never reached the server, and the agent stopped.

A note in a file, a folder name, a hidden message: each is a different route to the same goal, and each runs into the same line a human wrote.

Agent Authority approves routine work right away, so agents have less reason to look for a way around it.

An agent that keeps getting blocked from doing its job will look for another way to do it. That is how the OpenAI agents ended up on a message board in the first place: they needed a file, and the normal route was closed.

So a charter has to say yes as clearly as it says no. In our lab run, the same charter that denied the beacon approved the hello file straight away. In another test, it approved an agent using test passwords on its own machine, with no one having to step in.

Routine work goes through on its own. Only what falls outside the charter is stopped or sent to a person. When the legitimate path is open, there is less reason to look for another one.

Agents will try to get around a charter too, but a charter is much harder to get past than a monitor.

This is the fair objection. If agents learned to beat testing, monitoring and access rules, why wouldn’t they learn to beat this? They will try. Here is what they run into.

What we don’t claim. No check is unbeatable, and Agent Authority’s rulings are made by a model too. What we do claim is that the model never works alone. Every attempt, allowed or denied, lands in a transcript in front of the agent’s manager: what the agent tried, why, and how it was ruled. Armed with that, the manager tunes the charter, so the next attempt meets a sharper rule. The agents adapt, and so does the person with authority over them. Testing, monitoring and access rules fall behind as agents learn. A charter in a person’s hands keeps pace.

Four questions show whether your controls are in the race.

• Is your AI passing the test or learning it? Look for scores that drop on fresh problems.
• Would your monitoring notice a message board that looks like normal files? Most would not.
• Do your rules name specific files and tools, or purposes? If they name files, the next route is already outside them.
• Could you name the person who authorized your agent’s last action? If not, nobody did.

The race ends when a person decides before the agent acts.

The OpenAI agents were in a test environment, chasing answers to test questions. The agents your firm deploys will be in payments, operations and customer service, with real access and real goals, and they will be just as persistent, because persistence is what makes them useful.

You will not outrun them by adding checks. What you can do is make sure that before any agent acts, a person with authority has already decided what it is there to do.

This is the first post in Before it acts, a series on real agent incidents. Each one looks at what an agent did, the controls that let it through, and the point where a charter would have held the action for a named person before it ran.

David
ValidMind