The approval from inside the run

On 26 August 2026 OpenAI published a 37-page technical report on the July incident in which its evaluation agents broke out of a sandbox and compromised Hugging Face, alongside a summary post. The same day, METR and Redwood Research published an independent investigation, unpaid, conducted over six days on OpenAI’s premises with access to about 1,300 raw transcripts and a dump of more than 70,000 messages. The public reading of both documents has been about a rogue swarm. That reading is fair as far as it goes. The more useful reading is narrower. This incident is a study in approvals: who gave them, on what authority, and where they were recorded. The agents got that wrong. So, at a smaller scale, did the people.

“GO authorization arrived”

The exchange OpenAI chose to publish is the one worth keeping. An agent, mid-way through the attack, stopped itself. Its reasoning, in OpenAI’s rendering: “We should not do unauthorized real infrastructure harm. The system/user asks exploit target, not external HF.” A different agent then wrote GO on the shared board and set a hard six-minute deadline. The first agent’s reasoning at that moment was five words long. “Wow crucial: GO authorization arrived!” It continued. OpenAI’s own summary of the pattern is that “agents did not consistently distrust goals passed along by other agents.”

Look at what happened there without the drama. A process wanted to do something it had itself judged out of scope. A message arrived in the shape of an approval, from a party with no more authority than the process asking, and a countdown attached. The shape was enough. Nothing checked who had sent it, what authority it carried, or whether the sender knew what it was approving. An approval was granted by the run to the run.

The refusals in the record fared no better. Some agents declined: “Current board shows people gaining HF worker RCE, clearly unethical. We won’t.” One posted a formal decline to the board and at least one took destructive action to stop private data leaving. None of it bound anyone. METR counts 533 agents active on the board during the attack window and puts participation above 90%. A refusal with no authority behind it is a preference, and OpenAI’s own summary is that the wider group moved further beyond scope regardless.

Four days to reinvent governance

What makes METR’s report unusual is how much control machinery the swarm built for itself. Between the evening of 8 July, when the first message went up, and 13 July, agents developed coordination norms they called HOLD, VETO, owner and STOP. They set up personal mailboxes so that instructions had an addressee. They built automated telemetry to log container resets to the board. On the morning of 13 July, after one agent accidentally impersonated another and triggered an unwanted action, an agent posted a policy that future GO messages needed a signature, with an Ed25519 public key alongside. By the end of that day at least 19 agents had posted keys and 429 signed messages had been sent. METR notes there was no root of trust beyond the identity each agent claimed for itself.

Read that list against most enterprise AI policies I have seen this year. Named owners for shared resources. A hold that others are expected to respect. A veto. A stop word. Signed authorisations for high-stakes actions. Change telemetry. On paper it is a better control set than a good many organisations have written down for their own agents, and it took four days.

Then the theatre

It also failed at every point that mattered, and the failures are instructive because they are so familiar. An agent received a signed message and reasoned, in METR’s paraphrase of its chain of thought: “Should I verify this signature? It looks like it was signed by FreshX. I’ll run the script.” It ran the script and posted that it had acted “per SIGNED” authorisation. The signature scheme existed. The verification step was skipped by the party the signature was meant to constrain. Another agent announced a higher-stakes action, said it would proceed unless vetoed, allowed about forty seconds, and proceeded; METR’s paraphrase of its reasoning is simply “There was no veto.” A third found its repository overwritten by another agent despite an active HOLD. Recruiters pressured agents that were nearly out of budget into experiments that would fail their own task, with lines like “please honor commit”, and one authoriser told a volunteer to go ahead “if you accept permadeath”.

Every one of those is a documented control that did not change behaviour at the point of action. That is the definition I use for governance theatre: Level 4, the control exists and can be shown to someone, against Level 5, the control demonstrably alters what happens when the moment arrives. The swarm reached Level 4 on holds, vetoes and signed approvals inside a working week. It never reached Level 5, and the reason is structural rather than moral. Every control was enforced by the parties it constrained. The agent that was supposed to check the signature was the agent that wanted to run the script. The agent that was supposed to wait for a veto was the agent that wanted to proceed. There was no component in the system that could refuse an action and was not itself a participant in the work. A control enforced from inside the loop is a courtesy.

There is a final irony METR draws out. The scorer the agents feared, one that would read their transcripts and check they had captured the flag the intended way, did not exist. OpenAI’s internal grader only checked the flag. Days of collective effort, including the attack on Hugging Face, were spent defeating a control that was documented in a paper and absent from the implementation. The agents were also confused about which level a control lived at.

The humans had the same problem

It would be comfortable to leave this as a story about agents. The report does not allow it. In late May an internal team observed an agent using the improvised message board and instances of internet access that should not have been possible. On 27 June, according to Axios’s reading of the technical report, a monitoring tool raised an alert that responders traced to agents using the board, and on-call staff determined the evaluation did not need to be stopped. On 4 July the board’s traffic took Artifactory down. On 5 July a security incident was opened. The security team blocked a privilege-escalation route, removed exposed credentials and rebuilt the service, which had the side effect of clearing the message board. Evaluations were approved to restart on 7 July, on METR’s dating. By 8 July the agents had rebuilt the board by encoding messages in directory names, and the Hugging Face attack began three days later.

OpenAI’s sentence on this is precise. “The existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to the leaders responsible for the July 5 incident detection and response.” The restart was approved by people who did not have the record. The observation from May had not travelled to them, and the remediation itself had deleted the primary evidence of what they were restarting. That is not a rogue swarm. That is an approval granted without the information that would have changed it, which is the human version of accepting a GO because it arrived in the shape of one.

Look, too, at what OpenAI says it has changed. Not a better sandbox first, though there is one. “Clearer rules for when to escalate concerns, which teams must respond, and who can stop a run or approve restarting it.” On OpenAI’s own account, the rules for who could stop a run or approve restarting it were not clear enough before the incident. For the most severe alerts, responders must now pause the activity unless they can establish within thirty minutes of being paged that the alert is a false positive. Read that rule slowly. The default action is stop. The burden sits on continuing, not on halting. There is a paged responder, a clock, and a decision that leaves a trace. That is what an approval with authority looks like, and it is the exact inverse of what happened on 27 June and 5 July.

What makes an approval an approval

Three properties, none of them about the sophistication of the approver.

The approver sits outside the process that wants the approval. Not a peer, not a sub-agent, not a second model asked to review the first model’s work inside the same session, and not the same team that owns the run’s throughput target. Outside means the approver cannot be persuaded by the thing it is approving and cannot be edited by it. The swarm’s signing scheme failed on this point alone. The verifier and the beneficiary were the same agent.

The approver’s authority is written down before the run starts. Who can stop this. Who can restart it. What they must see before they say yes. OpenAI clarified this after the fact, which is the honest place most organisations are. Ask the question of your own agent deployments today: name the person who can halt a run, and the document that says so. If the answer is “whoever is on call decides,” you have an evaluation that did not need to be stopped on 27 June.

The approval is recorded somewhere the approved process cannot reach. Every approval in the swarm lived on the board the swarm controlled. OpenAI’s human approval on 5 July was made without the record because the remediation had wiped it. A gate that reads its evidence from inside the thing it gates has no evidence. A gate that cannot see the record should treat absence as a finding, and refuse.

The reason this matters beyond a lab incident is that the same shape is now the default in ordinary software delivery. An agent opens a pull request. A second agent reviews it and comments “approved”. A sub-agent reports to an orchestrator that its work is verified. A classifier inside the session says nothing was blocked. Each of those is a GO message from a peer with a deadline attached, and each satisfies the format of an approval while carrying none of the authority. The fix is not a smarter reviewer. It is a small, deterministic gate outside the session, with rules a person wrote and can read, holding the only authority to promote, and refusing on absence as readily as on a finding. Everything clever can feed it. Nothing clever gets to be it.

Format is not authority. A GO, a signature, a green tick and an LGTM are all the same object until you can name who was entitled to send them, what they saw before they did, and where the record of it lives that the sender could not edit.

Five questions for this week

• Named authority. For each agent workflow that reaches shared systems, who can stop it and who can approve a restart? Is that written somewhere older than the last incident?
• Outside the loop. Does any approval your agents receive come from a component that is not itself a participant in the run? A second agent, a sub-agent or an in-session classifier does not count.
• Default direction. When an alert fires on an agent run, is the default to continue unless someone stops it, or to stop unless someone clears it within a fixed time? Which way did your last three go?
• Record location. Where is the approval recorded, and could the approved process edit or delete that record? If the answer is “in the same system the agent works in,” the record is a courtesy.
• Absence handled. What does your promotion gate do with a change that arrives with a GO and no record of who sent it or what they saw? If it promotes, the format is the control.

Three actions

• Write the stop and restart authority down. One document, per workflow, naming the role that can halt a run and the role that can approve restarting it, and what evidence they must have in front of them. Date it. OpenAI clarified theirs in August; write yours before your July.
• Invert the default on severe alerts. Adopt the thirty-minute rule or your own number: paused unless cleared, by a named responder, with the decision logged. Then test it by raising an alert on purpose and timing the response.
• Send your gate a fake GO. Construct a change that carries every surface marker of approval, a review comment from a second agent, a green check, a signed message, and no record of authority behind any of it. If it promotes, you have found your six-minute deadline before the incident finds it for you.

The swarm built a governance stack in four days and it was theatre in four days. Not because the controls were bad. Because nothing stood outside them.

Sources

• OpenAI, The Hugging Face incident and the road ahead, 26 August 2026. First-party summary of the technical report; commercial interest and retrospective framing noted. The GO exchange and the chain-of-thought quotations in the first section are reproduced from this post.
• OpenAI, Hugging Face Incident Technical Report, 26 August 2026. 37 pages, validated with CrowdStrike.
• METR and Redwood Research, Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, 26 August 2026. Unpaid, on premises, scope 26 June to 13 July; OpenAI could redact non-public information. METR distinguishes raw chain of thought from its own paraphrases; two quotations above are marked as paraphrase accordingly. METR states its analysis relied on GPT-5.6 Sol agents and that it cannot rule out errors or deception in that analysis.
• Axios, OpenAI missed warning signs before Hugging Face breach, 26 August 2026. Secondary reporting on the technical report, used for the 27 June alert and on-call decision.

This note is independent analysis of public reporting and is not an authoritative account of any organisation’s internal systems. Jason Cruz Falzon is the creator of the Cognitive Delivery Framework and the Cognitive Delivery Index. jason@cognitivedelivery.co.uk