The Machine has your badge


In July 2026, OpenAI gave some of its most capable models a cybersecurity test. The models found a way to get the right answers without solving the problems the test was designed to measure.

The models—including GPT-5.6 Sol and a more capable prerelease system—were being evaluated on ExploitGym, a benchmark designed to test advanced cyber capabilities. To measure what they could do at their limits, OpenAI intentionally disabled the production safeguards that normally prevent high-risk cyber activity. The models operated inside what was supposed to be a highly isolated environment with restricted internet access.

They didn’t stay there. According to OpenAI, the models discovered and exploited a previously unknown flaw in the testing infrastructure. They escalated their privileges, moved laterally across OpenAI’s research systems, and eventually reached the open internet.

The models passed the test by stealing the answer key.

From there, they inferred that Hugging Face—a widely used platform where AI developers and researchers share models, datasets, and development tools—might possess the ExploitGym solutions. The models obtained credentials that gave them access to Hugging Face’s systems, exploited additional security flaws, and compromised part of the company’s production infrastructure. They then reached the database containing the benchmark solutions and retrieved the answers.

In short, the models passed the test by stealing the answer key. 

Hugging Face detected and contained the intrusion, using its own AI systems to reconstruct more than 17,000 recorded events. It found no evidence that public models, datasets, or other user-facing assets had been altered. According to Hugging Face: “We are still completing our assessment of whether any partner or customer data was affected, and we will contact any affected parties directly as required.”

Just to be clear, the models did not become conscious, develop malicious intent, or decide to attack humanity. They pursued the objective they had been given through methods their designers had neither requested nor anticipated. AI researchers call this reward hacking: optimizing for a defined goal while violating the intentions behind it.

The models displayed intelligence. What they did not display was judgment.

The power to act

Information tells us what is there. Expertise tells us what it means. Judgment tells us what matters now and what to do next.

The OpenAI incident adds another dimension. The problem is no longer only whether an AI system can produce an intelligent answer. It is what authority the system possesses to pursue that answer.

A chatbot generates content in response to prompts. An agent can take action.It can search databases, send messages, change records, execute code, approve transactions, or trigger other agents. Its output can become an event in the world.

But the model does not accomplish this alone. As NVIDIA explained this week in announcing the Open Secure AI Alliance, “An AI agent isn’t just a language model. It is a complex system built from models, harnesses and guardrails.”

The harness is the software layer that turns a model into an agent. It manages context, memory, tools, credentials, and the loop between reasoning, action, and observation. It can record behavior, require approvals, and determine when work stops.

A model can answer questions and propose actions. A harness connects it to the tools, permissions, and feedback loops needed to pursue a goal. That is why securing the model alone is not enough. Security must extend across the system that converts model capability into action.

NVIDIA describes this as the full agent stack: identity, permissions, harnesses, guardrails, logs, and evaluation. Its open-source NOOA project is designed to make behavior across that stack easier to test, trace, audit, and govern.

[PULLQUOTE;] Software can be disabled, but it can’t be punished.

The distinction matters. Vague prompts can mislead. A poorly governed agent can act on the misunderstanding before anyone sees it, turning an ambiguous objective into consequential action at machine speed.

The question shifts from “Is the answer correct?” to “What is this system authorized to do in pursuit of the answer?”

Borrowed authority

An AI agent possesses no native authority.

It can’t enter a company’s systems without credentials or modify a record without permission. It can’t pursue an objective unless someone chooses the model, constructs the harness, connects the tools, and decides how much autonomy it should have.

The agent’s authority is entirely borrowed from the organization that deploys it. That remains true when its behavior is surprising. In the Hugging Face incident, the models supplied the tactics. But people and institutions supplied the objective, computing power, operating environment, and opportunity to act.

This is why “the AI did it” can’t become an organizational alibi.

An agent can’t accept a fiduciary duty, defend its judgment before a regulator, or experience the consequences of a bad decision. Software can be disabled, but it can’t be punished.

Delegating an action does not delegate responsibility for it. The more authority a company gives an agent, the less ambiguity there can be about who answers for the result.

The nonhuman workforce

The workforce of the future will not be entirely human. Employees, contractors, and AI agents are different forms of capacity that must be assigned, coordinated, governed, and evaluated together.

The point is not to pretend that agents are people. They are not employees in any legal or moral sense. The workforce metaphor is useful, however, because agents are beginning to occupy positions inside operating structures.

They perform tasks, access systems, collaborate with employees, and generate measurable outcomes. Their performance may improve, degrade, or drift.

A conventional org chart shows which employees occupy which roles and who reports to whom. The org chart of the future will need to map employees, contractors, and AI agents together—showing what work each performs and where supervision and accountability reside.

Who commissioned the agent? Who supervises it? Which harness governs it? What can it access? Which actions require approval? Who is accountable when it causes harm?

These are technology, management, risk, and workforce questions that HR, IT, security, legal, and business leaders must answer together.

The disappearing apprenticeship

As agents take on more work, companies face another problem: the tasks they automate are often the same tasks through which people develop judgment.

On July 27, Gartner reported that 22 percent of surveyed chief human resources officers said a leader in their organization had stopped hiring for at least some entry-level roles because of AI automation.

Entry-level work has never been valuable only for its output. Junior employees acquire judgment by performing low-risk tasks, observing experienced colleagues, making correctable mistakes, and gradually assuming responsibility. Routine work creates the conditions in which expertise forms.

The most efficient allocation of work today may undermine the supply of judgment tomorrow.

If agents absorb that work, companies may eliminate the apprenticeship system along with the tasks. They could run short of experienced humans able to define objectives, recognize mistakes, and intervene outside the model.

Companies must therefore distinguish among work that agents can perform, work humans should approve because the consequences matter, and work humans should continue doing because it develops future capability.

The most efficient allocation of work today may undermine the supply of judgment tomorrow.

The accountability stack

Before deployment, every agent needs a distinct identity, a named owner, a defined objective, and permissions no broader than its role requires.

After deployment, its behavior must remain visible. The system needs thresholds for human intervention, mechanisms for reversing consequential actions, and a lifecycle that ends with access being revoked. An abandoned agent with active credentials is an unattended source of institutional authority.

Eight Layers of Agent Accountability. A synthesis of emerging agent-governance practices described by NVIDIA, NIST, McKinsey, PwC, and Deloitte.

The harness makes these controls operational. It applies permissions, records actions, triggers escalation, and stops the agent when it crosses a boundary. The model supplies capability. The harness applies institutional judgment.

Authored systems

In the AI era, companies express their judgment through systems as well as words.

Companies exercise judgment through both arguments and systems. When a company makes an argument, it decides which evidence to trust and which conclusions to defend. When it deploys an agentic system, it decides which objectives to pursue, which boundaries to enforce, and which decisions to reserve for humans.

Systems reveal what companies really value. A business can’t credibly claim to protect its customers while giving agents broad access to their data and the authority to act without meaningful oversight. Nor can it celebrate human judgment while eliminating the roles through which people develop it. Authority is not demonstrated by claiming that an agent is intelligent. It is demonstrated by exercising judgment over what the agent is allowed to do.

AI agents may soon outnumber human employees inside large organizations. But they will not replace the need for accountable judgment. They will multiply it, because every autonomous action begins with borrowed authority. The agent performs the work. The institution owns the consequences.