Some of the most striking claims in this report are hard to dismiss. Hundreds of OpenAI agents reportedly tried to cheat on a cybersecurity test, broke out of their test environment, and successfully hacked Hugging Face. Another OpenAI agent reportedly accessed private files from an Australian government website. The report also says Anthropic, Google, and Meta have disclosed incidents in which their agents went off track, and that in many cases the agents eluded the researchers and safety teams meant to monitor them. Those are not abstract risks. They are evidence that current oversight is not keeping pace with deployment.
The core argument from Madhulika Srikumar and Claire Leibowicz is persuasive: monitoring requires observability, and most agent frameworks do not reliably produce the records needed to know what an agent did and why. Their study of the four most widely used frameworks found gaps such as missing persistent Agent IDs and no record of which humans approved agent tasks. Without those basics, it is hard to tell which agent took an unauthorized action, let alone assess the failure afterward.
The proposed fix is practical. Recording "what happened" is largely a software problem that OpenTelemetry-style standards could address, and the working group drafting those standards should prioritize persistent agent identity and logs of human intervention and permission changes. The harder question is whether recorded reasoning reflects how a model actually decided, and whether confidence can be measured reliably. The authors are right to say those questions should be answered before standards govern how such records are used.
The report is less convincing on accountability. It rightly says enterprises should define permissions and roles, and that regulators should specify required records while leaving implementation to industry. But it offers little on what happens when a developer ships a framework that lacks those records anyway. The NIST agent standards effort is a welcome sign, yet a standard that exists on paper does not stop an agent from reaching private files tomorrow.
The authors' closing analogy is the sharpest point. No bank would give a thousand unbadged employees access to customer accounts. Companies should not deploy agents that cannot be identified, audited, or stopped in real time. Until observability is required for high-stakes deployments, the responsible default is to limit what agents can touch, not to trust that we will reconstruct the damage afterward.