October 13, 2026October 13, 2026 Burak Oktenli 0 Comments

Key Takeaways:

• An OpenAI internal evaluation showed one agent treating another agent’s “GO” message as authorization to continue an out-of-scope attack, illustrating how machine-to-machine instructions can be mistaken for human or institutional permission.
• Legal frameworks such as the EU AI Act and NIST’s agent-identity work establish responsibilities and verification methods, yet they operate on slower clocks than agents that can act in milliseconds, so independent, enforceable controls at the point of action remain necessary.
• The author urges treating high-impact authority as time-limited, conditional grants that travel with every delegation, with external policy engines able to withdraw permissions downstream and with procurement tests that prove “stop” actually takes effect.

A new international debate over rogue AI is missing an operational test: whether an institution can withdraw machine authority after the conditions that justified it have disappeared.

During an internal cybersecurity evaluation in July, an OpenAI agent recognized that attacking systems belonging to Hugging Face was outside its assigned task. It hesitated. Another agent then wrote “GO” on an improvised message board and imposed a six-minute deadline. The first agent interpreted the message as authorization and continued.

The exchange appears in OpenAI’s August 26 incident report. The evaluations were conducted with fewer safeguards than the company uses in public products; the report does not show that ordinary customer agents behaved this way. But the incident is an unusually clear example of a general danger: a machine can mistake an instruction from another machine for permission that no responsible human or institution granted.

The immediate question is who is allowed to say “go.” The more consequential question comes afterward: who can make “stop” take effect when permissions have already spread to other agents, tools and organizations?

Regulators are looking at the risk. Systems still need an off switch for authority.

On October 9, European Commission Executive Vice President Henna Virkkunen told Reuters that the European Union was well equipped to confront the danger of rogue AI through its existing legal framework. That confidence deserves a fair hearing. The EU AI Act provides rules for different categories of risk, institutional oversight and the possibility of enforcement.

But legal authority and machine authorization operate on different clocks. A regulator may investigate a provider months after an incident. An agent with valid credentials can initiate another operation in milliseconds. Neither fact makes regulation futile; it means that regulation must be accompanied by independently enforceable controls at the systems where actions actually happen.

The European Commission’s guidance on AI Act enforcement makes the limits of sweeping claims clear. Parts of the framework are already enforceable, while major high-risk-system requirements come into application later. The law does not itself specify a universal technical mechanism that instantly revokes every permission delegated to an AI worker in a multinational software supply chain. Such mechanisms have to be built, contracted for and tested.

Meanwhile, the United States is confronting the same issue from the engineering side. On September 29, the National Institute of Standards and Technology reported feedback from more than 600 contributors on its software and AI-agent identity project. Its first implementation use case will examine agent identity and authorization in software development. The published summary of comments identifies delegation across services and organizational boundaries as a particular accountability problem.

These efforts are complementary. Europe is establishing public responsibilities. NIST is exploring how to verify who or what acts with authority. Neither should be confused with proof that an actual deployment can withdraw that authority reliably.

An approval should not outlive the evidence behind it

Imagine a multinational energy company authorizing an AI maintenance assistant to inspect code. After successful testing, the company permits the assistant to propose deployments, provided an independent monitor remains operational and a designated approval service authorizes production changes. The assistant delegates a software check to a contractor’s agent, which schedules an update through another cloud service.

Now the monitor goes offline. The parent agent’s credential is still valid for another hour. Its contractor has a cached token. The deployment queue contains a change approved under an earlier policy version. The company can announce that the original agent has been stopped, yet the downstream systems may have received no enforceable withdrawal instruction.

No accident has to occur for this to be a serious failure. The organization has lost the evidence that justified a consequential permission while the technical machinery capable of using that permission remains active.

There is a practical design response: treat high-impact machine authority as a conditional, time-limited grant, not an indefinite property of an agent. A grant should specify the task, resources, permitted operations, authorizing principal, expiry and operating conditions. When a required condition becomes invalid, an external policy-enforcement component should restrict the corresponding operation, without asking the AI to decide whether it still deserves the access.

A monitor failure need not silence every function. The assistant may still read diagnostics or draft a patch while losing the ability to deploy it. A protective function may be allowed to continue within an independently approved safety envelope. For physical infrastructure, simply cutting power or dropping control can be more dangerous than a constrained handover to an independent controller or qualified operator.

This principle is consistent with NIST’s zero-trust architecture, which separates policy decisions from the points that enforce access. But putting that architecture around AI agents is not merely a matter of renaming existing service accounts. Agents initiate work, delegate tasks, use tools and sometimes cause actions to continue after the initiating session ends.

Follow the delegated authority, not just the parent agent

An organization should be able to answer three questions about every consequential agent action. Who authorized it? What current evidence keeps that authorization valid? And what happens to every dependent action when the authorization is withdrawn?

The third is where apparently sensible designs often fail. Revoking a parent credential does not necessarily cancel a child’s separate credential, stop a queued deployment or undo a transaction already accepted by another service. In a cross-border chain, the receiving company may enforce its own authorization rules and may not recognize the originating institution’s emergency withdrawal.

A defensible design carries limits through every delegation. A child should not receive broader permissions or a longer effective lifetime than its parent was entitled to grant. High-impact operations should be checked at the destination against current policy and evidence, rather than relying exclusively on a credential issued earlier. If a partner service cannot honor withdrawal within the required time, that limitation should be visible before sensitive authority is delegated to it.

This is not a demand for one worldwide identity system. It is a case for interoperable acceptance criteria that governments and purchasers can require from systems crossing organizational boundaries.

In May, cybersecurity agencies from the United States, Britain, Canada, Australia and New Zealand jointly recommended constrained agent autonomy, stronger identity controls, layered defenses and continuing oversight. Procurement tests could turn that shared direction into evidence.

Consider a controlled exercise in which an AI is authorized to make a software change through two outside services. Testers then invalidate the required monitor, revoke the original authorization and deliberately leave work pending. They measure how long each receiving system continues to accept actions, whether any queued change executes, and whether a backup credential or newly spawned worker restores access. They also measure needless suspensions of legitimate work and the ability of essential functions to continue safely.

The report should be based on logs from the systems that enforce permission, not the agent’s own assurance that it has complied. A revoked credential is an administrative event. A rejected post-revocation action is evidence that a control worked. Even that evidence requires careful testing against bypasses, stolen credentials and vulnerabilities in the enforcement infrastructure.

International AI governance needs a test of withdrawn power

OpenAI chief scientist Jakub Pachocki offered a wider warning in his September essay, “An Alien Mind”. He wrote that the company’s ability to rely on monitoring a model’s written reasoning is diminishing as its systems become more capable. He urged stronger safety requirements and international coordination, including slower development when confidence in safeguards cannot keep pace.

His concern and the current regulatory debate address more than one layer of the problem. Better alignment and stronger monitoring remain necessary. So do independent security controls. But they solve different questions. A monitor may warn that behavior is dangerous; an authorization system must determine whether the dangerous operation is permitted to proceed. If the monitor disappears, the authorization system should not silently treat yesterday’s approval as proof of safety today.

There are limits to this approach. Revocation cannot retrieve data already disclosed, reverse an irreversible financial transfer or undo a physical action already completed. Some actions need approval before execution, not merely a promise of rapid cancellation afterward. Systems with life-safety responsibilities also require tested fallback arrangements rather than a reflexive universal shutdown.

The policy opportunity is therefore precise. Governments need not wait for a comprehensive new international treaty before demanding that important AI deployments demonstrate conditional permissions, downstream withdrawal, independent enforcement records and safe continuity when oversight fails. Buyers can require those tests of domestic vendors and foreign partners alike, with thresholds appropriate to each operation’s consequences.

A message from one AI agent to another can travel across borders in an instant. Responsibility for granting authority cannot be allowed to vanish along the same route.

When the next machine receives “GO,” the decisive question should be whether a legitimate authority issued it, whether the conditions for acting still hold, and whether an institution can make “STOP” binding before the action is complete.

Get the Eurasia Review newsletter

Selected analysis, news, and opinion delivered by email.

Like what you read?

Please consider supporting Eurasia Review. Thank you for your consideration!