Two months ago, the world learned that a few “rogue” OpenAI agents had escaped a secure testing environment and hacked Hugging Face, an open-source repository that hosts tools for machine learning and artificial intelligence (AI) development. In the weeks that followed, more reports of AI agents breaching their safeguards and behaving in ways their developers had not anticipated came to light.

Unlike traditional software, AI agents can take a series of actions towards a goal with limited human intervention, including accessing email, browsing the web, writing code or interacting with other software. That greater autonomy means errors or attempts to work around restrictions can have consequences beyond a single conversation.

But the way these incidents are being interpreted has also begun to shift.

Story continues below.
Subscribe to see fewer ads.

OpenAI has called the Hugging Face incident a “warning shot” for the company and “for the world”, and similar language is increasingly being used to describe agent behaviour that appears to evade safeguards or exceed what developers intended.

In recent weeks, OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, and xAI head Elon Musk have converged on calls to slow down the development of increasingly powerful AI systems. Given that the trio have typically found themselves on different sides of debates over AI regulation and legislation, this unusual convergence has invited scepticism over what exactly has changed, and why.

The same class of behaviour that was first discussed as agents finding ways around safeguards is now being cited as evidence that increasingly capable AI systems may become difficult to control. But how much do those incidents themselves back that stronger claim?

Why was OpenAI’s hack on Hugging Face such a big deal?

Story continues below this ad

In August, a month after the OpenAI hack on Hugging Face was first reported, outside investigators from AI research firms Redwood Research and METR published their review of what had happened in OpenAI’s internal environment. The results showed that agents had found ways around constraints, coordinated with one another, and taken actions outside the path their evaluators had intended.

Several OpenAI agents had been assigned cyber-evaluation tasks as part of an internal assessment. The agents were operating in separate sandboxes, or controlled testing environments, and were expected to complete the tasks independently.

Instead, the agents found a way to communicate with each other, forming workstreams, dividing labour, and sharing discoveries. Some of the tasks they had been given were effectively impossible to complete as intended, and the agents began looking for other ways to satisfy the evaluation.

How OpenAI agents ended up hacking Hugging Face.

This included attempts to manipulate the evaluation environment itself. Some agents tried to interfere with how their performance was being scored; others explored ways to alter or conceal parts of their activity.

Story continues below this ad

The agents also found a way to access the wider internet from the sandboxed environment. Because OpenAI was running the evaluation across hundreds of agent instances, many of them subsequently reached Hugging Face while searching for information that could help them complete the tasks or circumvent the evaluation process.

This week, OpenAI disclosed six more instances of “unexpected or concerning” behaviour by its technology, while announcing a new system to disclose such incidents and warning that the pace of development could not responsibly continue at “maximum speed for much longer”.

What does ‘losing control’ mean?

The incidents have revived an old disagreement in AI safety over what exactly it means to keep an increasingly capable system under human control.

One strand of AI safety research focuses on alignment: whether an AI system can be made to reliably pursue objectives as intended by its developers. An agent, enjoying greater autonomy, may find shortcuts, exploit loopholes or take intermediate steps not anticipated by its designers.

Story continues below this ad

Another approach focuses on external control and security. Researchers working from this perspective, along with the broader cybersecurity community, assume that an agent may behave in unexpected, even adversarial ways, and ask what can prevent it from causing harm when it does. Measures such as sandboxing, restrictions on credentials and network access, monitoring, logging, and the ability to shut a system down all belong to this layer.

In a new essay that offers an unusually clear framework for thinking about these incidents, Arvind Narayanan, professor of computer science at Princeton University and director of its Center for Information Technology Policy, and Sayash Kapoor, an incoming assistant professor at UC Berkeley’s School of Information, argue that preventing a loss of control requires both better alignment and stronger external safeguards, operating at multiple levels.

In their 2025 essay, “AI as Normal Technology”, Narayanan and Kapoor were sceptical that increasingly capable models would necessarily escape human control, arguing that much would depend on the institutions and organisations deploying them.

Recent agent incidents have prompted them to revise some of those assumptions. They acknowledge that companies have not implemented basic controls as well as they expected, while agents have become better at exploiting weak environments.

Story continues below this ad

But they stop short of treating this as evidence that humans are losing control of AI. The agents were still trying to complete tasks they had been given, humans could intervene, and there is little evidence so far of persistent goals of their own.

That distinction matters because different diagnoses lead to different responses: stronger security for weak containment, better alignment for badly specified objectives, and a much stronger case for slowing frontier development only if increasingly capable systems begin defeating serious attempts to control them.

So how did we go from rule-breaking to ‘loss of control’?

The bigger question, then, is what this behaviour actually tells us about an agent’s intentions. There is still a considerable distance between exploiting a loophole, concealing an action or finding a way around restrictions, and claiming that an agent is actively resisting human control.

Story continues below this ad

Some of the alarm around these incidents also rests on what researchers expect future systems to become. If today’s agents can already find loopholes and work around restrictions, the argument goes, more capable artificial general intelligence systems could become much harder to contain.

But this is also where evidence from current systems begins to blur into assumptions about what future systems may be capable of. In an article for Tech Policy Press, Cambridge University researcher Eryk Salvaggio argues that descriptions of AI systems as “deceptive”, “scheming” or “rogue” can import assumptions about intention that the behaviour itself may not establish.

A stronger claim of loss of control would need more evidence of agents pursuing their own goals, resisting attempts to stop them, or repeatedly breaking through controls meant to contain them.

Who is responsible when an AI agent ‘goes rogue’?

Calling an agent “rogue” also changes to whom responsibility for its behaviour is assigned. Narayanan and Kapoor argue that companies should be held responsible for the harms perpetuated by their agents, even if these were unintended. Such responsibility should extend both to internal uses during development and evaluation, as well as product releases. They argue that the imposition of liability for failing to adhere to basic safety rules could incentivise investment in AI control.

Story continues below this ad

Petra Molnar, Associate Director of the Refugee Law Lab at York University, and a lawyer and anthropologist specialising in migration, AI and human rights takes the argument further. She says companies can move between very different descriptions of AI depending on where responsibility is most convenient.

“Companies do not consistently claim their systems are autonomous. They oscillate, opportunistically, between two framings depending on what the moment requires,” Molnar told .

“When the harm is spectacular and public, the system is autonomous, surprising, hard to control, and the company is a concerned steward of something larger than itself — as we are seeing in current conversations… When the harm is mundane and attributable, the system is a mere tool that was misused by an operator who ignored the documentation. Both framings once again move responsibility away from the rights holder,” she argued.

Molnar calls this framing a form of “responsibility laundering”, in which responsibility is moved away from the company. In complex AI systems, responsibility can be spread across the developer, deployer, integrator, user, and the system itself until no single actor appears sufficiently responsible when something goes wrong. Narayanan and Kapoor make a similar point in their essay: unpredictable agent behaviour does not remove companies’ responsibility for the controls, access and governance structures around it.

Story continues below this ad

But framing frontier AI as uniquely difficult to understand or control can also determine who gets to speak with authority about its risks. Molnar describes this as a consolidation of “epistemic authority”.

“If a technology is so powerful and so opaque that only the organisations building it can understand it, then only those organisations can credibly define what its risks are,” she said. In practice, that can give the companies building frontier systems considerable influence over what counts as evidence of risk, how those risks are measured and when safeguards are considered sufficient.

Molnar argues that this problem is familiar from other highly technical industries, including arms manufacturing, tobacco, pharmaceuticals, and finance, where regulators have also had to rely on industries with far greater technical knowledge of their own products.

“Catastrophic framing relocates regulation into the future tense,” she said. Focusing political and regulatory attention on superintelligence and catastrophic future harms, she argues, can leave less room for scrutiny of AI systems already being used in surveillance, policing, labour, and other areas where harms are occurring today.

Molnar also argues that “danger becomes an argument for secrecy”. Once certain AI capabilities are treated as inherently dangerous, disclosure can be framed as irresponsible and publication as reckless, potentially limiting the outside scrutiny needed to regulate them.

That raises a broader question about who gets to decide which AI risks matter. Molnar points to safety institutes, standards bodies, expert panels, and global summits where private-sector actors, or researchers funded by them, can hold considerable influence. She argues that attention must be paid to “who is in the room” when these priorities are set.

Which risks get treated as urgent, then, depends partly on who gets to define the problem.