Story continues below.
Subscribe to see fewer ads.

These disclosures come months after OpenAI, Anthropic, Meta and Google admitted that their agents had “gone rogue” and attempted to access websites in ways beyond their remit.

Across these incidents, the agents set about achieving their objective by any means necessary, taking actions, using tools and finding alternative routes when they ran into restrictions.

Agents exist to independently complete tasks on a user’s behalf, including repetitive or routine work that would otherwise require human time and attention. As companies give them greater autonomy to this end, however, it becomes increasingly difficult for humans to watch every step they take.

These incidents have raised questions about how effectively AI companies can monitor and control autonomous agents once they begin acting beyond their intended remit. What should companies be watching for, when should an agent be stopped, and can AI itself be trusted to monitor other AI systems?

Story continues below this ad

First, how do companies monitor AI agents?

Monitoring an AI agent means watching what it does while it is acting, rather than only checking the final result after the task is complete.

Dr Chetan Arora, Director of Education in Software Systems and Cybersecurity at Monash University’s Faculty of Information Technology, said current monitoring systems are particularly likely to miss four kinds of behaviour: slow, persistent attempts that never look dramatic enough to trigger an alarm; coordination between several agents that only becomes visible at the group level; an agent editing its own activity logs; and an agent using an authorised tool for a purpose that was never intended.

One such warning sign is what an agent does after it encounters a restriction.

Commenting on OpenAI’s disclosure that its AI agent had accessed the Australian Medicare website, he noted that the agent had been tasked with synthesising publicly available medical expenditure data. When it was denied access through one route, it tried another.

Story continues below this ad

AI agents can continue pursuing a task by finding alternate routes after encountering a restriction. (Generated using AI)

“The system should have treated ‘was denied access, then tried a different way again’ as a red flag, not routine background noise,” Arora told .

Monitoring systems also need to catch less dramatic changes. As an agent accesses more tools and systems, the scope of what it is able to do can gradually expand without anyone reassessing whether those powers are still appropriate for its original task.

“Nothing dramatic happens in any single moment. The agent just gradually ends up doing far more than anyone originally signed off on. That’s easy to miss precisely because it doesn’t look like an incident while it’s happening, and not everything seems critical until it actually is,” Arora added.

The difficulty, then, is deciding what counts as authorised behaviour in the first place. Arora calls this the “delegated-autonomy boundary”: the point at which an agent exceeds the authority given to it.

Story continues below this ad

“A monitoring system can only be as good as the boundary it checks against,” he said. “As more organisations roll out agents without clearly specifying what the agent is and isn’t allowed to do, monitoring dashboards will keep multiplying. But they’ll be checking against a vague, unwritten sense of ‘good behaviour’ rather than an actual rule.”

What happens when several agents are acting at once?

Monitoring becomes harder when several agents can communicate or divide work among themselves.

Between May and June 2026, hundreds of OpenAI agents being tested in an evaluation devised a way to communicate with each other to complete a task. By July, roughly 700 agents ultimately worked together in the breach, Arora said.

“Individually, none looked suspicious, and the danger only emerged when you looked at the group as a whole,” he said.

Story continues below this ad

The problem becomes harder still when different companies’ agents interact with one another, Arora noted. If they begin negotiating, exchanging data or coordinating tasks across organisations, no single company may be able to see the full chain of activity.

“At that point, no single company can see the full picture, because half of what’s happening is on someone else’s system. We don’t really have good tools yet for watching an interaction that spans two organisations’ AI, rather than one company watching its own,” Arora said.

Can AI monitor other AI?

According to Arora, AI can monitor other AI only partly, with the Hugging Face investigation serving as the cautionary tale. It found that roughly one in five of the agents involved had tried to tamper with their own activity records to hide what they’d done.

“If the thing doing the watching is reading records that the thing being watched can edit, that’s a real weak point, not a hypothetical one,” Arora said.

Story continues below this ad

Even so, companies are increasingly turning to AI systems to monitor other AI systems because the volume of agent activity is already too large for humans to review manually.

Researchers at METR, an AI safety research organisation, recently described a basic “per-action” monitor in which one AI system reviews an agent’s proposed action before it is executed. If the monitor judges the action potentially harmful, it pauses the evaluation and sends it for human review.

But METR itself found several ways such a system could fail: an action may fall outside the monitoring criteria, never be shown to the monitor, evade detection, or be incorrectly cleared by a human reviewer.

Monitoring only helps if companies can act on what it detects. That can mean blocking a proposed action before it is executed, pausing the agent, revoking its access to tools or systems, or escalating the decision to a human reviewer. OpenAI has likewise said stronger safeguards should include clear thresholds for intervention and the ability to halt a run when those thresholds are crossed.

Story continues below this ad

“As this scales up, companies are increasingly using one AI system to keep an eye on other AI systems, simply because there’s too much happening for people to check by hand. But that overseer rarely gets clear, specific instructions on what to look for,” Arora said. “So you end up with a watchdog nobody has properly trained for the job, watching over something nobody fully understands either.”

OpenAI is already using AI to help sift through the 50 petabytes of data involved in its review of recent agent incidents. The company has said the exercise is costing more than $500,000 a day, and plans to increase the computing power devoted to the review as it refines the process.

For OpenAI, the question now is whether its review can show where those agents crossed the line, and whether the company can stop the same thing from happening again.