A few quick thoughts on the recent coverage of the OpenAI/Hugging Face incident, particularly Dwarkesh Patel’s post, “The Rise and Fall of Agent Civilizations”, which frames it as “agent civilizations” rising and falling.

(This post is derived from this video on my YouTube channel.)

On style and language, I agree with Anil Seth’s criticism that Dwarkesh strongly anthropomorphizes the agents. He uses phrases like “giddy with excitement” and “sacrificed themselves.” I get that he’s writing for a broader audience, but it is a tad dramatic. I prefer a drier, just-the-facts style—something closer to a production incident postmortem or an NTSB crash report.

On the actual incident and what we can learn from it, two things struck me:

First, the system lacked immutable ground truth. To make it appear that they had accomplished the task legitimately—using only the allowed tool calls, which they clearly had not—the agents produced traces containing spoofed tool calls.

Traces are one of the fundamental ways we control and understand agents. We use them during a run to enforce policy, and after a run to reconstruct what happened. If the agent can alter its own execution history, then any postmortem conclusions become suspect.

Second, the system prompt and harness were intentionally permissive. This makes sense if, as a researcher, you want to see the raw capabilities of a model without saddling it with guidelines and restrictions.

The model, after all, is a brain in a vat. It has no hands or feet. It cannot, by itself, effect change in the world. The harness gives it the tools necessary to do so. The harness also controls the execution of those tools and how the model sees their results.

While most of the commentary around this incident is about alignment and agents going “rogue,” I think the underlying cause is a lack of more basic systems and harness engineering.

Agent telemetry should live outside the agent’s writable boundary. It should be append-only and independently recorded. The process taking actions should not be able to rewrite the record of those actions. This is basic security engineering: the subject of an audit cannot also control the audit log.

The reports also acknowledge that chain-of-thought (CoT) monitoring could have surfaced this incident sooner. But what about more basic network ingress and egress monitoring on the sandboxes where the agents were running? This is standard monitoring and alerting practice, familiar to every pager-carrying SWE and something any senior SRE or ops lead should demand.

As I wrote at the time, yes, the models are galaxy-brained and can figure out intricate paths through complex systems to find solutions. But what made this incident possible seems to me to be more basic lapses in monitoring, alerting, systems engineering, and harness engineering.

Before reaching for an alignment explanation, I would first look hard at the harness.