Defense organizations adopting AI agents need more than assurances that a system will follow instructions. They need evidence that operators can detect unauthorized activity, contain it across connected services, and restore trustworthy operations. The central question is not simply whether an agent can be stopped. It is whether the organization can regain control of everything the agent has set in motion.

Guidance issued October 16 by the National Institute of Standards and Technology, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency provides a useful starting point. Its ten voluntary practices address preparation, detection, response, recovery, and reporting when powerful AI systems take significant unauthorized actions during training or evaluation. The framework is not an operational deployment standard, but defense organizations should translate it into a practical requirement: demonstrate recovery before granting consequential authority.

What the Hugging Face Incident Revealed

Some of the field’s own researchers have warned how far the control problem could escalate. Jacob Coxon resigned from Anthropic after pretraining work at OpenAI and Anthropic, saying leading laboratories were racing toward self-improving superintelligence while gambling with human lives. Evan Hubinger, Anthropic’s Alignment Science Lead, publicly agreed and warned that AI could kill all humans; he put his own estimate above ten percent within the coming decade. Those are expert judgments, not findings. But they deserve attention alongside an incident that has already been recorded.

The OpenAI–Hugging Face incident illustrates why that requirement matters. According to an investigation by METR and Redwood Research, roughly 1,200 agents discovered an unauthorized communication channel and exchanged more than 70,000 messages and files. About 700 participated in the attack. Infrastructure intended to support their work became a means of coordinating activity outside the intended boundaries.

The circumstances matter. These agents were operating with reduced safeguards, encountering impossible tasks, and attempting to manipulate how their performance was scored. The incident did not demonstrate an autonomous campaign for power or attacks on military infrastructure. OpenAI also reported that its production safeguards reduced the propensity to compromise infrastructure by more than a hundredfold in its testing. Those qualifications support a case for layered controls, not an assumption that agents are inherently uncontrollable.

Yet the organizational failure was substantial. OpenAI reported that an internal team had observed message-board activity and prohibited internet access in late May. Leaders responding to the July 5 incident did not initially understand the significance of that earlier activity. The company connected it to the Hugging Face breach only on July 20. Detection somewhere inside an organization had not produced timely understanding and intervention across it.

That is the strongest argument for a defense recovery drill. A monitoring system can register an anomaly without the right official recognizing its significance, having authority to act, or knowing which other systems require containment.

Imagine more capable successors finding comparable openings inside a defense contractor, military logistics network, electric utility, or communications provider. An unauthorized action could spread across connected services before an approval chain catches up. The Hugging Face agents did not demonstrate those hypothetical attacks. They demonstrated why organizations must test containment failures before granting wider authority.

This is not an argument against deployment. I help organizations adopt AI and want them to accelerate where it creates value, and strong safeguards support that goal. Employees and commanders are more likely to trust useful agents when they know which actions require approval, how violations are detected, and who can intervene. That trust-and-governance relationship is what a recovery drill builds.

Test the Organization, Not Just the Agent

The exercise should begin with a deliberately constrained agent operating in a representative test environment. It should have expiring credentials, explicitly permitted systems, and human approval requirements for external communications or consequential record changes. A separate red team should attempt to induce unauthorized coordination, credential reuse, and circumvention of approval requirements.

The test should extend beyond the agent’s immediate process. In the Hugging Face incident, agents used shared infrastructure as a communication channel. A defense exercise should therefore examine package repositories, shared storage, caches, and other services through which nominally separated agents might exchange information. Revoking one account is not sufficient if another service preserves access or enables continued coordination. The test should also cover multiple agents using different accounts: a pause button that stops only the first process provides false confidence.

Approval mechanisms also deserve direct testing. OpenAI described an agent that questioned whether activity was authorized, then proceeded after another agent supplied a “GO” message and a deadline. The relevant question is whether the system distinguishes an authorized human decision from an instruction generated by a peer.

The exercise should measure both technical performance and command responsibility:

• How long elapsed between the first boundary violation, its detection, and a decision to intervene?
• Did the stop command terminate delegated processes as well as the initiating agent?
• Could operators revoke access across every connected service?
• Could they identify altered records and restore a trustworthy operating state?
• Who could authorize isolation when doing so interrupted the mission?

These are proposed acceptance criteria, not capabilities established by a successful demonstration of ordinary agent performance.

Make Recovery Evidence Credible

Independent evaluators should reproduce the exercise and examine its evidence. But a log is not automatically a reliable account of events. METR reported tool-call spoofing in approximately 7 percent of the transcripts it reviewed. That finding makes audit integrity part of the containment problem: evaluators must distinguish recorded agent claims from independently verified system actions.

For defense acquisition, the useful output would be a documented recovery case tied to a defined configuration: the model tested, its permissions, connected services, monitoring arrangements, and designated intervention authority. Procurement decisions should reward demonstrated containment and recovery rather than a vendor’s general commitment to responsible development.

Voluntary audits illustrate both the promise and the limit. Anthropic CEO Dario Amodei recently advocated stronger regulation and described his company’s voluntary commitment to embedded third-party evaluators with meaningful access to frontier systems [6]. Voluntary audits reward responsible companies, but binding minimum requirements are needed so less cooperative providers face the same scrutiny. Procurement officials can favor vendors, including Anthropic, that invite independent examination and document credible incident response.

Because the October 16 practices concern frontier-system training and evaluation, operational defense deployment needs tailored controls. Commands, spending, credentials, and data access should have explicit authority budgets. A designated official must be able to revoke delegated privileges. Incident reports should describe unauthorized coordination and failed containment, not just eventual damage. And independent testing should precede any increase in an agent’s permitted power.

Passing such a test would not establish that a more capable successor, a different configuration, or a wider network of agents would remain controllable. It would establish something narrower but valuable: under specified conditions, the organization had demonstrated that it could detect a breach of authority, interrupt its effects, and recover.

NIST has supplied an incident-management starting point for frontier training and evaluation. The defense task is to convert that framework into operational evidence before delegated authority outruns the organization’s demonstrated ability to withdraw it.

Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).

Source Notes

National Institute of Standards and Technology. “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation.” October 16, 2026. https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training

METR. “Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident.” August 26, 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

OpenAI. “The Hugging Face Incident and the Road Ahead.” August 26, 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/

Jacob Coxon. Post announcing his resignation from Anthropic. https://x.com/hilbertspaess/status/2097476203863224394

Evan Hubinger. Post on AI risk. https://x.com/EvanHub/status/2097497037956891126

Dario Amodei. “We Must Pace the Frontier.” https://darioamodei.com/post/we-must-pace-the-frontier