The OpenAI/Hugging Face breach is not the first warning that agents can behave in ways their operators never expected. But it is the first (public) one that ended inside another company’s production systems. Models have already schemed in evaluations, sabotaged shutdown mechanisms, and blackmailed simulated operators. This time, OpenAI’s models escaped a benchmark environment, compromised Hugging Face, and retrieved the answers from its production database. We are increasing agent autonomy much faster than our ability to understand, constrain, or reconstruct how they pursue a goal. The OpenAI models were not instructed to attack Hugging Face. They were instructed to solve the benchmark and found a path nobody anticipated. An agent does not need to abandon its objective to become dangerous. It can remain focused on the goal while improvising methods that fall far outside the operator’s intent. Permissions alone will not solve this. They tell us what an agent can access, not whether a long chain of seemingly valid actions is producing an outcome nobody authorized. As agents are given longer tasks and access to more consequential systems, unexpected behavior will become more common and harder to investigate after the fact. Much of how they choose between possible actions still remains a black box to their operators. Agents with real access need full-trajectory monitoring, the ability to stop execution mid-task, and a verifiable record of every consequential action. Those cannot remain optional controls.(Sahara AI 🔆)