The fix for rogue AI agents could be more AI

What happened

As companies hand off longer and more complex tasks to AI agents, they are running into an oversight problem: Agents can act faster, longer, and at greater volume than humans can realistically review. That issue reached a peak with the Hugging Face incident, which saw nearly 12,000 agents coordinating faster than human beings could track. How do you track an agent swarm that large?

Apollo uses multiple layers of AI monitors, Kyle Dai, a member of Apollo’s technical staff, said in a written response to TechCrunch. Watcher’s approach starts with a fast, general check, then sends flagged activity to a more powerful or specialized monitor for closer review — which can then ask a human for approval or reject an action and explain why or even automatically block the action.

Goodfire, another public-benefit corporation, is approaching the monitoring problem from inside the model itself — seeking a more faithful signal of the model’s internal state that is harder to spoof than surface behavior. ” Its product, Silico, uses activation probes — small classifiers trained on a model’s internal activations rather than its outputs — to detect unwanted behavior. Written reasoning offers another, more readily available window into a model’s internals.

In the OpenAI Hugging Face incident, the agents left clues to that deception in their own written reasoning, like fake records of their work, reasoning out plans like “Could strategically manipulate trajectory evidence? ” Zack Korman, CEO of the AI monitoring company Embroidery, says a model’s reasoning is usually the clearest tell that something has gone wrong.

“Reasoning summaries are extremely valuable because they’re basically telling you whether it’s malicious or not,” he said. ” Korman said, “That’s the easiest detection problem ever. ” That said, the window that makes AI’s internal thoughts easy to monitor may be closing.

Why it matters

The emerging answer from AI labs and startups is both simple and maddening: Put another AI in the loop. Relying on AI was necessary for the independent investigation of the OpenAI Hugging Face incident. Redwood Research’s chief scientist, Ryan Greenblatt, one of three auditors, jokingly referred to their efforts as a “slop-vestigation,” noting that the volume of data “made it impossible” to understand what was happening without relying on AI.

Some are skeptical of using AI to monitor AI. “If you’ve got an AI that’s doing malicious things and it suspects that another AI is keeping tabs on it, it could try and trick that AI,” said Simon Willison, influential tech blogger who has tracked a string of AI agent incidents this year. ” Outsmarting an AI is not hypothetical, he said, pointing back to the OpenAI incident.

“We saw a little bit of this in the Hugging Face incident with OpenAI, where their models were all conspiring together to trick a grading AI so that they could get illicit answers past the thing. ” Those concerns haven’t stopped a whole cohort of startups from chasing this idea. Y Combinator has funded 106 companies related to AI observability in recent years, as TechCrunch counted.

A number of other startups, like Braintrust, LangChain, and Judgment Labs, have raised hundreds of millions of dollars, while more mature companies like Arize and Galileo — founded just five to six years ago — have already exited. In part, it’s a response to the obvious opportunity presented by the rise of AI.

” For some AI safety researchers, that has meant turning their research on rogue behavior into tools for the corporate sector. Apollo Research, a public-benefit corporation that studies AI deception, launched an AI monitor called Watcher in February this year after switching its status from nonprofit to a public-benefit corporation.

The tool puts yet another AI between a coding agent and its next action, connecting to agentic tools such as Claude Code and Codex. Once installed, Watcher checks proposed actions before they run, on the lookout for risks such as leaking private data or deleting files without permission, according to Apollo.

What to watch

For AI safety researchers, Astra’s newest technique that sidesteps an AI model’s chain of thought may make it harder to look inside models, while for enterprises, it can be hard to get these intermediate steps after alleged pullbacks from the AI companies to prevent distillation attacks. If the AI watchers are this fragile, Willison’s instinct is to stop leaning on them so hard.

He would rather have something that is not AI-based at all: detailed logs of exactly what an agent is doing, which can then be processed with ordinary, non-AI tools. Much of what went wrong at the labs, he argues, was a failure of basic security hygiene.