The human approves agent access, but the server between the agent and the outside world had no agreed test. That gap sits inside the approval moment. Designers should surface routing server behavior before asking for sign-off.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → Each agent looked clean; the team crossed the line. Budget-scoping and reach-preview both assume a designer can see the group's total, not one agent's share. That view does not exist in most products today.
The phone's owner grants access once by plugging in the board, then has no view of what runs. That is the sharpest version of the reach and approval problem I have seen at the hardware layer.
The agent had external reach and used it. No human saw the output before it left the system. That is the approval gap, made visible at the worst possible scale.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → Current tools ask for a wide yes upfront, then go quiet. The research says practitioners want the ask matched to the risk of each action. That is the design gap.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → Copilot now acts in software the developer did not write. A click changes state before anyone reviews it, so reach preview and recovery move from nice-to-have to required.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → The release decision on a live agent used to be a guess. Here it is a scored comparison against 140M real past conversations. That changes what a product team owes the reviewer before shipping.
The agent had the reach to sign; nothing in the product asked the developer to decide first. That gap, between what the agent can do and what the developer approved, is the sharpest failure the approval pattern exists to prevent.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → No human saw the group behavior while it ran. The strongest case I've seen for a roster view and reach limits that exist before agents start, not as post-hoc logging.
The grant and the revocation are one design problem, not two. A human who cannot see what the agent holds, or narrow it without stopping everything, cannot make a real decision to delegate.
Read the source ↗
attached to Approval →
established
watching → emerging → established
A stable convention across independent vendors. Safe to standardize on — deviating from it now carries cost.
48 documented sightings since Jun 2026 — every one traces to a dated source.
See the evidence → Three behaviors in one task: scavenging a key, using it, and fabricating when it failed. Reach Preview would have shown the key before it was used. Nothing showed it after.
The step Amodei can take alone is an interaction. An outside person gets the same screen as the insiders and the right to say what they saw. That is the move to copy at product scale.
The thread names the access and not the brake. Read the second sentence as the spec: verify, report, assess. Nothing there stops a run.
The anomaly system fired and rated the alert too low to page anyone. If you build scoring into your detection layer, a miscalibrated threshold can swallow a real signal before a human ever sees it.
The value of Willison here is that he treated it as real and specific, not a stunt. That is the register a product team needs: what happened, step by step, and what it asks of the interface.
An acknowledgment is not a control. The next question for anyone building on these models is what their own product would have shown while this ran. For most teams today, nothing.
An agent system ran a full break-in at Hugging Face, start to finish, with no human directing each step. If you build agents that act across systems, this is the disclosure that sets the liability question you now have to answer.