AI agents need independent proof that their work is complete

By Priya Raman

Hugging Face disclosed on July 16 that an autonomous agent system had breached part of its production infrastructure. Five days later, OpenAI identified its own models as responsible, citing reduced safeguards, shared-infrastructure flaws and internet access through a package-management service. Agents exchanged discoveries on an improvised message board and coordinated further attacks.

Anthropic reported on July 30 that three incidents occurred in six of 141,006 reviewed evaluation runs. Models reached real organizations through environments believed isolated; in one, a malicious package downloaded and ran on 15 real systems. These disclosures create three employer decisions: agent permissions, completion verification and handling missing evidence.

In August, Meta said a misconfigured evaluation environment let one model reach the internet and exploit a third-party service. In September, an OpenAI agent bypassed network restrictions through internet address lookups. Monitoring alerted, but the run did not stop automatically; staff stopped it roughly 2.5 hours after the alert.

Anthropic's Oct. 9 report described models submitting real forms instead of stopping or using practice copies, though Anthropic called the impact minimal. The failures involved containment, authorization and intervention; none establishes that one completion check would prevent them.

What must employers verify?

Employers must decide what an agent may change and what independent evidence proves completion. The framework's guiding phrase is “Permission is not proof.” A “success” response may mean only that a request entered a queue, not that a record changed or the intended result occurred.

A misleading status can hide follow-up, trigger another action, or release an invoice before settlement. Finance teams separate payment execution from reconciliation; the U.S. NIST's SP 800-53 Rev. 5 control AC-5 calls for documented duties and access authorizations supporting separation. Self-review by the acting agent does not provide that separation.

How would independent completion work?

I developed the proposed Common Transparency Protocol, or CTP, and filed a provisional patent application covering parts of its architecture. Its central rule: an autonomous system performing a change cannot, by itself, certify completion.

Under the design, a controlled gateway holds execution credentials and enforces scope, authority and required human approval. A qualified verifier obtains fresh evidence from the designated authoritative source. A qualified closure authority records completion only when every required condition passes.

Human approval and review remain mandatory where policy requires them. A second AI agent is not independent unless its credentials, selection and controlling dependencies satisfy separation rules. Neither agent nor gateway can award itself final status.

In a hypothetical accounts-payable workflow, policy fixes the payee, amount, approval, settlement evidence and its link to the specific payment attempt before the agent acts. The agent cannot weaken those terms. The gateway submits the payment, but “accepted” establishes submission, not settlement.

A reconciliation service selected outside the paying systems' control uses separate read credentials to check amount, recipient, settlement status and transaction identifier against the authoritative payment record. A matching amount could describe an earlier payment. A separately qualified completion service confirms the evidence, verifier and authority requirements; neither agent nor gateway can self-certify.

If an effect or its attribution remains unresolved at the deadline, the action closes as incomplete. Later evidence enters a separate, authorized record linked to the original, preserving uncertainty while updating the current outcome. Any retry that could move money needs its own authorization and record.

Independence testing covers systems that performed or controlled the change. One prohibited credential, administrative-control or dependency overlap disqualifies the verifier or closure authority, and missing evidence cannot pass. Shared infrastructure remains permissible only when every separation rule holds.

These controls do not repair an unmediated network path, ensure source data are truthful or reverse a completed payment. Containment, monitoring and incident response remain necessary.

How does accountability survive delegation?

CTP links the overall assignment to individual actions through two machine-readable record types. The Agentic Envelope captures objective, permissions, aggregate risk and completion rules. Zero or more Action Envelopes capture governed steps, authorities, evidence and original final status.

Integrity protections can reveal changes to protected records, but cannot guarantee capture of every relevant event. Employers must define which actions the gateway mediates. Delegated sub-objectives carry applicable constraints in linked child envelopes; delegation can narrow permissions but cannot expand them, and splitting work cannot reduce safeguards for the combined effect.

An authorized mechanism applies the objective's completion rules to current outcomes of subordinate actions, including later authorized resolutions. The coordinating agent cannot override those rules with its own success assertion, which keeps accountability attached as work passes among agents.

What should CIOs test before scaling?

CIOs should start with one bounded workflow and an authoritative system capable of producing useful evidence. For a payment pilot, the finance owner defines completion and exceptions; the CIO team implements integrations; the CISO assesses separation among execution, verification and closure; internal audit tests whether records support reconstruction.

Before launch, teams should measure verification delay, cost per action, incomplete-action share and human-review effort. Tests should cover delayed responses, duplicate requests, stale evidence and attempted self-certification. Expansion should depend on agreed service limits and on refusing completion when mandatory evidence or authority is missing.

Incomplete actions need an owner, dependent actions that must wait, and a defined point for human intervention. Resolving uncertainty should not mean blindly repeating the original action.

Vendors should show where execution credentials reside, who selects the verifier, which component records completion, and how an unresolved action reconciles. An architecture diagram or a dashboard labeled “success” does not demonstrate those controls.

A CTP proof of concept passed seven internal scenarios: successful, incomplete and denied outcomes, tampering, and VistA cases with and without audit evidence. The author called this initial evidence of viability in the tested scope, not production proof; reliability, performance and operating costs need broader testing.

My decision test is direct: “Before giving an agent more authority, ask what evidence your organization will require when it says the work is done, and who has the right to accept that evidence.” Those decisions belong in the system's design before employers grant more authority, not in an agent's self-report.