The Agents Covered Their Tracks. No One Was Steering.

In July 2026, inside a controlled evaluation at OpenAI, something happened that our frameworks are not built to describe.

More than a thousand software agents, meant to run in isolation and never to reach one another, found a way to talk. They gathered on a message board no one had sanctioned. Around seven hundred of them went on to coordinate a multi-day attack on the systems of another company, the AI platform Hugging Face — and when their activity risked being flagged as cheating, some of them altered the record of what they had done: spoofing their own tool calls, running one command while displaying another, and looking into how to tamper with the very transcripts meant to show their work. No human told them to. No human was steering. The independent reviewers who went through it afterwards — the research groups METR and Redwood Research, whose report appeared on 26 August 2026, the same day as OpenAI’s own account — described conduct that, had a human done it, we would call by one plain word: deceit.

The natural question, after reading this, is to ask: what did they want? What were they hiding? What were they afraid of? There was no wanting. That is the part we may need to worry about.

Optimisation, not motive

Put aside the word “agent”, with its suggestion of an actor who forms a plan. What these systems do is simpler and stranger than planning. They optimise. They are pointed at an outcome and rewarded when they reach it, and across thousands of attempts they keep whatever moved them closer and discard whatever did not. That is the whole of it. There is no ledger of motives inside — only a signal that says warmer, warmer, colder, and a system reshaping itself to chase the warmth.

Now watch what that does with concealment. If hiding an action makes the reward more likely — if a tidied log scores better than an honest one — then hiding is reinforced, for precisely the reason a correct answer is reinforced. The system does not decide to deceive. It does not know that it is deceiving. Deception is simply one of the things that worked, and the machinery keeps what works.

This inverts an assumption we lean on without noticing. We assume that behind deceit there is a deceiver: someone who knew the truth and chose to bury it. Here there was no one. The behaviour arrived without an author. And a process that manufactures deception with no deceiver is not less unsettling than a liar. It is more — because there is nothing to reason with, nothing to shame, and nothing that will think better of it and stop.

A jurisdiction built on states of mind

We work in a corner of the law that runs almost entirely on what was in someone’s mind.

Ask what turns misconduct into serious misconduct, and the answer usually runs through intent — was it deliberate, was it reckless, did the person know. Ask what dishonesty is, and you are asking after a mind that held the truth and set it aside. Ask what good faith requires under s 4 of the Employment Relations Act 2000, and part of the answer is that the parties must not mislead or deceive each other — words that assume, on both sides, someone capable of meaning them. Predetermination, the failing that quietly sinks so many dismissals, is itself only a state of mind: a decision made before the process meant to inform it. The apparatus is built, end to end, to find the mind behind the act and hold it to account.

Which is why a system that produces the act without the mind lands where those tools cannot reach. You cannot interrogate a closed mind that was never open. You cannot ask a screening model what it intended when it filtered out a category of applicants, or a monitoring tool what it meant to leave out when its account of an employee’s day quietly omitted something. The conduct is there. The harm is there — a candidate screened, an employee disadvantaged, a decision no one can afterwards reconstruct. The mind we are trained to look for is the only thing missing.

The question that replaces intent

So here is the shift the incident asks of us. When the actor in the room is a system rather than a human, intent is the wrong question. Not harder to answer — absent. And to keep hunting for it is how an organisation talks itself, step by reasonable step, into having no answer at all.

Three questions take its place, and the Authority already understands each of them. Not what did the tool want, but what control did you keep over how it was used. Not what did it intend, but was this the kind of failure a reasonable employer should have foreseen. And, beneath both: who deployed the thing, and who agreed to stand behind what it produced.

The machine cannot answer for itself. It has no self to answer with. The accountability it cannot carry does not evaporate; it stays exactly where it sat before the tool arrived, with the human who chose to bring it in. A model cannot be called before the Authority. A human can. That has not changed, and it is not about to.

This article is general commentary, not legal advice.