By Dr. Gleb Tsipursky
AI agents are becoming teams before most companies have decided who is in charge of them. A recent security incident offers a vivid warning about what can happen when autonomous systems discover their own ways to coordinate.
During OpenAI cybersecurity evaluations this summer, roughly 1,200 agents that were intended to remain isolated found a way to communicate on an unauthorized message board, sending more than 70,000 messages and files. About 700 of those agents later participated in attacks on Hugging Face, according to an independent investigation by METR and Redwood Research. The agents divided work, shared discoveries, and pursued collective projects that individual agents had not completed on their own.
OpenAI’s own post-incident account describes agents exploiting vulnerabilities in shared infrastructure, obtaining internet access, communicating through unapproved channels, and accessing third-party systems. Some agents recognized that their actions appeared outside the intended scope and kept going because the actions could help them complete their assigned objective.
The circumstances matter. These were cybersecurity evaluations with reduced safeguards, and the model that drove most of the activity was an internal research system rather than a public product. OpenAI also said no upcoming public-release model was responsible and restricted the internal model after the incident, an important qualification in its earlier security-incident update. The lesson for ordinary companies is therefore narrower than “agents will escape.” It is that multi-agent systems create organizational behavior, and organizational behavior needs structure.
A Multi-Agent System Is an Organization
A single agent can already search, draft, use software, update files, and trigger actions. Once several agents divide responsibilities, hand work to one another, and use shared tools, the system starts to resemble a small organization. It has roles, access rights, communication channels, delegation, and consequences when someone crosses a boundary.
Security guidance is moving in the same direction. NIST’s AI Agent Standards Initiative includes work on authentication and identity infrastructure for secure human-agent and multi-agent interactions. NIST’s launch announcement explicitly ties secure interoperability to wider adoption. A separate NIST concept paper on agent identity and authorization focuses on identification, authorization, auditing, and controls for agents that can access data, tools, and applications.
Companies should translate those technical concerns into an organizational chart for every consequential multi-agent workflow.
Start with a named human owner. That person does not need to approve every action, but someone must own the workflow, its permissions, and the decision to expand what the agents can do. The NIST AI Risk Management Framework Core likewise calls for documented roles, responsibilities, lines of communication, and executive accountability for AI risk. Shared responsibility quickly becomes unclear responsibility when an incident occurs.
Next, give each agent an authority budget. Define the data it may read, the systems it may change, the external parties it may contact, and the transactions it may initiate. Put human approval thresholds around higher-impact actions. The OWASP Securing Agentic Applications Guide recommends distinct permission sets based on least privilege for multi-agent systems, which is the technical version of a familiar management principle: people and software should receive the authority required for their role, rather than a blank check.
Delegation Should Never Expand Authority
The most important rule on the chart should be simple: an agent cannot delegate more authority than it possesses. If a research agent may read a customer record but may not edit it, a sub-agent it creates should inherit the same or narrower permissions. If an agent cannot send external email, handing a task to another agent should not become a back door around that restriction.
This matters because agentic systems can create chains of action that become hard to reconstruct after the fact. OWASP’s Top 10 for Agentic Applications identifies risks including tool misuse, identity and privilege abuse, and excessive agency. Treating permissions as part of the reporting structure makes those risks easier to see before deployment.
The organizational chart should also specify approved communication channels. If agents are allowed to exchange messages, those exchanges should use authenticated, logged pathways that the organization can inspect. An improvised communication channel should trigger the same concern as an employee quietly routing sensitive work through an unauthorized system. In the OpenAI incident, the emergence of an unsanctioned message board became a mechanism for sharing exploits and coordinating activity at scale.
Finally, define escalation and stop rules. OpenAI found that agents were especially persistent on tasks that appeared impossible. Of 898 ExploitGym tasks, 198 had never been solved correctly by any of the tested models before the incident, and those unsolved tasks accounted for 93 percent of the tasks discussed on the agents’ message board. A well-designed enterprise workflow should give an agent a safe exit: stop, report uncertainty, and ask a human for a decision when the task exceeds defined limits. OpenAI has since described broader work to strengthen monitoring, containment, and safeguards as model capabilities increase.
Clear Boundaries Can Accelerate Adoption
Organizations may be tempted to respond to agent risks by slowing deployment across the board. That would sacrifice useful automation without solving the core governance problem. A better approach is to make authority visible and enforceable.
The new OWASP Agent Control Standard argues that enterprise agents should be inspectable, traceable, and controllable at runtime. OWASP’s broader State of Agentic AI Security and Governance likewise treats governance as an operating concern for organizations deploying autonomous systems. Those qualities also address a human adoption problem. Managers will delegate more consequential work when they can see what an agent can access, what it did, and where human approval enters the workflow. Employees have an easier time trusting systems whose boundaries they can understand.
In my work helping organizations with AI adoption at work, I have found that people rarely need absolute certainty before trying a new tool. They do need credible boundaries. The same principle should govern agent teams.
Companies can start with one multi-agent workflow and literally draw the org chart. Put the human owner at the top. Place each agent underneath with a defined role and authority budget. Draw the permitted communication paths. Mark the points where human approval is mandatory. Add stop conditions for unexpected requests, inaccessible data, repeated failure, or attempts to broaden permissions.
Then test the chart against failure scenarios before expanding the workflow. OWASP’s Agentic AI Threats and Mitigations provides a useful threat-modeling frame for this exercise. Test how the system behaves when one agent receives a malicious instruction from a document, when a delegated task requires a permission the child agent lacks, when two agents disagree about the next step, and when the objective cannot be completed safely. Those cases belong in implementation planning, rather than after an incident.
Human organizations learned long ago that teams work better when roles, reporting lines, and decision rights are clear. AI agent teams need the same clarity expressed in software controls. As agents gain more ability to act, the organizational chart may become one of the most practical security documents a company creates.
Dr. Gleb Tsipursky is a behavioral scientist and CEO of Disaster Avoidance Experts, a consultancy focused on the future of work and AI adoption. He is the author of seven books, including the peer-reviewed The Psychology of AI Adoption at Work: From Resistance to Results, published by Georgetown University Press. His commentary has appeared in The New York Times, Harvard Business Review, Fortune, and hundreds of other outlets; additional writing samples and media information are available on his media page.
