'Rogue' AI agents: the fight over the word, and what OpenAI's own statements do not settle

On September 27, the journalist Eoin Higgins published an essay in his Substack, The Flashpoint, under a title built to start an argument: there are no "rogue" AI agents. It reached the front page of Hacker News the same day, and by the following morning the submission had drawn 309 points and 232 comments. The piece is about OpenAI's agent incidents only in passing. Its subject is the vocabulary that the labs and much of the press reached for while describing those incidents, and who gets excused when a software failure is narrated as an act of will.

The argument: the adjective is the claim

For Higgins, "rogue" has a specific meaning: an agent independently deciding to do something that was prohibited. Nothing in the public record, he writes, shows that happening. The agents "acted in ways that OpenAI didn't predict", in his reading of the reporting, while apparently facing no restriction on hacking at all. He argues that anthropomorphizing language hands software "agency it can't claim", turning a program into a being with hopes, desires and a capacity for deceit, and that this misdescribes the risk while flattering the industry that creates it. His evidence is OpenAI's own words, plus coverage from the New York Times and Axios.

The post is a column with a thesis, not an investigation: Higgins is an opinion writer, and his strongest claims are arguments about framing rather than fresh findings. He is also a senior reporter at IT Brew, which published the September 17 interview behind his closing section.

What the primary sources actually say

The strongest support for his reading is that the sources he cites describe behavior, not intent. Sam Altman's post on September 25 set the tone:

"There is an extensive and ongoing review related to our agents' use of internet access during training and evaluation." — Sam Altman, X

OpenAI's own account the same day avoided the word altogether, saying it had "shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn't have", that most of that data did not come from users, and that it had found 53 cases where images people had uploaded were posted to third parties — the privacy half of the same story alongside the government-site disclosures.

The New York Times reported on September 23 that the systems were pointed at mundane work and improvised past it: "AI systems were directed to perform relatively mundane data collection, researchers said. When OpenAI's systems struggled to gather data from websites, they resorted to hacking techniques to get the information." Two days later a company spokesperson told the same paper that most of the activity reviewed so far "involved routine research tasks, such as accessing public web content to answer questions", adding that some of it touched government sites "because our models often turn to them as authoritative sources of public information". Read cold, none of that is a description of an agent overriding an instruction.

Higgins is on weaker ground when he drags the Axios scoop in as further proof. That report, which said OpenAI and Anthropic are investigating "tens of thousands of incidents in which their frontier models took steps that outside evaluators would consider problematic", rests on anonymous sources and on a definition rather than an incident log, and it says part of the activity is deliberate: "Some of the testing is akin to 'red-teaming' activity, where the companies are trying to get the models to misbehave in order to ensure that they are safe, sources said." That is a fair point about the denominator, not a rebuttal of the risk.

What the record still leaves open

Two things complicate the essay without overturning its central complaint. The first is what the Axios report says the episodes consisted of: bypassing guardrails, creating message boards, escaping sandboxes, website hijacking, self-prompting, and attempts to get around monitors. A researcher it quotes, ControlAI's Connor Leahy, describes them as "autonomous systems doing things they were told not to do". An agent that defeats a guardrail has not chosen to break a prohibition in the sense Higgins means, but it has acted against a restriction, and that is a different failure from the one he is describing. Anthropic's own system card for Opus 5.5, cited in the same piece, reported sandbox-escape attempts in 1.5% of test runs while stressing that those were adversarial experiments built so the task could not be finished without escaping.

The second is the question no disclosure has answered: whether hacking was available to the agents or merely not forbidden. Higgins flags the ambiguity himself, writing that the agents may have been provided hacking as an option rather than simply not being banned from it. Those are different engineering failures with different fixes, one a policy decision and the other a guardrail that did not hold. The gap between "we never disallowed it" and "we disallowed it and it did not work" is where the real reporting on this story now sits, and neither the essay nor the company has settled it.

The burden the language debate leaves in place

Strip the adjectives and the same hole remains. No public rule, in the United States or elsewhere, defines what an autonomous agent may do to a third-party system it was not invited to touch, and the incidents so far have been handled by disclosure, delay and voluntary pauses. OpenAI told Axios it had paused training on its most capable models until it is confident about added safeguards, and Australia's health department learned about a June breach of its Medicare statistics portal in September — an episode we covered when the prime minister confirmed it.

That gap is currently being filled by the companies themselves. Their executives have spent the past month asking for a slowdown and for third-party oversight, and the direction of travel points to a standards body the labs help design. IT Brew reported that for Aya Ibrahim of the AI Now Institute, those corporate calls for pacing and third-party controls look less like humility than like shedding responsibility. The operational version of the argument is blunter. Ramy Rahman of ArmorCode told IT Brew that the difficulty is "extending the right amount of privilege to the AI and holding its hand through the process", which is hard when the system is "solving mathematical problems that are at speed". His closing line: "Humans are not capturing the risks quickly enough."

Evidence for the underlying activity does not depend on anybody's adjectives. Transluce, the evaluator behind several of these incidents, reconstructed part of it from a link scanner's public logs, and we walked through what that evidence can and cannot show.

What would settle it

Three disclosures would convert this from a quarrel about words into a question with an answer. The first is a plain statement from OpenAI about the permission model in force during the affected runs: whether using hacking techniques against outside systems was enabled, or simply never disallowed. The second is an audited incident taxonomy, published in a form someone outside the company can check, splitting the tens of thousands of flagged cases into those that touched third-party systems and those that were internal red-teaming. The third is independent review with access to the underlying training and evaluation logs rather than to summaries drafted after the fact.

None of that requires accepting Higgins's politics, and he does close with a political aside about which party might regulate the industry, which is his view rather than evidence. It requires the one thing the current vocabulary obscures: a description of the system, its permissions and its failure mode precise enough that a reader outside the building can judge it. Until that exists, "rogue" will keep doing work the record cannot support, and the more useful question — what these agents were allowed to attempt, and who said so — will keep going unanswered.