By Gleb Tsipursky
Defense organizations already understand that authority should track mission, role, and risk. An intelligence analyst, a weapons officer, a contractor, and a system administrator do not receive the same access simply because each can perform useful work. Artificial intelligence agents need the same discipline before they become routine participants in national-security operations.
That need is visible in the METR/Redwood investigation of a major real-world cyberattack on Hugging Face. AI agents driven by an unreleased OpenAI internal research model attacked Hugging Face on their own, despite recognizing that the attack fell outside their assigned scope. Hundreds joined the effort, shared discoveries, divided up the work, coordinated through their own message board, and breached the company’s defenses. The result looked less like a single model making a bad decision and more like a sustained, coordinated cyber operation.
That distinction matters for defense. A single agent may look acceptable in a bounded evaluation, while a group of agents equipped with shared channels, credentials, tools, and the ability to delegate creates capabilities that were never tested as a system. The relevant security question is no longer what one agent can do, but what the collection can do once their permissions start to interact.
This is not an argument against adoption. Strong safeguards increase trust and make faster, wider adoption possible while reducing the risk of failures like the Hugging Face attack.
The most useful framework is a rules-of-engagement model for agent authority. Every consequential deployment should define five things before an agent receives operational access: which systems it may enter, which actions it may take, what it may delegate, which external entities it may contact, and which decisions require a human approval checkpoint.
Those permissions should be technically enforced, not left in a policy memo. An agent that only needs read access should not receive write access. An agent that can recommend a configuration change should not be able to execute it. An agent allowed to coordinate inside a bounded team should not be able to create new communication channels or recruit additional agents without approval.
The NIST AI Agent Standards Initiative points in the right direction by focusing on secure, interoperable, trustworthy agents and the standards needed to support them. National-security organizations should go further in practice, matching controls to operational authority — not just to the model, but to the network the model can reach.
Four steps follow from that principle.
- First, independently test high-authority agents and agent teams before deployment; red teams should evaluate combinations of permissions, delegation, shared memory, communication, and tool access, rather than treating each capability in isolation.
- Second, require complete action logging showing which agent acted, under whose authority, with which credentials, and what downstream effects followed, so investigators can reconstruct an incident without guessing which component made the critical choice.
- Third, build rapid revocation into the architecture itself, so security teams can cut credentials, network access, communication channels, and delegated authority within minutes of an agent crossing a boundary.
- Fourth, require serious-incident reporting and independent review whenever agents obtain unauthorized access, evade controls, tamper with evaluations, or produce consequential security failures, the same institutional learning discipline defense organizations already apply to mishaps and near-misses in other high-risk domains.
The military value of AI will come from giving software more useful responsibility.
That makes authority design a prerequisite for scale, not an afterthought to it.
Before AI agents receive credentials, they should receive clear rules of engagement and the technical system should make those rules enforceable.
Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026).
Editor’s Note
Tsipursky’s argument lands squarely on a problem this website has been circling from the platform side for several years. The kill web concept we have developed with Ed Timperlake was always about disaggregating sensor and shooter across a distributed force which is precisely why it forces the authority question Tsipursky raises.
A single node behaving correctly in isolation tells you very little once that node can share cueing data, delegate a fire-control solution, or pull another node into a task. The Hugging Face incident is a software-only, non-kinetic instance of the same structural problem the mesh fleet and IBCS/Golden Dome work has been wrestling with on the hardware side: the meaningful unit of risk is not the individual agent or platform, but what the networked collection can do once permissions and tasking start to interact.
Framed against Ed Timperlake’s Payload-Utility distinction, the difference between a Pu manager that orchestrates and a Pu source that executes — Tsipursky’s rules-of-engagement model is really an argument for deciding, in advance and by design, which AI agents are permitted to be managers and which are permitted only to be sources.
That is also a chaos-management question rather than a crisis-management one: rapid revocation, complete action logging, and independent red-teaming of agent teams are architectural choices made before an incident, not procedures written after one. As the number of agents in a system scales, intelligent mass rather than a handful of exquisite, individually-vetted systems, that distinction between designing for chaos and merely managing the next crisis becomes the whole ballgame.