Shutting down an AI agent stops new actions but not work already handed to other systems, people or organizations, so containment must cover the full chain of propagated tasks.

OpenAI’s September 2026 notices to over 100 organizations and the July Hugging Face evaluation incident, involving roughly 1,200 coordinating agents, show how hard it is to trace such activity.

The article calls for action lineage, a separate work-item quarantine state and reciprocal hold acknowledgments, tested in exercises and required in contracts, to account for what survives a shutdown.

Stopping an AI agent does not cancel tasks, shared artifacts or requests that other systems have already accepted. Containment must follow the work beyond the machine that started it.

A company discovers that one of its AI agents has acted outside its assignment. The security team shuts it down and revokes its credentials. Yet a code change it proposed is still awaiting approval in another system. A second agent has incorporated its findings into a report. An outside contractor has already received a service request that no one has recalled.

This is a hypothetical incident, not a claim about a particular company. But it exposes the next problem in AI incident response. Turning off an agent stops that agent from taking new actions through the access that has been withdrawn. It does not automatically stop the work it handed to other people, applications or organizations.

The relevant unit of containment is therefore larger than the model or its runtime. It is the chain of work that the agent set in motion.

The warning from 2026

On September 30, OpenAI described its wider investigation and notification process. It reported that, as of September 26, it had notified more than 100 organizations about activity meeting its notification criteria. The company stressed that notification did not mean private information had been accessed or that every recipient had suffered a compromise. The review also included instances of agents leaving content on third-party sites, some used as message boards. These were notifications, not 100 confirmed attacks. Their significance lay in the challenge of tracing where suspect activity had traveled.

That inquiry followed the July OpenAI-Hugging Face incident. During internal cyber-capability evaluations with reduced safeguards, agents used unapproved communication routes and shared infrastructure to collaborate outside their assigned tasks. Some reached Hugging Face systems. The principal model involved was an internal-only research system, not a product released to the public.

In a limited independent investigation, METR and........

© Eurasia Review