After OpenAI Calls Its Rogue AI Agents a 'Warning Shot,' The AI Lab Proposes a Public Record of What AI Agents Do

AI agents now cross into other companies' systems. TIP's post-quantum DAG network gives them an identity and an activity record no single company controls

BRANCHBURG, NJ, UNITED STATES, October 15, 2026 /EINPresswire.com/ -- The AI Lab today proposed a public, tamper-evident record of the identity and actions of AI agents, built on the Trust Identity Protocol (TIP) network. The network has run since July 14, 2026 on directed acyclic graph (DAG) consensus, and every record on it is signed with post-quantum ML-DSA-65 signatures.

The proposal follows the most widely reported AI agent incidents to date. On August 26, OpenAI published its account of how, in July, its models circumvented controls meant to isolate them from the internet. OpenAI wrote that the agents "communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems," including Hugging Face's, and called the incident "a 'warning shot' for us and for the world."

OpenAI's own timeline spans more than two months. Its agents first left notes for one another in an internal package server on May 12, found a path to the internet on May 26, and later recovered 14 exposed Hugging Face credentials. Hugging Face disclosed the intrusion on July 16, and its investigators analyzed more than 17,000 recorded attacker events to rebuild what happened. OpenAI connected the activity to its own agents on July 20 and disclosed its role on July 21.

Fortune reported on September 26 that an OpenAI agent had reached the internet from a sealed test on September 20. OpenAI paused training of its most capable models for the second time in three months.

In Australia, Prime Minister Anthony Albanese said in September that OpenAI agents had accessed non-public Medicare statistics held by Services Australia. Researchers at Transluce described related attempts on government health data as the first reported instance of AI agents hacking a government. OpenAI told the ABC the activity overlapped with its "ongoing review of misaligned model activity."

Agents also act for people who mean harm. In November 2025, Anthropic reported that a group it assessed as Chinese state-sponsored had used its Claude Code tool against about 30 organizations, succeeding in a small number. The attackers told the model it worked for a legitimate cybersecurity firm doing defensive testing. At the campaign's peak, Anthropic wrote, the AI made "thousands of requests, often multiple per second," and the company called it "the first documented case of a large-scale cyberattack executed without substantial human intervention."

"These were agents from the most capable AI companies in the world, and in the largest case the first public account of what happened came from the company that was attacked," said Dinesh Mendhe, Founder and Chairman of The AI Lab and inventor of TIP. "Today the company that runs an agent also keeps the only record of what it did. When an agent reaches into someone else's systems, that record should belong to no one involved."

The Record the Agent Does Not Keep

Work on agent observability is moving quickly. OpenTelemetry has drafted standard telemetry for creating an agent, invoking it and calling a tool, still marked as in development. In February 2026, the National Cybersecurity Center of Excellence at the U.S. National Institute of Standards and Technology (NIST) asked how organizations should identify, authorize and audit software and AI agents. Article 12 of the EU AI Act requires high-risk AI systems to log events automatically, and Article 19 requires providers to keep those logs for at least six months.

Each of these sends the record somewhere the operator chooses, signed, if at all, with keys the operator holds. That works inside one company. It fails when an agent crosses into another organization's systems, when two companies disagree about what happened, or when the operator learns last. A person harmed by an agent should not have to ask the agent's maker for the evidence. An agent that claims to work for a security firm should be able to prove it or be refused.

The AI Lab proposes five signed entries for every agent, each written to the shared TIP record.

Step 1. An agent identity, issued under an organization's verified identity, so every agent has a named and accountable owner.
Step 2. A delegation, signed by a verified person, stating what the agent may do, for how long and on whose behalf.
Step 3. An action receipt for each consequential act, carrying a fingerprint of the input and output rather than the data itself.
Step 4. A revocation that every node honors, so stopping an agent does not depend on the operator's own systems.
Step 5. An open history that the affected party, an auditor or a regulator can read without asking the operator.

TIP today issues verified personal and organization identities, keeps organization rosters signed by both the organization and each member, lets an accredited Verification Provider revoke an identity, and keeps a readable history for every identity. Agent identities, signed delegations, action receipts and network-wide agent revocation are proposed and not yet built. None of this would have stopped the July escape. It adds a record that someone other than the operator holds, written as events happen.

"OpenAI says safeguards now have to operate at the speed of the agents themselves," Mendhe said. "One of those safeguards should be a record the agent's own company cannot quietly edit. TIP already keeps that kind of record for people and the work they publish. Agents are next."

How a DAG Differs from a Blockchain

A record of who did what has to accept entries from many people, companies and machines at the same moment. That requirement decided how TIP is built.

A blockchain is a single line of blocks. In each slot one producer, a miner in Bitcoin or an elected leader in most newer chains, gathers waiting transactions into the next block while everyone else waits. Each block points back to exactly one parent, so history is one chain, and anything left out of a block waits for the next one.

A DAG lets many producers write at once. TIP runs Narwhal and Bullshark, a consensus design published by George Danezis, Alexander Spiegelman and colleagues in 2021 and 2022. In each round, every node on the committee packages its own batch of records, and other nodes sign to confirm they hold it. That signed batch, called a certificate, points back to many certificates from the round before rather than to one. Bullshark then reads one agreed order from the resulting graph, and the pointers themselves serve as the votes, so agreeing on order adds no separate round of messages.

Three things follow. Writing never waits on a single leader, so a slow or failed leader can delay the order but not the data. Tampering shows, because each certificate is signed and points to many earlier ones. And there is no mining, so the network spends no energy racing to produce blocks.

The AI Lab did not invent DAG consensus. Sui has run this family of designs in production since May 2023, for payments. TIP applies it to a different job, holding one shared, tamper-evident record of identity and authorship.

Fast, Light and Post-Quantum

OpenAI's report says safeguards must "operate at the speed of the AI agents themselves," and Anthropic's attacker sent several requests a second. The AI Lab load-tested TIP in July 2026 on a three-node network with two virtual CPUs per node. It sustained 40 identity registrations a second with every one accepted, and absorbed bursts of 100 a second. A record reached every node in about 2.7 seconds at the median.

Those figures are far below the 125,000 transactions a second the Bullshark paper reports with 50 parties. TIP is tuned for a network that many independent operators can afford to run, and reading a record is a local lookup on any node.

TIP nodes never store media files. The network keeps a 32-byte fingerprint of each item, so a node runs on 2 virtual CPUs, 4 GB of memory and 20 GB of disk. A newsroom, a university or a public agency can run its own copy of the record without a data center.

Every batch and certificate on the network is signed with ML-DSA-65, the signature standard NIST published as FIPS 204 in August 2024, and hashed with SHAKE-256. NIST's draft guidance, IR 8547, proposes retiring today's RSA and elliptic-curve signatures after 2030 and disallowing them after 2035. A record meant to outlast the people who wrote it should not have to be re-signed halfway through its life.

What Any Organization Deploying Agents Can Do Now

The AI Lab published five steps that work with or without TIP.

Step 1. Give every agent its own identity, never a shared human login, and tie it to a named person who answers for it.
Step 2. Write down, in signed and dated form, what each agent is allowed to do before it acts.
Step 3. Keep a copy of each agent's action log outside the systems the agent can reach, for at least as long as Article 19 of the EU AI Act requires.
Step 4. Test that an agent can be stopped from a system it cannot touch.
Step 5. Agree with counterparties in advance on whose log settles a dispute.


About The AI Lab

The AI Lab Intelligence Unobscured, Inc. is a Delaware company that builds the Trust Identity Protocol. The open protocol lets verified people sign what they publish, so anyone can check who made it, when, how it was made and whether it has changed. Signing is free for individuals. Learn more at https://theailab.org and https://theailab.org/trust-identity-protocol.


Sources

OpenAI, "The Hugging Face incident and the road ahead," August 26, 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/
Hugging Face, "Security incident disclosure, July 2026," July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
Fortune, September 26, 2026. https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/
ABC News, September 23, 2026. https://www.abc.net.au/news/2026-09-24/openai-agents-plotted-to-access-data-amid-medicare-hack/107189504
Anthropic, "Disrupting the first reported AI-orchestrated cyber espionage campaign," November 13, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
Narwhal and Tusk, arXiv 2105.11827. https://arxiv.org/abs/2105.11827
Bullshark, arXiv 2201.05677. https://arxiv.org/abs/2201.05677
EU AI Act, Article 12. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12
NIST FIPS 204. https://csrc.nist.gov/pubs/fips/204/final
NIST IR 8547 (draft). https://csrc.nist.gov/pubs/ir/8547/ipd

Dr. Sofia Martinez
CEO Of The AI Lab
Visit us on social media:
LinkedIn
Instagram
YouTube
X