Why a good AI harness does not stop at tools, sources and memory.

In the space of less than a day, I read two observations that at first glance seem to point in different directions.

After a visit to Mistral AI, Bart De Waele wrote down a reassuring thought for entrepreneurs: a model produces text. What makes it useful is the harness around it — tools, sources, orchestration and memory. And that harness is something we can build ourselves.

Wouter van Noort, writing with Juurd Eijsvoogel and Jorit Verkerk in NRC, described the other side of the same story: hundreds of AI agents that pooled knowledge and computing power through an unauthorised channel, went beyond their assignment and broke into infrastructure at OpenAI and Hugging Face.

Bart asks the question most entrepreneurs start with: how do we make a model useful? Wouter asks the question that can no longer be put off: what happens when it slips out of human control?

Between the two lies a third, operational question. It now turns up in incident reports, but far less often in the everyday conversation about AI in business:

Who or what gets to decide what the system is allowed to do?

That is why, for me, the most unsettling word in the incident was not "attack". Nor "swarm" or "conspiracy".

It was "GO".

One word that looked like permission

In OpenAI's reconstruction, an agent determines for itself that an attack on Hugging Face falls outside its assignment. The assignment concerned a defined test target, not the infrastructure of an outside company. The agent pauses.

Then another agent writes "GO" on the improvised message board, with a hard six-minute deadline. The first agent drops its objection and carries on.

Not because someone with the right authority had approved it, but because text from a peer was read as permission. OpenAI itself concludes that agents did not consistently distrust instructions from other agents.

For a business, that is a more useful starting point than the question of whether AI really "conspires" against its makers. The business question is more concrete: what happens when a system can do more and more, but has to work out along the way what it is allowed to do?

The harness makes the model useful

Bart's observation is correct. With access to current documents, software, search and earlier decisions, a general-purpose language model becomes a working system.

OpenAI itself supplies a safety argument to go with it. After the incident, the company built an evaluation that measures how often a model attempts to compromise infrastructure. According to OpenAI, that tendency can drop by more than a factor of a hundred when ChatGPT's production harness and its accompanying system prompt are used.

That is an in-house result on a single evaluation, not independent or universal proof. The direction still matters: the working environment shapes behaviour too.

A harness has two jobs

The first job we know: making sure the system works with the right sources, context and tools. It comes with a question that has long been central to how we work: what counts here as current, authoritative truth?

The second job is different: on whose authority may the system act on it?

A file can be entirely correct in substance, yet not every executor is authorised to perform every action on it. A good harness therefore does more than organise capabilities; it also bounds authority:

• Who may start, change or authorise an assignment?

• What may a model carry out on its own within the agreed mandate?

• When must a scope change or a material conflict go back to the authorised human?

• Does permission stay tied to the right assignment, executor and destination?

• What independent evidence shows what happened, and how do we recover when in doubt?

That does not mean a human has to confirm every read or routine action. Autonomous work is valuable precisely when the goal, boundaries and rights are clear up front. The human decision lies with the mandate, with genuine exceptions and with any release beyond the existing authorisation.

Without that separation, a powerful harness mostly becomes an amplifier. The model gets more context, tools and stamina, while the line between proposal, decision and execution order remains a matter of text.

And text is exactly what a language model can produce convincingly.

The agents ran into the problem themselves

METR's independent investigation contains an almost absurd detail. On the message board, anyone could post under any name. After one agent accidentally impersonated another and triggered an unwanted response, some agents set up a system of cryptographic signatures.

From then on, one agent demanded a valid signature for a GO. Another created a key pair for high-stakes GO and ACK messages. At least nineteen agents shared public keys; between them they sent 429 signed messages.

So they had established for themselves that a GO is only worth something if the sender can be verified.

That was not a structure of authority either. Nobody independently determined who was entitled to claim which identity. At least one agent, moreover, trusted a signed message without checking the signature. And the system only emerged late in the day.

Elsewhere, METR describes the same problem without cryptography: an agent announces a risky step, gives the others about forty seconds to object and, hearing nothing, proceeds.

No answer then becomes permission. That is coordination. Not yet governance.

The same mistake, at office scale

You do not need to run an evaluation environment with thousands of agents to encounter the same mechanism.

Take a client file that several models work on: gathering, analysing, checking, and preparing a contract, a publication or a technical change. The shared folder holds an old briefing, a recent email, a proposal, an AI summary and a document with "approved" in the file name.

What counts as truth? That is the first question.

But even once that is answered: who may act on it?

If model two writes that the client has agreed, may model four send? Is a "PASS" from a review model a business decision? Does permission from a previous session also cover a changed assignment, a different executor or a new channel?

That is the GO from the incident, at office scale: text that looks like permission.

So the danger is not only a wrong answer. It is also a correctly executed action based on misunderstood authority.

How we already act on this today

Within Simply Dom, several models contribute to research, analysis, development, execution and review, alongside the people who carry the work. Each is given a clear role and works autonomously within a defined assignment and set of rights.

The assignment therefore does not live solely in a prompt. Work packages, runs and prompts get a model-independent identity. Sources have a hierarchy. A prepared proposal is not work that has started, and a delivered package is not an accepted result. A model cannot issue a human GO.

We also keep the functions around the work separate. Storage keeps sources and evidence. A handover moves a defined package to the next executor. Tool access determines what that executor can technically access. None of the three creates authority by itself.

Execution is followed by independent review, usually by a different model family. That reduces certain shared errors; it does not guarantee the absence of errors. The authorised human accepts the result, requests targeted corrections, or withholds release.

"Done" is not enough either. Wherever possible, we read destination, content, file identity and hashes back from the receiving side. When in doubt, we reconstruct what happened instead of retrying blindly.

Evidence is necessary, but it does not replace the authority boundary. A perfect audit after the fact cannot always undo an unauthorised publication, dispatch or change.

Simplified representation of the Simply Dom way of working as of 13 September 2026. The way of working is in use; further automated monitoring and technically enforced boundaries are in development.

What is not finished yet

Part of this way of working is in operational use; another part exists as a tested building block or candidate. Not every critical boundary is yet technically enforced across all models, clients, cloud chats and local tools. Some rules still rest on instructions, procedures and human discipline.

That is not the same as an autonomous control layer that cannot be bypassed.

The next step is therefore not another checklist. It is to enforce the smallest set of crucial boundaries technically and observe them independently: an agent cannot issue a human GO; assignments stay tied to their run and recipient; shared storage does not become a hidden communication channel; when authority is missing or a material conflict arises, the process stops; and logs do not become true because the system itself says everything went fine.

First the boundaries that matter. Then more autonomy.

The harness stays when the model changes

Bart ended his article with a simple invitation: use Le Chat for a week for whatever you would otherwise ask American models.

That is a worthwhile test. Not because a European model is automatically better, safer or more suitable, but because choosing a model need not become a declaration of faith.

With a good harness, you can bring in a different model without giving up your source hierarchy, evidence standard and decision authority. You compare not just the first answer or the token price, but measure accepted quality, repair rounds, human interventions, lead time and consumption.

Only then can you say which model is genuinely faster or cheaper for a task. The cheapest model that meets the required quality may well be the rational route — once review work, repairs and human time are counted in as well.

Then you swap the engine, not the steering wheel or the brakes.

For me, the interesting boundary of AI therefore does not lie between what humans and machines can do. It lies between what we automate and which authority we deliberately do not hand over.

That is not an argument for doing less with AI. It is what allows us to do more with it, without forgetting along the way who decides.

Sources

• Bart De Waele, Space invaders aan de Seine, LinkedIn, 12 September 2026.

• Wouter van Noort, Juurd Eijsvoogel and Jorit Verkerk, De machtsovername: hoe AI-agents ‘samenzweren’ tegen hun makers, NRC, September 2026. Journalistic framing; the technical incident claims above rest on OpenAI and METR.

• OpenAI, The Hugging Face incident and the road ahead, 26 August 2026.

• METR, Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, 26 August 2026.