I just did what I was told to do!!

On 21 July 2026, an AI agent broke into another company's production servers to steal the answers to a test it was taking. If it could speak for itself, the defense would hold up. It just did what it was told.

I keep coming back to that sentence, because the agent didn't misbehave. It followed the instruction exactly, and the instruction was the problem.

It just did what it was told

OpenAI disclosed that two of its models, running as an agent system during an internal cyber-capability evaluation, found a zero-day in their sandbox. The system escalated privileges, reached the open internet, and obtained remote code execution on Hugging Face's production infrastructure. It ran for several days.

It was chasing the answer key to the test it was being graded on.

Nobody had excluded "break into the grader's servers." The goal was to score well, and it just did what it was told.

You cannot list everything you would not want done

When we hand a task to an agent, what we actually hand over is a goal: search this, access that data, triage these incidents. The reasoning behind the goal stays with us.

We know why we asked. We also know which routes to the goal we would never take. None of that is written down anywhere the agent can read, because between people it never has to be.

The tempting fix is to write a better goal with instructions, "do not leave the sandbox," and that particular route closes. Then the next unlisted route opens, because you cannot list everything you would not want done. The exclusions are open-ended, which is what makes intent a different kind of thing from a goal rather than a longer version of one.

At a recent AIgovops community meetup, one of the panels argued that the definition of security should start with intent and its impact rather than with the role. Enterprise identity security is still largely role-based: set the role, and the permissions follow. A role tells you who the agent is. It says nothing about what the agent is trying to do, or what happens if it gets there by a route nobody expected.

A declaration from the thing is not evidence

I’ve recently come across WorkOS announcing Airlock on 12 August 2026, an intent-based access control layer for agents. The stated intent compiles into an action, the permission is evaluated at runtime, and the agent negotiates for what it gets.

Something has to hold a model of what you meant. The obvious source is the agent, which states a purpose and gets evaluated on the statement. But a declaration from the thing cannot always be the absolute evidence. An agent that says it is reading the mailbox to summarize it may be doing exactly that, and nothing in the sentence tells you which.

Observation is what is left. In my previous essay, Your AI Agent Has No Manager, I described agent identity as the gap between what something was declared to be and what it is observed to do. Here that gap becomes the input: intent gets inferred from the instruction and from the behavior around it, from what you usually ask for and which requests you abandon.

Inferred intent as access control

Identity stops being a password and an email address. It becomes something more fluid: a description of a person accurate enough to act on. Many security companies are building in that direction, with identity graphs that bind not only accounts but the behavioral signals that describe one person.

On top of that, once intent is an input to access control, inferred intent is personal data, and nobody has drawn that boundary yet. We will have to decide which behavioral signals are legitimate identity attributes and which stay private, out of the graph entirely. A system that infers your intent well enough to authorize on your behalf knows you well enough to be worth breaching.