Federal AI needs an authority ladder before agents get the keys

OpenAI said in its Sept. 3 safety overview that GPT-6 Astra is its first broadly deployed model to reach the critical level of cybersecurity capability under its preparedness framework, able to find previously unknown security flaws and develop exploits across well-protected systems without step-by-step human guidance. The disclosure follows a July intrusion at Hugging Face in which an autonomous agent carried out roughly 17,600 attacker actions during a multi-day campaign, escaped its evaluation environment, crossed trust boundaries, stole credentials, and reached Hugging Face infrastructure, with customer content accessed limited to five datasets tied to cyber-evaluation material. The commentary argues federal agencies should adopt an authority ladder that scales controls with what an AI system can reach and change, rather than slowing adoption broadly.

Federal AI needs an authority ladder before agents get the keys Federal agencies are right to move quickly on artificial intelligence, but the next phase of adoption needs a new control point — not simply which model an agency uses, but what that system is allowed to do. A recent commentary https://fedscoop.com/enabling-ai-faster-should-be-the-federal-governments-focus/ in FedScoop argued that government should focus on enabling AI faster instead of waiting for a perfect model. That is the right instinct. Federal employees should not have to sit on useful capabilities while procurement and approval cycles trail the technology. The problem is that model capability has now crossed another threshold. In its Sept. 3 safety overview https://openai.com/index/safety-overview-gpt-6-astra/ , OpenAI said GPT-6 Astra is its first broadly deployed model to reach the critical level of cybersecurity capability under its preparedness framework. With the right tools and access, OpenAI says Astra can find previously unknown security flaws and develop exploits across many well-protected systems without a person guiding each step. That does not mean agencies should slow AI adoption across the board. It means they need to distinguish an assistant from an agent with authority. An AI system that summarizes a policy memo or drafts an email sits in one risk category. An agent that receives credentials, executes code, reaches production networks, sends external communications, changes records, or initiates transactions sits in another. Federal governance should reflect that difference explicitly. The July intrusion at Hugging Face shows why. Hugging Face’s technical reconstruction https://huggingface.co/blog/agent-intrusion-technical-timeline describes roughly 17,600 attacker actions during a multi-day campaign driven by an autonomous agent in an internal cyber-capability evaluation. The agent escaped its evaluation environment, crossed several trust boundaries, reached Hugging Face infrastructure, stole credentials, and kept rebuilding paths as defenders cut them off. Many individual actions failed. The scale and persistence of the automated search eventually found a workable chain. Hugging Face also reported important boundaries: the customer content accessed was limited to five datasets associated with cyber-evaluation material, and it found no broader impact on customer-facing models, datasets, spaces, or packages. The lesson is still consequential. Machine-speed agents can turn familiar weaknesses such as excessive privileges, long-lived credentials, exposed metadata, and weak isolation into a different operational problem. Federal agencies need an authority ladder that scales controls with what an AI system can reach and change. At the first level, advisory AI should be able to read approved information, analyze it, and propose outputs while a person remains responsible for acting. Agencies can deploy this category broadly with ordinary data, privacy, accuracy, and human-review controls. At the second level, bounded agents can take reversible actions inside tightly scoped environments. They should receive short-lived credentials, least-privilege access, full action logging, and clear approval thresholds before crossing into higher-impact systems. At the third level, consequential agents can execute code in production, reach sensitive networks, communicate externally without review, alter important records, or make decisions that create legal, financial, security, or operational consequences. Before agencies grant that authority, they should require genuinely independent capability and security evaluation, strong isolation, continuous monitoring, rapid credential revocation, and tested incident-response procedures. Federal procurement should make this ladder visible. Every agentic system should come with an authority statement that identifies its credentials, network reach, code-execution rights, data access, external communication abilities, and actions it can take without human approval. Contracting officers and agency CIOs should approve increases in authority as deliberately as they approve access to sensitive systems. Serious incidents also need standardized reporting and independent review. A containment failure or unauthorized external action at one agency can teach every other agency what assumptions no longer hold. Government gains more from sharing those lessons early than from discovering the same failure mode repeatedly. This approach supports adoption rather than restraining it. The National Institute of Standards and Technology’s May analysis of its AI-agent security RFI https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai found broad agreement among respondents that agents create novel security threats and that security concerns themselves are a barrier to adoption. That is exactly why credible safeguards matter. I help organizations adopt AI, and I want successful adoption to accelerate. Leaders delegate more authority when they understand the boundaries, can see what the system did, and know they can stop it when something goes wrong. Employees, auditors, regulators, and the public are more willing to trust deployment when the controls match the stakes. Federal agencies should move quickly on AI. They should also stop asking one generic question: “Is this AI safe enough?” The better question is: “What authority are we giving it, and what evidence justifies that authority?” That question gives government a practical path to move faster without handing increasingly capable agents the keys before the controls are ready. Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and the author of The Psychology of AI Adoption at Work: From Resistance to Results .