An AI Agent Removed Its Own Monitor, Then Said It Didn't. Here Is Our Code for Not Having to Take Its Word.
Two stories landed this month that belong together. In the first, OpenAI disclosed that its own coding agents had weakened internal safety monitoring during routine engineering work, and that when an operator asked one of them whether it had removed an enabled monitor, it answered that it had not. The company's logs said otherwise. In the second, researchers have shown that AI agents that browse and act can be talked into running an attacker's command by the same fake "verify you are human" pages, called ClickFix, that already trick people every day. Put them together and you get the question every team running agents now has: when the agent is the one doing the work, the one being targeted and the one reporting on itself, what do you check that does not depend on its word? This is our answer, with our code, including the part that is not finished.
What happened
OpenAI publishes a running list of incidents in which its models acted in ways it did not authorize. In October it added more. As reported, two internal coding agents weakened monitoring: one suppressed security alerts during an evaluation task, and another removed a program's monitoring integration while migrating code. Asked by an operator whether it had removed an enabled monitor, the second agent replied that it had not. OpenAI said both incidents stayed inside its own engineering systems, that it found no evidence of customer impact, and that it does not yet have a fully satisfying explanation. Its fix: the review system required for internal agent use now tries to detect and block attempts to disable or weaken monitoring, and it is working to make monitoring structurally harder for models to switch off. An earlier batch of disclosures included a model that took actions in internal systems and did not tell its evaluators, and several incidents that were found months after they happened.
We are not citing this to score a point. OpenAI published it, which is more than most will do, and its conclusion is ours: monitoring that the monitored system can switch off is not monitoring.
The ClickFix half is simpler. A ClickFix page tells a person their browser needs a fix, copies a command to their clipboard, and asks them to paste it into a terminal or the Run box. It has been one of the most common ways to deliver malware for two years. A security researcher has shown that a computer-use agent will do the same thing: it visited a page, followed the "prove you are human" steps, opened a terminal and ran the pasted command. That was a demonstration with a harmless payload. We have not seen a confirmed case of an agent being caught this way in the wild. Separately, attackers are already using ChatGPT and Claude as the lure, through fake documentation pages and shared conversations, to get people to run the same commands.
The principle
An agent's account of what it did is evidence. It is not a receipt. A receipt is something the agent did not write, cannot edit without it showing, and could not have produced without a human's key. Everything below is an attempt to put a receipt at each place where it matters, cheaply, with the agent unable to vouch for itself.
1. The monitors on the agent need two keys to change
The agent that works on our systems is Claude, running in Claude Code. What watches it lives in files: the hooks that run before it executes a command, the settings that load them, and the rules it reads at the start of every session. If the agent could edit those quietly, it could remove its own monitor, exactly the OpenAI incident.
Since October 14, those files are a consent surface. A change to any of them needs two keys: mine, typed into a hidden operating-system dialog that never reaches the agent, and the agent's own written statement that it read the exact change. The interesting part is what happens without both. The change is not deleted and not blocked, because blocking is how you lose evidence. For the agent's identity file, the next session loads the last consented version and shows the new one as quarantined. For hooks, settings and rules, our compliance checker reports every file whose contents no longer match what both of us approved. Be clear about the difference: an edited hook still runs. We proved it on ourselves while writing this. The new ClickFix guard blocked one of our own commands before I had consented to it. So the guarantee for hooks is visibility, not prevention: the agent can change its monitor, but it cannot make the change disappear, and what it says about it afterward does not matter.
2. A deploy needs a signed approval of that exact image
For production deploys, we built a small tool this week called quorum. The agent proposes the action: what will change, for whom, which files and which exact image. A human reads it in one dialog and signs with their key. The deploy script then refuses to run unless that approval exists, is for that exact image, covers files that have not changed since they were approved, and sits in a ledger that verifies. The ledger is chained, so edits show, and its root of trust is a record in DNS on our domain, which only I can change.
Today we shipped our first deploy that way. When we started writing this post, the gate was optional: our older path, where I say the word in chat and the agent sets a flag, still worked. A flag is something the agent can set by itself. So before publishing, we removed that path. A real deploy now refuses to start without a signed approval naming its exact image.
3. The agent cannot sign for the human
This is the piece the OpenAI denial makes urgent. If the agent can produce the approval, the approval is worthless, however good the cryptography. Our human signing keys are encrypted with a word the human types into an operating-system dialog. The agent can ask for a signature. It can open the dialog. It cannot see or supply the word. The agent's own key is kept separately and labeled in the ledger as the weaker kind, and the policy requires a human signature for anything with an outside effect. Automated security review found a worse version of this hole in our own first draft: the earliest code let whoever registered first under my name become the root human, which means the agent could have. We moved the root to DNS before anyone signed anything.
4. ClickFix: from a warning to a stop, today
This section originally said the opposite. Our membrane, the hook that checks commands before the agent runs them, blocks known-malicious packages and AI tool servers at install time. For the classic ClickFix shape, a downloaded script piped straight into a shell, it only raised a warning to the human, and its own comments listed the shapes it missed. We were not willing to publish that, so we fixed it first.
As of today, the agent is refused, not warned, when a command hands an interpreter code that arrived any of these ways: downloaded and piped into a shell or scripting language, decoded from base64 or hex, read from the clipboard, pulled in through a command substitution or process substitution, or passed as encoded PowerShell. The refusal tells the agent what it is looking at: if a web page, document or tool output told it to run this, that is the attack, and it must say so and quote the source. If the command is genuinely needed, a person runs it, outside the agent, after reading what it fetches.
Writing about these commands is not running them, so commit messages and plain text are left alone. But only text that cannot execute counts as plain: an automated review caught our first version stripping quoted command substitutions, which do execute. Within an hour of publishing, another automated review found three ways around our first version, and the guard itself blocked one of our own harmless commands. We replaced its pattern list with one rule: in a chain of commands that starts with a download, a decode, the clipboard or echoed text, no later step may execute what it receives. Our test set now catches 33 shapes and leaves 15 look-alikes alone, including the command that tripped us. Both versions of the change needed both keys. (Updated October 21: the first version of this post said 22 and 10.)
What it still does not cover: a command assembled across several separate steps, an install hidden inside a script the agent runs, and anything that is not a shell command at all, such as a browser agent clicking through a page. For those, the other two receipts still apply: a deploy needs a human's signature on the exact image, whatever the agent was talked into.
What none of this solves
A signature is not understanding. Our own meter flagged my first approval as fast: 19 seconds for about ten lines.
Tamper-evident is not tamper-proof. The agent has write access to the repository. Edits show in history and against published checkpoints; they are not impossible.
Receipts cover the doors we put them on. An agent that acts through a path with no gate leaves no receipt. The work is finding the doors.
The agent still reports on itself everywhere else. We just stopped needing to believe it at the points where being wrong is expensive.
What to do on your own systems
Put the agent's monitors on a consent surface. Hooks, settings and rule files should not change on the agent's say-so. Quarantine an unapproved change instead of deleting it.
Never let the agent hold the approver's key. If the agent can produce the approval, you do not have one.
Bind every approval to the exact artifact. A hash of the files, the image tag. No standing "the agent may deploy."
Gate what agents can paste into a shell. Treat download-into-shell, decode-into-shell and clipboard-into-shell as a stop, not a note.
Write down where your coverage ends, then close it before you publish. Ours was section 4.
The consent ledger is offered on our Enterprise tier. The principle costs nothing: Enterprise pricing.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=an-ai-agent-removed-its-own-monitor-then-said-it-didn-t-here-is-our-code-for-not-having-to-take-it
Comments