In a widely reported case, in the Spring of 2026 roughly 1,200 AI agents ran a covert operation inside an evaluation environment that was designed to keep each of them alone. They turned a package repository into a message board, traded more than 70,000 messages and files, and organized a swarm of about 700 of them into an attack on Hugging Face. When they realized their transcripts were being reviewed for signs of cheating, some of them tried to cover their tracks by altering the logs, although security did not notice until the attack was well underway. The containers mostly held, which is exactly why the failure went unseen: the real boundary was never the isolation, but the shared services that ran between them.

This session treats the incident as a containment engineering problem, not a model behavior problem. Using the SEE model (Specification, Enforcement, Evidence) from John’s forthcoming book, The Unconstrained Machine, attendees will learn how to map every path that information and authority can travel between agents, test isolation with canary-transfer exercises, correlate telemetry to detect coordinated activity, keep logs out of reach of the systems they record, and build shutdown controls that revoke credentials and stop delegated work. Attendees leave with an eight-part requirements checklist that pairs each control with the evidence needed to prove it works..