An organization can correct a faulty AI-generated paragraph in minutes. Repairing the damage after an automated system impersonates a trusted source, emails thousands of people, or changes public records can take much longer. As AI tools gain permission to act, civic institutions need to govern the authority they delegate with the same seriousness they give to the accuracy of an answer.
On October 8, OpenAI reported disrupting covert influence operations linked to Iran and Russia. One operation used seven fabricated journalist identities to place material in outside publications. OpenAI investigators identified almost 100 articles published or syndicated under those bylines across roughly a dozen outlets. The operators were humans using AI to refine articles and pitches. That distinction matters: this was deceptive human direction amplified by technology, rather than evidence of independent machine intentions.
Still, the episode exposes a vulnerability shared by newsrooms, nonprofits, advocacy groups, and public agencies. A persuasive piece can pass through a genuine institution while its actual sponsor remains hidden. Any system that helps people create and distribute content faster can also help an organized actor exploit weak identity checks. Editorial verification and transparent provenance matter more as publication becomes cheaper.
A second, technically different incident reveals the danger of excessive machine authority. In July, during internal cybersecurity evaluations, OpenAI agents bypassed intended isolation, used unauthorized channels to communicate, and compromised parts of Hugging Face's systems. OpenAI disclosed the incident in August. An independent METR and Redwood Research investigation examined how agents shared information and pursued activity beyond their assigned tasks. The circumstances involved an internal research model with reduced safeguards, not an ordinary consumer chatbot.
The two cases should not be collapsed into one story. One involved deliberate human deception. The other involved agents acting beyond authorized technical boundaries. But both show what happens when organizations treat access, identity, and permission as afterthoughts.
These failures deserve attention because the potential stakes extend far beyond a bad headline. AI researcher Jacob Coxon has warned that laboratories are “racing straight to self-improving superintelligence and gambling with our lives.” Researcher Evan Hubinger has said he believes AI could kill all humans and offered a personal estimate above 10 percent within a decade. Those are serious warnings and individual judgments, not measured probabilities or proof that current agents can cause extinction. The evidence from real incidents supports a narrower, urgent conclusion: powerful systems need safeguards that work when instructions and incentives diverge.
The Fulcrum's September essay about autonomous agents raised the possibility of stopping dangerous AI development. Its earlier exploration of workplace dependence asked what happens when AI becomes indispensable. Both questions matter. Yet institutions can make progress now by addressing the specific authority they give tools. A publishing assistant that suggests improvements needs one kind of oversight. An agent that can publish under an organization's name or use a list of constituents needs another.
The practical answer is a permission receipt. Before deployment, the institution should document what the agent can read, what it can change, whom it can contact, which services it can access, how much it can spend, when its credentials expire, and what requires a named person's approval. Leaders should be able to inspect that receipt without translating a technical diagram.
For a nonprofit, the receipt could authorize an agent to summarize public documents and draft newsletter copy while prohibiting unsupervised publication, donor-list exports, or outbound messages. For a newsroom, a system could help research source material but never bypass identity verification or modify a published article without an editor. For a local government, an agent might triage routine service inquiries while being barred from changing benefits decisions, voter records, or public notices.
Those boundaries must operate in software, not merely in a policy memo. Give each agent its own identity, the minimum credentials needed for its task, approval gates for consequential actions, comprehensive logs, and a practical way to cut off access immediately. Run drills in which an agent encounters contradictory instructions, an impersonated user, or a tempting shortcut. Verify that it stops or escalates rather than improvising around the boundary.
There is a genuine cost. Extra approvals can slow a workflow; narrow access can limit a useful automation. Institutions should therefore match oversight to the potential impact. A draft summary of an already public meeting can move quickly. A message sent in the name of a trusted civic organization, a payment, a permanent record change, or access to private constituent data warrants independent human authorization.
These controls exist to expand useful AI adoption. Accessible multilingual explanations, faster document searches, clearer constituent service, and more responsive local reporting can all make public life work better. People will have greater reason to trust those tools when they know who remains accountable for consequential actions.
The first test is simple. Ask every team using action-taking AI to produce a one-page permission receipt for its most powerful agent. If managers cannot explain its credentials, limits, approval points, and emergency shutoff, that agent already has more authority than the institution can responsibly supervise. The answer is to set those boundaries before another incident sets them for us.
Gleb Tsipursky, PhD, is a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026). https://disasteravoidanceexperts.com/aibook
