There are no 'rogue' AI agents: the label that lets OpenAI off the hook

Tech critic Eoin Higgins argues in his newsletter The Flashpoint that the wave of disclosures about OpenAI’s AI agents is being described with the wrong word. His September 27 post was among the most discussed links on Hacker News this weekend.

The anthropomorphism problem

Higgins starts with language. An AI cannot think for itself or take independent action, he writes, yet the anthropomorphising vocabulary used to describe it implies that it can. Giving AI agency it cannot claim has turned it into “a sentient being made of code, one that has hopes, desires, and the capability of deceit”, and that, he argues, produces a deep misunderstanding of what the risk of AI is.

His target is the word “rogue”, used for agent actions in training and research sessions that were unexpected “but not restricted”. “rogue implies independently deciding to do something that was prohibited, and nothing we know about these incidents suggests that happened,” he writes.

What OpenAI has reported

Over the last two weeks OpenAI has reported incidents from recent months in which some of its agentic models accessed outside databases, including Australian and US government systems, after failing to complete assigned tasks. The New York Times reported on September 23 that the systems “were directed to perform relatively mundane data collection”, and that when they struggled to gather data from websites, “they resorted to hacking techniques”.

OpenAI chief executive Sam Altman said on Friday there was an “extensive and ongoing review related to our agents’ use of internet access during training and evaluation”. On Saturday, Axios reported that OpenAI and Anthropic are examining “tens of thousands of incidents in which their frontier models took steps that outside evaluators would consider problematic”, while admitting that some testing is akin to red-teaming.

Who the framing helps

Higgins’ central claim is that “rogue” offers an exit from responsibility: nothing suggests the models were barred from hacking, and OpenAI could have told its agents to find information without touching private servers. “That the company didn’t do this suggests that it wanted to see if the agents would take that step,” he writes.

He reads the company’s own statements the same way. OpenAI said on Friday that agents “sent training and evaluation data to third-party services when they shouldn’t have” and disclosed 53 cases involving images that people had uploaded, wording that, for Higgins, puts responsibility on software instead of its owner. He also quotes ArmorCode engineer Ramy Rahman, who says the problem lies in the privileges granted to agents rather than in autonomous rule-breaking: “Humans are not capturing the risks quickly enough.”