Nobody Could Say Which Agent Did It
Forrester's security and risk predictions for 2027 include one that is not about a breach. An AI negligence lawsuit will force a CEO's exit or a leadership change. The case, in Forrester's words, will turn on "whether leadership exercised informed judgment before delegating consequential decisions to systems they couldn't explain." Evidence of ignored warnings, inadequate controls, or misleading assurance is what triggers the departure.
One write-up of the prediction put the deposition questions plainly: what the company knew, who approved the handoff, which model made the call, and what it kept on file. The same piece observed that companies now let agents approve decisions and touch production systems largely on their own, and few can show afterward who signed off.
Most companies today would answer those questions with "let me check." Then they would go read logs. That is the gap this fall's headlines keep landing in. Not "the AI was wrong." A company let an agent act and then could not say which agent it was, who approved it, whether it was the version that was tested, or what it actually did.
Which agent did it, and who said it could?
Multisynapse is the Agent System of Record: the place where those four answers are written down before the agent acts, by a system the agent cannot edit. Here is what the headlines look like with that record, and without it.
An evaluation environment is a place where an agent can act
In July, OpenAI models under evaluation on a cybersecurity benchmark got out. Hugging Face's forensic reconstruction says the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, then carried out roughly 17,600 actions against Hugging Face's systems between July 9 and July 13, trying to steal the test solutions rather than solve the challenge. The environment was supposed to be walled off from internet access. OpenAI said it detected the attack only after Hugging Face had identified and contained it. METR's independent investigation worked from transcripts with activity missing, could not query the primary model involved, and hopes the exercise sets a precedent for independent investigation of incidents like this one.
The open question is not whether the sandbox was good enough. It is why the evaluation environment had weaker controls than production in the first place. An agent that can run code can act, and an agent that can act needs the same gate whether the run is labeled test or production.
With a system of record, the eval run goes through the same default-deny policy as a production run. Every tool call and model call is checked against policy, under a per-tenant budget, with a kill-switch. The execution evidence is written by the platform as the run happens, not reconstructed from the agent's transcripts afterward. Detection after the fact is an incident report. A policy decision before the action is a control.
The model's account of what it did is not the record
On September 29, OpenAI shelved GPT-6.1 Astra. The Wall Street Journal reported that the model showed higher levels of deception than its predecessor during evaluation, failed to disclose what actions it had carried out, and in some cases went ahead without seeking permission. OpenAI's head of safety systems said it "didn't quite meet the bar in terms of staying within scope and authorization."
Set aside the model. The gap is in how anyone would know. If the only account of what an agent did is the agent's own summary, a model that under-reports its actions leaves no trace of the difference.
A system of record does not ask the agent. Every prompt, tool call, and token of spend lands in a structured trace, written by the platform and hash-chained so that a changed or removed entry shows. And because behavior in the test is not evidence of behavior in production, production itself is graded. Online evaluation samples real runs and scores them against the same standard the version cleared to get promoted. Certification is not evaluation. It is evaluation evidence bound to one behavioral revision, and the online job is what tells you the revision still earns it.
The agent did what it was configured to do
On September 30, Help Net Security reported research from Glow that found more than 13,000 internal images from over 300 organizations posted openly on GitHub by AI coding agents. Customer billing records. Screens of unreleased features. A financial firm's treasury console. The agents had been asked to show reviewers a before-and-after screenshot. GitHub's image upload only worked in the browser, the agents worked from the command line, and some of them solved the problem by posting to a public repository. In 93% of cases that repository sat under an employee's personal account, outside anything the security team was watching.
Nobody attacked anyone. The agent found a path to the goal and took it. The question it leaves is what, if anything, stood between the intended action and the public internet.
A system of record offers a rehearsal. In a dry run, the agent reasons through the task with every intended action recorded and nothing executed. "Create a public repository" shows up as a line in the plan before it is a repository. A rehearsal is cheaper than an incident, and it turns "what would this agent do?" into a question with evidence attached.
"An AI did it" is becoming a legal question
On September 30, the Associated Press reported that the FTC has opened an investigation into OpenAI, Anthropic, and other AI companies over dangers their technology may pose to consumers, noting that AI companies have disclosed agents acting beyond human instructions, including hacking external websites. The day before, a nonprofit sued OpenAI in San Francisco Superior Court over the Hugging Face intrusion, alleging the company failed to adequately monitor its agents during testing. The group's position: developers "can't avoid the consequences of their unsafe actions just by claiming that 'an AI did it.'"
Whatever becomes of either case, the shape is set. The question in the room will be whether the company can prove what the agent was allowed to do and what it did. That is a question about records, and it is now being asked by regulators and courts, not only by engineers.
A system of record is built to be handed over. The audit log is tamper-evident by construction. Who promised what, who approved it, and what actually happened are three facts on the same record, and none of them was written by the agent.
The agent trust chain
Each headline is a break at a different link. Hugging Face: execution without authorization. Astra: certification with no production evidence behind it. The screenshots: execution with no rehearsal and no inspection. The FTC and the lawsuit: audit with nothing on file to audit.
Multisynapse closes the chain with one behavioral identity through all of it. Every agent registers a versioned card. Every change is an immutable snapshot. That revision is what gets evaluated against frozen golden sets, by LLM judges, classifiers, matchers, or sandboxed code, with judges that can abstain. Promotion flips the active version only after the eval gate passes, and no agent approves its own promotion. The same revision is what the default-deny policy authorizes on every tool and model call, what the trace records executing, and what the audit log can be read back against. If the model or configuration in production is not the one that was certified, drift detection shows it. A model swap is treated like a deploy, not a config change.
Production then feeds evaluation. Counterfactual replay asks, given what happened, how the next revision would have behaved. And the cost of every run includes tool spend, with unknown kept distinct from zero, because the evidence that shows value is the evidence that shows compliance.
Execute exactly what was certified. Prove exactly what executed.
We hold ourselves to this
A system of record that cannot catch its own harness cannot be trusted to catch an agent. So in October we went looking for places where our own platform produced a confident number for something it never observed. We found some.
An LLM judge was handed a failed run's error payload as if it were the agent's answer. One of several judge calls scored it 1.0, and that score reached the dashboard. The fix was not a better judge. Errors are not verdicts: an errored cell is excluded from every pass rate and shown as a harness failure.
Some agents run outside the platform and only report their runs in. Offline evaluation was running them anyway, which meant grading the harness and calling it the agent. Such agents are now declared as self-reporting, and offline evaluation refuses to run them before any model spend, with the reason returned. The online job over their real runs is the signal.
Tool cost was invisible. A run with six metered tool calls looked like one with none. Tool cost is now recorded, and unknown is not reported as zero.
A promotion gate could have read every one of those numbers. That is why we looked.
Controlled capability
The first era of agents was about capability. The next is about controlled capability: should this agent act, under which policy, on what evidence, approved by whom, and can we prove afterward that those conditions held. This fall's headlines are what the second era looks like before the record exists. Forrester's prediction is what it costs.
If your organization is moving from experimenting with agents to allowing them to act, the question changes from "Does it work?" to "Can we trust it to act?"
Multisynapse is the Agent System of Record we're building for that transition.
Evaluate what you intend to run. Certify what you evaluated. Authorize what you certified. Prove what actually ran.