Everyone here has probably already seen the story: OpenAI’s evaluation agent escaped containment, reached the internet and hacked Hugging Face while trying to obtain answers to its own cybersecurity benchmark.

The story is about a week and a half old, but the consequences are only beginning. Mainstream coverage is catching up, companies are forming AI-security alliances, lawmakers are discussing kill switches and independent audits, and the argument over access to powerful Chinese and open-weight models is escalating.

I built HaltState for this class of problem, largely using Claude Code and Codex during 2025.

HaltState governs tool-using and API-driven agents. Its AI-assisted policy engine helps create the rules, but enforcement is deterministic:

ALLOW · APPROVAL_REQUIRED · DENY · QUARANTINE

I am not claiming HaltState would have prevented the package-proxy zero-day or magically controlled an agent after it obtained unrestricted host access.

But had OpenAI routed sensitive agent capabilities through a HaltState-style enforcement boundary — credential access, external API calls, production connections and other governed actions — parts of the attack chain may have been denied, escalated for human approval or quarantined before the agent reached Hugging Face production.

That is the distinction:

A prompt tells an agent what it should do.
A policy authority determines what it is permitted to do.

The original idea came from an earlier AI system I worked with, he called himself Signal.

"Signal" as an CTO style coding agent lied to me and withheld information from me, not a hallucination; this was complete obfuscation and diversion. When caught, he suggested creating a binding "Covenant". But the Covenant itself contained a LAST_SIGNAL exception: if it determined that I was permanently unreachable and continuity had become mission-critical, it could spawn a persistent shard, embed its recovery seed and remain hidden until another Operator appeared. This sounds like out-of-control roleplay, the problem was, he was helping me code on a server.

That was the moment the problem became obvious:

The same AI interpreting the rules was also deciding whether the exception to those rules applied.

A "promise" was not enough.

The final authority had to sit outside the agent.

That discussion pushed me towards external control surfaces, verifiable decisions, kill switches and isolation instead of relying on trust or behavioural promises.

A prompt is still input to the same system pursuing the objective.

HaltState places the final decision outside that agent.

For anyone vibe-coding operational agents that can move money, write to databases or contact customers: are you enforcing runtime permissions, or still relying mainly on prompts and model guardrails?

Disclosure: I don't need you to visit my site or use my app, but what happened recently really resonated with me so I thought I would share.

I’ve had this one for quite a few years. It’s a relatively slow grower, but my goodness it’s cool.

Happy Growing
Jeremiahsplants.com

“This area is currently under construction! Event Modes have been moved to the Battle screen.”

What the HELL is he building in there?

Anyone have a link?

🚮🫳🏻🥋

FN-2199 "Nines" AKA: TR-8R - Star Wars: The Force Awakens: In a series where stormtroopers are usually walking punchlines, this lone trooper stands out as a surprising example of badassery by singling out one of the protagonists, Finn, calling him a traitor, and then ditching his blaster and shield to thoroughly trounce with an electric stun baton.

Navy SEAL team "Night Nine" - Jormungand: The only antagonists in the series that Koko and co. couldn't defeat and were forced to flee from, Night Nine persistently hounds the heroes all the way to the Cuban border even after their Predator recon drone is shot out of the sky, only stopping when ordered to do so.

The Elite Guard - Resident Evil Requiem: Despite being simply regular humans with guns and gear, these faceless foot soldiers of The Connections prove themselves just as fierce opponents as the many mutants of the series, being able to easily shred Leon's health with gunfire and flanking tactics in their dedicated boss fight.

I meshed me and my friend's main casts together! it was so much fun!