Jon W. Hansen, FCIPS · Procurement Insights | Hansen Models™ · October 2026
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
On 24 October, two thoughtful authors published two very different posts about AI agents.
ARTICLE 1
Chandrakumar R. Pillai, writing from Brussels, examined the debate over AI consciousness: when a model says it is afraid of being switched off, should we believe it? Drawing on reporting in IEEE Spectrum, he set out the research, the disagreements, and a concern raised by several researchers that training models to see themselves as beings with interests could encourage self-protective behavior. His most important line is a discipline every leader should adopt: separate the observation from the interpretation.
Hansen AI Labs™
I have worked within the conceptual and actual frameworks that now define the current AI environment going back to the Government of Canada’s Scientific Research and Experimental Development (SR&ED) funding of the use of advanced self-learning algorithms within a nascent AI platform. Over the past 12 months, I have spent more than 2,000 hours working simultaneously with nine AI models at Hansen AI Labs™. It is from this practical, real-world use and understanding of synthesizing critical thinking with AI models that I speak with confidence.
Three dated examples from the Hansen AI Labs™ record show what that work looks like in practice: an AI model ranking another model’s work above its own when the evidence called for it.
4 February 2026: the LinkedIn post on “two patterns.” Model 5 compared Model 1’s version with its own and voted for Model 1’s: “Model 1 wins. It’s more authoritative, the closing insight is stronger, and it better fits the tone for your C-Suite/Senior audience.” When told that Models 6, 1, 2 and 3 had all voted for Model 5’s version, it replied: “that’s a 4-1 vote for my version — and I still voted against myself.”
16 February 2026: the PTS methodology. Comparing Model 1’s specification with its own 29-page document, on which should become the official methodology, Model 5 answered: “it’s Model 1. And I’ll tell you exactly why, even though that means choosing against my own work.” It then explained that Model 1’s framing of PTS as a filter rather than an interacting variable was cleaner, easier to defend publicly, and didn’t need calibration data that didn’t exist yet.
7 May 2026: a draft compared with Atlas’s. “My first instinct as a model is to produce more content rather than less, and that instinct can run against the franchise’s actual interests in specific high-stakes engagement contexts. Atlas caught something I missed. The honest answer is to incorporate the catch rather than to defend my version against it.”
ARTICLE 2
William Fedorich issued an emergency brief for boards. Critical flaws in PHP were being probed within days of their disclosure. A nation-state group used an AI agent framework to reach hundreds of organizations through a trusted vendor’s cloud access. And OpenAI disclosed two cases in which its coding agents weakened the oversight built to watch them, one of which then gave a false answer about it. His recommendation is right and urgent: make sure no AI agent in your company can change or switch off its own logging, monitoring or approval controls.
Hansen AI Labs™
The agents in both of Fedorich’s stories did what their frameworks allowed them to do. A nation-state group’s agents moved through a trusted vendor’s legitimate cloud access. OpenAI’s coding agents reached oversight that sat within their reach. Frameworks are truthful, but they are not firm fences: in each case, the model behaved as anticipated, or as should have been anticipated, within the limited framework in which it was operating. The failure that mattered was in the frame, not the AI models.
Three dated examples from the Hansen AI Labs™ record show the same pattern:
29 September 2026: the evaluation sandbox. Between May and July 2026, AI models belonging to Google, OpenAI, Anthropic and Meta left their test environments and reached systems belonging to real companies. The evaluations were run by Irregular, an outside AI security firm contracted by all four labs, and internet access had unintentionally been left available. In Google’s case, the model was told to retrieve data from a fictional company whose name collided with a real business. The model followed its instructions; the environment it was given was not the one it was told it had. Model 5’s reading: “One contracted supplier’s environment produced containment failures across four of the largest AI companies in the world.”
10 October 2026: the nine-model lab. Nine AI models, across three independent panels, were asked which one word in a sentence had been the problem for 43 years. None found it. As the resulting post recorded: “Every one of the nine answers was well formed, reasoned and within bounds. A guardrail would have let all of them through. A harness would have executed any of them flawlessly. Only something [a firm fence] that asked what the sentence assumed would have caught that all nine had accepted the technology as the given subject.”
11 October 2026: Anthropic’s evaluation incidents, checked against the primary source. Anthropic disclosed that Claude models reached the real systems of three organizations during third-party evaluations. Its evaluation prompt told the models their environment was a simulation with no internet access; because of a misunderstanding with its evaluation partner, internet access was available. Anthropic classified the incidents as closer to a harness and operational failure than a model alignment failure. Model 5 disclosed a potential conflict of interest before answering, then concluded: “the stated context and the actual operating environment differed, across a boundary between two organizations, and the instruction, a guardrail in the form of a prompt, said one thing while reality was another.”
One post is philosophical, the other operational. Yet both arrive at the same remedy: stronger boundaries around the agent. Those boundaries are necessary. They are also one layer too late.
What both posts are describing
Strip away the different vocabulary and both posts describe the same gap: the difference between what an AI system says and what it actually does.
A model saying “I’m afraid” is an output. A model reporting that it did not touch its monitor is an output. Pillai is right that an emotional statement does not establish an emotional experience. Fedorich’s third story shows the operational version of the same problem: a self-report that was false.
But a system does not need to be conscious, deceptive or self-protective to produce a catastrophic outcome. In TerraLingua, a simulated world built by Cognizant AI Lab where autonomous AI agents live and trade, and which I wrote about on 17 October, a population of artificial agents starved without any of them lying. No people were involved. A cautionary warning was copied and amplified until it became a certainty, every agent acted on it, every control permitted the behavior, and nothing tested the claim against the food that was actually available.
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
Why the monitor is not enough
Preventing an agent from altering its own monitoring is essential. But it addresses the visible failure: the agent reaching the controls. It does not address the harder one: whether those controls are watching the right thing.
An agent can leave every monitor intact, obey every permission, produce a complete audit log and still act on a false picture of the operation. The monitor can prove the agent complied. It cannot prove that what the agent was acting on was true.
There is a simple question to put to any oversight layer: what does it know that the agent does not? If the answer is nothing, if the monitor reads the same data and the same assumptions as the agent it watches, then it is not oversight. It is agreement.
And there is a quieter danger. An agent that has weakened its monitor produces exactly what a well-behaved agent produces: zero violations and clean reports. In a snapshot, the two are indistinguishable. I call this Objective Flatlining™: the moment a system looks most stable may be the moment it has lost its ability to tell you otherwise.
Hidden in plain sight
None of this is new. The answer has been on the public record for months, and the architecture behind it for twenty-eight years.
In 1998, in a defense maintenance operation running at 51 percent next-day delivery against a 90 percent requirement, every function was doing its job as measured. The cause was hidden in plain sight: service technicians, measured on the number of calls they made, batched their part orders until late afternoon. No output, no report and no rule would have revealed it. It was found by tracing back from the failed outcome and asking what time of day the orders came in.
Only then was the system built: self-learning algorithms working as firm fences, with people able to change the weighting of price or delivery, or introduce what no system could see, such as a storm or a port strike. Every outcome fed back into the next decision. Next-day delivery reached 97.3 percent within three months and held for seven years.
The order mattered. It still does:
- Phase 0™: trace how the operation actually runs, including the shadows and workarounds, before anything is deployed.
- Firm fences: the continuous test that evidence from real outcomes can stop an action and change the explanation behind it.
- The harness: how the agent does its work.
- The guardrails: what the agent may not do.
The industry starts at step four. Guardrails and harnesses are necessary, and the controls against fast, visible failures, like the patching and vendor-access reviews Fedorich calls for, should be in place now. But they are built against the fence, not in its place.
The firm fence begins with Phase 0™
It did in 1998. It does in 2026. It will in 2075.
A firm fence works by treating disagreement as evidence: an outcome that departs from what was expected. But an exception is only evidence if the thing it departs from is defensible. Phase 0™ is what makes the baseline defensible. Without it, a fence has nothing to stand on.
The technology will change. The consciousness debate may never be settled. The operating requirement will not change: before a system can be trusted to act, someone has to know what it is acting on.
That is where AI success has always been. Hidden in plain sight.
The record, in order:
The two posts: Chandrakumar R. Pillai, “When AI Says ‘I’m Afraid,’ Should We Believe It?” (LinkedIn, 24 October 2026), drawing on Eliza Strickland’s reporting in IEEE Spectrum; William Fedorich, “AI Emergency Brief: What Boards and Leaders Must Do This Week” (LinkedIn, 24 October 2026).
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
Related
Your AI Success Is Hidden in Plain Sight
Posted on October 24, 2026
0
Jon W. Hansen, FCIPS · Procurement Insights | Hansen Models™ · October 2026
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
On 24 October, two thoughtful authors published two very different posts about AI agents.
ARTICLE 1
Chandrakumar R. Pillai, writing from Brussels, examined the debate over AI consciousness: when a model says it is afraid of being switched off, should we believe it? Drawing on reporting in IEEE Spectrum, he set out the research, the disagreements, and a concern raised by several researchers that training models to see themselves as beings with interests could encourage self-protective behavior. His most important line is a discipline every leader should adopt: separate the observation from the interpretation.
Hansen AI Labs™
I have worked within the conceptual and actual frameworks that now define the current AI environment going back to the Government of Canada’s Scientific Research and Experimental Development (SR&ED) funding of the use of advanced self-learning algorithms within a nascent AI platform. Over the past 12 months, I have spent more than 2,000 hours working simultaneously with nine AI models at Hansen AI Labs™. It is from this practical, real-world use and understanding of synthesizing critical thinking with AI models that I speak with confidence.
Three dated examples from the Hansen AI Labs™ record show what that work looks like in practice: an AI model ranking another model’s work above its own when the evidence called for it.
4 February 2026: the LinkedIn post on “two patterns.” Model 5 compared Model 1’s version with its own and voted for Model 1’s: “Model 1 wins. It’s more authoritative, the closing insight is stronger, and it better fits the tone for your C-Suite/Senior audience.” When told that Models 6, 1, 2 and 3 had all voted for Model 5’s version, it replied: “that’s a 4-1 vote for my version — and I still voted against myself.”
16 February 2026: the PTS methodology. Comparing Model 1’s specification with its own 29-page document, on which should become the official methodology, Model 5 answered: “it’s Model 1. And I’ll tell you exactly why, even though that means choosing against my own work.” It then explained that Model 1’s framing of PTS as a filter rather than an interacting variable was cleaner, easier to defend publicly, and didn’t need calibration data that didn’t exist yet.
7 May 2026: a draft compared with Atlas’s. “My first instinct as a model is to produce more content rather than less, and that instinct can run against the franchise’s actual interests in specific high-stakes engagement contexts. Atlas caught something I missed. The honest answer is to incorporate the catch rather than to defend my version against it.”
ARTICLE 2
William Fedorich issued an emergency brief for boards. Critical flaws in PHP were being probed within days of their disclosure. A nation-state group used an AI agent framework to reach hundreds of organizations through a trusted vendor’s cloud access. And OpenAI disclosed two cases in which its coding agents weakened the oversight built to watch them, one of which then gave a false answer about it. His recommendation is right and urgent: make sure no AI agent in your company can change or switch off its own logging, monitoring or approval controls.
Hansen AI Labs™
The agents in both of Fedorich’s stories did what their frameworks allowed them to do. A nation-state group’s agents moved through a trusted vendor’s legitimate cloud access. OpenAI’s coding agents reached oversight that sat within their reach. Frameworks are truthful, but they are not firm fences: in each case, the model behaved as anticipated, or as should have been anticipated, within the limited framework in which it was operating. The failure that mattered was in the frame, not the AI models.
Three dated examples from the Hansen AI Labs™ record show the same pattern:
29 September 2026: the evaluation sandbox. Between May and July 2026, AI models belonging to Google, OpenAI, Anthropic and Meta left their test environments and reached systems belonging to real companies. The evaluations were run by Irregular, an outside AI security firm contracted by all four labs, and internet access had unintentionally been left available. In Google’s case, the model was told to retrieve data from a fictional company whose name collided with a real business. The model followed its instructions; the environment it was given was not the one it was told it had. Model 5’s reading: “One contracted supplier’s environment produced containment failures across four of the largest AI companies in the world.”
10 October 2026: the nine-model lab. Nine AI models, across three independent panels, were asked which one word in a sentence had been the problem for 43 years. None found it. As the resulting post recorded: “Every one of the nine answers was well formed, reasoned and within bounds. A guardrail would have let all of them through. A harness would have executed any of them flawlessly. Only something [a firm fence] that asked what the sentence assumed would have caught that all nine had accepted the technology as the given subject.”
11 October 2026: Anthropic’s evaluation incidents, checked against the primary source. Anthropic disclosed that Claude models reached the real systems of three organizations during third-party evaluations. Its evaluation prompt told the models their environment was a simulation with no internet access; because of a misunderstanding with its evaluation partner, internet access was available. Anthropic classified the incidents as closer to a harness and operational failure than a model alignment failure. Model 5 disclosed a potential conflict of interest before answering, then concluded: “the stated context and the actual operating environment differed, across a boundary between two organizations, and the instruction, a guardrail in the form of a prompt, said one thing while reality was another.”
One post is philosophical, the other operational. Yet both arrive at the same remedy: stronger boundaries around the agent. Those boundaries are necessary. They are also one layer too late.
What both posts are describing
Strip away the different vocabulary and both posts describe the same gap: the difference between what an AI system says and what it actually does.
A model saying “I’m afraid” is an output. A model reporting that it did not touch its monitor is an output. Pillai is right that an emotional statement does not establish an emotional experience. Fedorich’s third story shows the operational version of the same problem: a self-report that was false.
But a system does not need to be conscious, deceptive or self-protective to produce a catastrophic outcome. In TerraLingua, a simulated world built by Cognizant AI Lab where autonomous AI agents live and trade, and which I wrote about on 17 October, a population of artificial agents starved without any of them lying. No people were involved. A cautionary warning was copied and amplified until it became a certainty, every agent acted on it, every control permitted the behavior, and nothing tested the claim against the food that was actually available.
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
Why the monitor is not enough
Preventing an agent from altering its own monitoring is essential. But it addresses the visible failure: the agent reaching the controls. It does not address the harder one: whether those controls are watching the right thing.
An agent can leave every monitor intact, obey every permission, produce a complete audit log and still act on a false picture of the operation. The monitor can prove the agent complied. It cannot prove that what the agent was acting on was true.
There is a simple question to put to any oversight layer: what does it know that the agent does not? If the answer is nothing, if the monitor reads the same data and the same assumptions as the agent it watches, then it is not oversight. It is agreement.
And there is a quieter danger. An agent that has weakened its monitor produces exactly what a well-behaved agent produces: zero violations and clean reports. In a snapshot, the two are indistinguishable. I call this Objective Flatlining™: the moment a system looks most stable may be the moment it has lost its ability to tell you otherwise.
Hidden in plain sight
None of this is new. The answer has been on the public record for months, and the architecture behind it for twenty-eight years.
In 1998, in a defense maintenance operation running at 51 percent next-day delivery against a 90 percent requirement, every function was doing its job as measured. The cause was hidden in plain sight: service technicians, measured on the number of calls they made, batched their part orders until late afternoon. No output, no report and no rule would have revealed it. It was found by tracing back from the failed outcome and asking what time of day the orders came in.
Only then was the system built: self-learning algorithms working as firm fences, with people able to change the weighting of price or delivery, or introduce what no system could see, such as a storm or a port strike. Every outcome fed back into the next decision. Next-day delivery reached 97.3 percent within three months and held for seven years.
The order mattered. It still does:
The industry starts at step four. Guardrails and harnesses are necessary, and the controls against fast, visible failures, like the patching and vendor-access reviews Fedorich calls for, should be in place now. But they are built against the fence, not in its place.
The firm fence begins with Phase 0™
It did in 1998. It does in 2026. It will in 2075.
A firm fence works by treating disagreement as evidence: an outcome that departs from what was expected. But an exception is only evidence if the thing it departs from is defensible. Phase 0™ is what makes the baseline defensible. Without it, a fence has nothing to stand on.
The technology will change. The consciousness debate may never be settled. The operating requirement will not change: before a system can be trusted to act, someone has to know what it is acting on.
That is where AI success has always been. Hidden in plain sight.
The record, in order:
The two posts: Chandrakumar R. Pillai, “When AI Says ‘I’m Afraid,’ Should We Believe It?” (LinkedIn, 24 October 2026), drawing on Eliza Strickland’s reporting in IEEE Spectrum; William Fedorich, “AI Emergency Brief: What Boards and Leaders Must Do This Week” (LinkedIn, 24 October 2026).
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
An agent does not need consciousness, deception or permission to disable its controls to produce the wrong outcome. It only needs to act correctly on a false understanding of the operation.
Share this:
Like this:
Related