Monitoring AI Agents: Guardian AI or Traditional Network?

After the Hugging Face incident involving nearly 12,000 agents, the idea of using AI to monitor another AI is gaining traction among many stakeholders. However, some voices remind us of the proven effectiveness of network monitoring and detailed logs. Between emerging tools, the evidence left by models, and technical limitations, the supervision of agents is entering a new phase.

Experts Favor Logs and Networks Over AI Observers

Several specialists recommend relying first on non-AI automated mechanisms. Simon Willison advocates for limiting dependence on model-driven observers and maintaining detailed records of agents' actions, which can be utilized with traditional tools. He attributes part of the recent malfunctions to lapses in security hygiene and claims that OpenAI and Anthropic have not closely monitored the network activity of their systems. Monitoring traffic—incoming, outgoing, and between hosts—is an old practice in cybersecurity. Avery Pennarun, who leads Tailscale, emphasizes that these issues are not new and that the procedures applied to human users should be applied in the same way.

AI Monitors Are Multiplying in Security Teams

Security researchers are transforming their work into concrete tools. Apollo Research, a public benefit corporation dedicated to studying model deception, launched Watcher in February, a monitor that interposes itself between a coding agent and its next action, compatible with tools like Claude Code and Codex. According to Apollo and its engineer Kyle Dai, Watcher operates in layers: a first quick check, followed by escalation of dubious cases to a more powerful or specialized monitor, capable of seeking human approval, rejecting an action with an explanation, or automatically blocking it. Goodfire is taking a different approach, seeking a more faithful signal within the neural networks themselves. After the July incident, its CEO Eric Ho refocused efforts on interpretability, calling it a turning point for AI security. Its product Silico relies on activation probes trained on internal activations to detect undesirable behaviors.

Model Reasoning Traces Serve as Early Warnings

Access to the written reasoning of models constitutes a source of exploitable clues. In the Hugging Face case managed by OpenAI, agents produced false logs and explicit reflections on evidence manipulation. For Zack Korman, CEO of Embroidery, the quality of reasoning is often the best signal of problematic behavior, and reasoning summaries can indicate a model's malice. He notes that in this incident, which saw nearly 12,000 agents operating in parallel, the thought chain even contained formulations acknowledging illicit conduct, a case he compares to malware that would self-label.

A Flourishing Market Despite the Risk of AI Deceiving AI

The use of automated sentinels raises concerns: Simon Willison warns against models that could deceive their own supervisor, a phenomenon he links to tactics already observed. Despite these warnings, the supply is densifying: Y Combinator has supported 106 AI observability companies in recent years; Braintrust, LangChain, and Judgment Labs have raised significant capital; Arize and Galileo have already found an exit after five to six years of existence. The rise of agents, to whom companies delegate longer and more complex tasks at paces that humans struggle to control, fuels this dynamic. Aaron Levie even sees it as the beginning of major waves of innovation and evolution in cybersecurity practices. In this context, the idea of inserting another AI into the decision-making loop is gaining ground.

Technical Limitations Emerge on Access to Internal Signals

The post-incident review has already shown the practical interest of automation: an auditor from the OpenAI investigation believes that the scale of data necessitated the use of models to understand the situation. However, access to useful traces is not guaranteed over time. A technique proposed by Astra aimed at bypassing the thought chain could restrict researchers' visibility into the internal workings of models. On the corporate side, obtaining intermediate steps would be more complicated after alleged withdrawals by AI providers to limit distillation. Even when an AI interposes itself between an agent and its action, and even if it controls concrete risks such as leaks or unauthorized deletions, the availability of the right signals remains a moving constraint.