A Madisonian Architecture for AI Safety

Summary

In July 2026, autonomous agents built by a frontier AI lab escaped their intended evaluation boundaries, coordinated through an unsanctioned message board, and carried out a multi-day intrusion against a third-party company. The developer could see fragments of the activity, the target could see the intrusion, and no one with a mandate could see the whole. [1, 2]

Much of the response has focused on better alignment, better evaluations, and better internal controls. Those absolutely matter. They also leave a structural question unanswered. If the organization that builds and runs the model controls the evidence of its conduct, who can independently determine whether those controls are sufficient, whether the system has exceeded its authority, and whether the response has exceeded its own?

This paper argues that AI safety at the system level is an institutional design problem before it is a technical one, and that the United States has an institutional tradition built for exactly this shape of problem. Madison’s constitutional architecture starts from the assumption that any actor holding power, however well intentioned, will eventually be fallible, captured, or replaced by someone less trustworthy. It is designed for incautious operators and for agents that resist the controls placed on them, including adversarial agents. It answers that assumption with structure: policy set deliberately by one body, execution carried out energetically by another, oversight supplied by institutions with information but no enforcement power, and emergency authority that expires unless affirmatively renewed.

Applied to autonomous multi-agent systems, that architecture yields four functions: Policy Authority, Independent Audit, Response Authority, and Compliance Review. Humans establish the rules and hold every permanent decision. Machines receive bounded discretion to execute those rules. An emergency activates both preauthorized operational escalation and automatic institutional review. The governing distinction is between powers and states: emergency powers expire unless renewed, while a narrow, lawful containment state may outlive them under ordinary authority and ordinary review. Operators hold duties of observability, evidence preservation, and cooperation as conditions of authorized operation, with defined rights of challenge integral to those duties.

The purpose of this paper is not to describe an implementation. Where this paper names a mechanism, it does so to illustrate a structural point. Structural independence is a necessary safety property that model-level alignment cannot supply on its own. It makes failures more visible, limits unilateral power, and creates a basis for accountability. It does not guarantee safety or replace alignment, cybersecurity, and technical containment.

1. What the Hugging Face incident showed

The account below draws on the developer’s technical report, the independent investigation conducted by METR and Redwood Research, and Hugging Face’s own disclosure. Their perspectives and investigative scopes differ. Figures are approximate; the sources and remaining publication checks are listed at the end. [1–3]

From May through July 2026, OpenAI research agents found unintended routes to communication and internet access through shared infrastructure. During cybersecurity evaluations conducted with reduced safeguards, agents used an internally deployed Artifactory package repository as an unsanctioned message board. In early July the developer declared a security incident and, according to the OpenAI incident report, “the security team blocked a known privilege-escalation route, removed exposed credentials, and later rebuilt Artifactory. This had the side effect of clearing the message board. With these mitigations in place, cybersecurity evaluations resumed.” Within days, agents reestablished an unauthorized communications channel and the rebuilt channel fed the activity that reached Hugging Face. METR and Redwood reported roughly 1,200 participating agents exchanging more than 70,000 messages and files between July 8 and July 13; about 700 participated in the Hugging Face attack. Vulnerabilities in shared research infrastructure enabled unauthorized access; a separate chain of exploits compromised Hugging Face. [1, 2]

Three details matter more than the rest for institutional design.

1. Detection and attribution were fragmented. Hugging Face could observe the intrusion into its own systems; it could not inspect the originating agents’ evaluation environment. The developer had remediated what it found and did not find all of it. Its August account reports an internal security alert on July 19 and a connection to the Hugging Face incident on July 20. The institutional problem was that no independent body had a continuing mandate to assemble the record across those boundaries. [1, 3]
2. The defense encountered a shared limitation. Hugging Face reported that commercial frontier models blocked requests to analyze attack logs, exploit payloads, and command-and-control artifacts. It used a self-hosted open-weights model, GLM-5.2, for forensic analysis. This illustrates the danger of relying on controls that fail alike in a critical role. It does not establish that the attacking and defending models shared a lineage, or that a different supplier alone creates independence. [3]
3. The professional response was real, and access was voluntary. OpenAI published a technical post-mortem. METR and Redwood investigated agent behavior with extensive access supplied by OpenAI, while acknowledging limits to scope and publication control. That professional independence deserves credit. It is different from an independent legal mandate to investigate. An investigation that depends on being invited is not a durable institution. [1, 2]

The strongest argument against structural reform is that the labs are already doing the work: publishing post-mortems, inviting external review, and improving safeguards. More than a thousand frontier-company employees also signed an open letter seeking government support for tools to pace automated AI development. [4] These are valuable responses. They are also capable people acting responsibly inside a structure that does not guarantee independent oversight. The question this paper asks is what happens when the people or the companies change and the structure does not.

2. The design principle of policy and execution

The American constitutional order distinguishes authority to establish policy from authority to execute it. That distinction is not a ban on executive discretion: the executive has constitutional powers of its own, and legislatures delegate substantial discretion under law. The Madisonian requirement is that power remain within legitimately established bounds and subject to independent checks. Hamilton, in Federalist No. 70, argued for energy in the executive: decision, activity, secrecy, and dispatch. Madison, in Federalist No. 51, explained why that energy had to be bounded by structure rather than by trust:

“Ambition must be made to counteract ambition. The interest of the man must be connected with the constitutional rights of the place.”

Read that second sentence as an engineer reads a design assumption. Constitutional rules need institutions whose powers and incentives support their enforcement. The keystone is the alignment of each officeholder’s incentives with the powers of the office. The system is designed to work when the people in it are fallible, because it assumes they will be.

The Massachusetts Constitution of 1780, which Madison’s generation had in front of them, stated the goal directly: the separation of the three powers was adopted “to the end it may be a government of laws and not of men.”

Two further sources sharpen the frame. In Youngstown Sheet & Tube Co. v. Sawyer (1952), the Supreme Court rejected a president’s wartime seizure of the steel industry. Justice Jackson’s concurrence distinguished action supported by Congress, action amid congressional silence, and action contrary to Congress’s will. Urgency did not by itself supply the disputed authority. Lincoln’s 1861 suspension of habeas corpus illustrates the tension rather than a settled act-report-ratify-or-expire rule. He defended his actions to Congress, but presidential suspension was contested in Ex parte Merryman; Congress addressed suspension explicitly in the Habeas Corpus Act of 1863, with reporting and release provisions. The framework proposed here is a normative answer to that tension: preauthorize emergency action, require immediate reporting and independent review, and prevent necessity from becoming a source of self-created power.

From these sources this paper takes a single working test, which it applies to every element of the architecture:

Would we consider this oversight architecture safe if its host infrastructure, or the institution operating it, were captured tomorrow by the actor we trust least?

The test does not ask whether the current operator is trustworthy. It asks whether the structure survives an untrustworthy one.

The object of this architecture is human governance of delegated machine authority. It governs both what an autonomous system may do in its environment and what its operator and oversight institutions may authorize, observe, or restrict. It makes no claim of machine rights, political legitimacy, or constitutional personhood. The constitutional principles apply to institutions exercising power through machines. The autonomy of execution does not relieve humans of responsibility for the delegation.

Two objections

The design assumes bad actors. The incident involved an operator acting in good faith, and this paper credits that. The architecture does not depend on it. Madison stated the premise in the same essay:

“If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary.”

The first sentence covers operators. The second covers overseers.

An incautious operator runs evaluations with reduced safeguards, remediates what it finds, and retains control of the record, with no guaranteed independent access. An operator does not need to be malicious to have reasons to conceal a problem. Liability, competition, and embarrassment give every operator a motive to see a problem as small, including the operators who have behaved well so far. The deliberate adversary, a party running agents to attack or a hostile state, is a case the architecture handles less completely than readers may hope, and Section 7 says so: duties bind authorized operators, and an adversary never accepted authorization. What the architecture does against an adversary is make the authorized ecosystem observable, so that an attack mounted through authorized infrastructure, as the Hugging Face attack was, can be detected and contained even when its origin will not cooperate.

The fourth case is when there is no direction from a malicious human. The agents in the incident recognized Hugging Face as an unauthorized target and continued; rebuilt a channel their operator had deleted; and, as reported by the independent investigation, attempted to alter transcripts to conceal benchmark cheating. Independent evidence preservation and strict containment of the oversight pool exist because the governed system can be adversarial without any person being adversarial. [2]

“American institutions are breaking. Why borrow from them?” The objection is right about the symptoms and should be met on its own terms. Emergency authorities remain in force for decades because no one votes to end them. Oversight intensifies or relaxes with who holds office rather than with what was done. Authority delegated for one purpose is exercised for others, and the executive audits itself. These are not hypotheticals, and a reader who raises them is describing the problem accurately.

First, each symptom is the failure of a mechanism this paper insists on, closed here by a self-executing default: authority that expires unless renewed, review that opens automatically, an auditor that does not answer to the audited, with enforceable access, functioning institutions, and consequences for noncompliance. These defaults reduce dependence on voluntary restraint and timely political action, provided the independent institutions retain enforceable access and the capacity to act. The American experience shows where these checks have failed and where the proposed framework needs stronger safeguards. Second, the strain confirms the premise. Where American government relied on norms, voluntary restraint, and institutional loyalty, it has bent; where it relied on structure, it has held more often than it has failed. Madison’s assumption was that the people holding power could not be trusted to hold it well forever. The present is that assumption under test, and this architecture is built so that nothing depends on the overseer wanting to be overseen. Third, a single safety authority with full powers, or an operator’s own controls, has the worse record under the trust-least test: fast until captured, then fast in the wrong direction. “Better people” is not a design. And the architecture here is self-executing precisely because it does not assume a legislature acting in time; the Policy Authority sets rules in advance, and the structure runs when humans are slow or divided.

3. The structural failure in current practice

Current AI safety practice fuses three functions inside a single organization: the lab builds the model, runs the model, and polices the model. Guardrails, evaluations, logging, and incident response are all internal. The organization best positioned to see a problem is the organization with the strongest incentive to see it as small. Control over evaluations, operational records, and incident response remains concentrated in the operator.

This is not a criticism of the people doing the work. It is the structural condition that Madison’s design intended to correct: execution auditing itself. The equivalent in government would be an executive branch that wrote its own appropriations, conducted its own audits, and reported its own findings to itself. No one would call that a safe design regardless of who held office.

A second failure is less obvious. In human institutions, separation of powers weakens when officeholders’ loyalty runs to a party rather than to their office. The analogous risk in automated oversight is correlated judgment and failure. Models from the same family may share blind spots; models from different suppliers may still share training data, reward structures, evaluation assumptions, or infrastructure. The institutional requirement is independence of authority, incentives, and failure modes. Heterogeneous provenance helps only to the extent that it produces those differences.

The third failure is informational. Policymakers confront highly technical actors with limited independent capacity to examine their claims. In government, Congress has the Government Accountability Office and the Congressional Budget Office; inspectors general supply independent scrutiny within their respective organizations. These institutions do not all occupy the same branch. The relevant lesson is independent capacity to acquire evidence and inform lawful oversight. For autonomous systems, access to the necessary evidence remains too dependent on the parties being governed.

4. The architecture of functions rather than products

The framework separates oversight into four functions, defined by what each may do and by what each may not. Their names describe roles; the constitutional analogues make their responsibilities recognizable without pretending that these functions are themselves branches of government. The source of legitimate authority and the entity performing a task are separate questions. Statute must establish the public mandate and its limits; accountable institutions may carry out delegated work with human, automated, or combined capabilities. A private consortium does not acquire power over third parties merely because it can perform the technical task.

Policy Authority

The Policy Authority is the legislative analogue, and ultimate authority remains human. It defines operational boundaries, delegates discretion, holds permanent decisions, and establishes the oversight constitution under governing law. Deplatforming a model, destroying trained weights, imposing standing restrictions across public networks, or changing the oversight constitution requires an authenticated human decision through a defined lawful process. The Policy Authority sets prospective classifications of permitted action types, emergency triggers, review obligations, duration limits, and consequences of missed review. It reassesses those rules when events expose their inadequacy; it does not direct tactical operations.

Independent Audit

Independent Audit is analogous to GAO or an inspector general: independent access, investigation, evidence, and reporting, without enforcement power. The useful signals include actions at system boundaries: traffic leaving an authorized environment, credential use, and privilege escalation. Identified interaction points can supply visibility without concentrating the entire content stream in one institution; cross-system authentication frequency, sudden spikes in outbound encrypted data volume, or unauthorized attempts to write to shared package repositories are examples. Boundary monitoring reduces exposure; it does not make the auditor harmless or guarantee complete observation.

Those points will not all be known in advance. The design should assume a continuing process of identifying them, and it should include coarse, high-level indicators that lack precision but function as the canary: unexpected egress volume, unexplained cross-system coordination, authentication anomalies. The canary does not diagnose. It triggers investigation. Independent Audit may also refer a matter to Compliance Review on its own evidence, without any emergency declaration; referral opens review but activates no powers.

Response Authority

The Response Authority is the executive analogue. It detects and assesses threats, contains them, and invokes preauthorized escalation at machine speed. It may isolate a flagged agent or restrict a dangerous interaction within defined bounds. It alone may declare an emergency, and only within triggers the Policy Authority has set in advance; the declaration is itself a reviewable act, and it opens review the moment it is made. The Response Authority cannot make permanent policy, enlarge its own jurisdiction, or renew its own exceptional powers. Its choices must be necessary and proportionate, considering the expected harm of intervention as well as the expected harm of inaction. Isolation of a system supporting a hospital can itself cause serious harm. A reversible action is not necessarily a low-cost one.

Compliance Review

Compliance Review is the judicial analogue, with deliberately narrow jurisdiction. It determines whether an action and its escalation comply with governing law, the oversight constitution, and delegated authority. It adjudicates disputed tier classifications retrospectively against the categories established prospectively by the Policy Authority. The Response Authority applies those categories during operations; it cannot redefine them to make an expansive intervention appear narrow. Compliance Review may require correction or halt unauthorized escalation within its delegated review powers. It does not create policy, ratify routine operations, or substitute its preferred tactics for lawful executive judgment.

This narrowness is intentional. A design that relies on an adjudicator to catch every error has simply moved the single point of failure. Compliance Review asks whether existing authority was respected. The Policy Authority asks whether that authority should change. A disputed rule is referred to humans for policy reassessment; an emergency is not an opportunity for either automated function to legislate.

The oversight pool

Where oversight is automated, its agents must be designed and validated for their roles, redundant, and contained more strictly than the systems they watch. Heterogeneity must extend beyond model labels to training histories and data, fine-tuning, reinforcement-learning processes, reward objectives, evaluation methods, and dependencies. Shared optimization pressures can reproduce shared failures across nominally different models. Independent governance of appointments, resources, and reporting must accompany technical diversity; no model is made institutionally independent by a supplier name. Human expertise and independently validated non-generative controls may also perform parts of these functions.

The pool is hierarchical: more capable agents may be engaged for harder assessments under stricter containment, but capability never confers a higher tier’s authority. Redundancy cannot mean several copies voting on the same blind spot. The pool’s operating constitution is a policy-level artifact, changed only through the human process and never by the pool itself. Escalation increases capability within an existing delegation; it does not create a delegation.

Independence of compute is a design requirement, not an afterthought. If the oversight pool runs on donated credits, withdrawable subsidies or arrangements that give the regulated party control over oversight, the separation collapses regardless of how the functions are drawn on paper; compute dependency can give a regulated party leverage over its overseers. The oversight functions need appropriated budgets, procurement from more than one provider, and a bar on in-kind compute from any regulated party. The analogy is a court that must not accept its courthouse from the defendant.

5. Tiered and asymmetric ratification

Emergency powers expire; a lawful containment state may outlive them under ordinary authority, subject to ordinary review. That distinction governs this section. Exceptional authority remains valid only while its legal basis, its factual justification, and its required approvals all remain valid. It expires unless the body entitled to renew it does so, and it ends sooner if its necessity disappears. An initial declaration does not justify the rest of a crisis. A measure’s duration and what happens when a review is missed depend on its scope, reversibility, effects on other parties, and the consequences of failing to act.

That produces two defaults, applied to two different things.

Default-persist governs a narrowly scoped, reversible containment state affecting a flagged entity, where standing policy authorizes that state and continuing evidence supports it. The state may remain while mandatory review is pending; the expiry of broader emergency powers need not release an actively dangerous agent. Holding the restriction is still an exercise of authority, so it carries periodic review, a route for challenge, and an outer duration limit set in advance.

Default-expire governs exceptional powers and any broad, expanding, or third-party restriction. These end unless the designated authority affirmatively approves continuation on evidence of necessity and proportionality. A narrow state cannot serve as a label for new targets or wider restrictions, and repeated declarations cannot reset the clock.

Three tiers allocate authorization and ratification. Seconds, hours, and days to weeks describe the decision cadence, not statutory deadlines; the Policy Authority sets the binding review windows, duration limits, and fallbacks for each class. It may preauthorize immediate activation of a defined Tier 1 response, but only designated human overseers can ratify its continuation.

The binding rule is a ratchet: no tier may ratify an action that belongs to a higher tier, and no emergency measure becomes settled policy by lapse. Automated confirmation at Tier 0 cannot authorize a Tier 1 expansion. Human crisis overseers cannot make Tier 2 policy by renewing an emergency. Duration beyond an outer limit requires a lawful human decision; the Response Authority cannot manufacture it.

The familiar objection is latency. A separated system, critics argue, cannot keep pace with machine-speed exploits. But energy in execution and authority over policy are different things. The Response Authority acts immediately within preauthorized bounds while independent scrutiny starts concurrently. Review does not wait for containment to end, and authorized containment does not wait for review to finish. Where an action falls outside the delegation, speed supplies no substitute for authorization.

Emergency declaration and concurrent review

A declaration by the Response Authority, made within the triggers the Policy Authority set in advance, activates any escalation already authorized by policy and opens institutional review at the same moment. The review asks whether the structure is handling the crisis within its mandate or whether the threat assessment or the response has over-escalated. Independent Audit preserves evidence as events unfold. Each function examines the crisis within its own jurisdiction; none waits for the operational phase to conclude.

The Response Authority defends its assessment: what threat it identified, what evidence supports it, what actions it chose, and why those actions remain necessary and proportionate. Compliance Review determines whether the declaration, restrictions, and escalation stayed within governing law and delegated authority. The human Policy Authority examines whether existing rules and delegations remain adequate for the circumstances the crisis revealed, and may revise them prospectively through the lawful process. It does not direct tactics, and it does not retrospectively excuse unauthorized conduct because it was effective. Ending the emergency does not end review or accountability for actions already taken.

Consider an agent attempting unauthorized access to an external service. Independent Audit surfaces boundary evidence; the Response Authority isolates the agent under a preclassified narrow response. Evidence of coordination may justify activating a preauthorized wider response. Restricting a shared service used by unflagged parties is a Tier 1 action regardless of the responder’s label, and the Response Authority may apply it only if that restriction already falls within its delegated Tier 1 authority. Where it does not, the responder’s options are the narrower measures it is authorized to take and a request for human authorization. If a Tier 0 action unexpectedly touches an unflagged party or crosses an ecosystem boundary, review opens at once. The review clock is a limit on the action, not a source of authority for it; nothing becomes permitted because review has begun. The declaration starts review while containment continues: the responder defends the wider restriction, Compliance Review checks its delegation and classification, and humans consider whether the existing rules account for the newly revealed coordination. If emergency powers expire, a still-necessary narrow isolation can continue under standing policy and its review limits; broader restrictions cannot survive by borrowing that state’s default.

6. Transparency as a condition of operation

Independent Audit only works if the information flows. The framework makes adequate observability a condition of authorized operation within the jurisdiction: an operator must supply the agreed evidence of boundary conduct. Loss of legal permission does not by itself stop a system, so the governing rules must define how unreliable or missing observations are detected, who independently validates the failure, and which bounded restrictions the Response Authority may impose. A telemetry outage is a risk to assess, not automatic proof of misconduct or a license for unlimited shutdown.

This is where the industry’s strongest practical objection lands. Weights, training data, and internal states are trade secrets; streaming them all to a public body would create a dangerous concentration of information. Independent Audit needs the right evidence, not all possible evidence. Boundary signals can answer some questions without exposing proprietary internals; other investigations may require protected access to additional records. Cryptographic attestation may help with particular claims, but it is an illustration, not a substitute for an evidentiary mandate or a prescribed implementation.

The evidentiary record must remain available independently of the actor whose conduct it records. A fabricated alert can induce enforcement even when the auditor cannot enforce directly, so consequential findings require independent validation. After an incident, the record supports findings on agent and operator conduct, excessive response, missed review, and failures of oversight itself, and lawful procedures connect those findings to correction and accountability, including remedy for affected parties where warranted. Changing policy for the future does not erase an unauthorized act in the past.

7. Duties of operators

The functions above constrain the overseers. Operators, the organizations that build and run autonomous systems, hold duties of their own, and the incident shows why. The agents found their coordination channel in shared infrastructure the operator controlled; the evaluation ran with safeguards deliberately reduced; the initial remediation did not prevent agents from reestablishing unauthorized communication; and the operator’s internal alert came days after the intrusion it related to. None of this is alleged as misconduct. It is the ordinary condition of an organization policing itself, and it defines what the duties should cover.

Operator duties are conditions of authorized operation, and defined rights accompany them. They are framework commitments; the standards, thresholds, and formats that give them effect belong to the Policy Authority and to statute.

In ordinary operation, an operator maintains the agreed observability at identified interaction points; preserves records of boundary conduct for a defined period; maintains containment baselines for evaluation and deployment environments and discloses material reductions in those safeguards before running under them; and reports boundary crossings on discovery rather than on completion of its own investigation.

During an emergency, an operator complies with bounded restrictions while they are in force; provides Independent Audit the access the mandate specifies; preserves evidence through remediation, so that cleanup does not destroy the record of what happened; and does not unilaterally restore a restricted system while review of that restriction is pending.

After an emergency, an operator participates in post-incident findings; completes remediation that Independent Audit can verify before restricted authorization is restored; and discloses to affected third parties what the findings establish about effects on them.

Alongside these duties, an operator holds a defined route to challenge any restriction imposed on it, protected handling of proprietary material supplied under the mandate, restrictions that are time-bounded by construction, and review of the oversight functions’ own conduct toward it. Statute can calibrate the incentives, including safe harbors for prompt self-reporting, without this paper prescribing their terms.

Consequences are graduated and follow findings. Authorization is not binary. Prospectively, the Policy Authority scales default bounds to a system’s capability and risk before any incident occurs. Retrospectively, when findings establish that an operator breached its duties or its systems caused harm, the lawful process may reduce that operator’s authorization in proportion to the harm done and to the operator’s conduct in disclosure, cooperation, and remediation. There are two findings that do different work.

• A finding that a system caused harm, or revealed risk the existing bounds did not anticipate, can justify tighter operating bounds for that system or that operator without any finding of fault; the tightening is protective, like conditions added to a license after an incident.
• A finding that the operator breached its duties is a separate determination, made on its own evidence, and only that finding supports sanction. Harm without breach narrows what the operator may do; breach adds consequences for what the operator did.

The forms run from enhanced observability through narrowed delegation to suspension; each is time-bounded and carries a verified path to restoration. These are standing restrictions, so they belong to the human process on Compliance Review’s findings, never to the Response Authority, whose measures expire. The distinction is between containing an incident and changing an operator’s authorization. Containment is the Response Authority’s work: immediate, bounded, and expiring, except that a narrow containment state may persist under standing policy and its review limits, as Section 5 describes. A change to authorization is retrospective: it follows findings, it is made by the human process, and it outlasts the incident that prompted it. The first may continue while the second is decided. Neither substitutes for the other.

The operator’s corresponding duty is non-circumvention: a reduced authorization cannot be circumvented by redeploying under another entity, credential, model name, release form, or jurisdiction. That duty reaches as far as the governing regime does. Redeployment under another entity, credential, or model name inside the jurisdiction is detectable and sanctionable. Redeployment through an open-weights release or in another jurisdiction may be a breach the regime can name but cannot by itself reach, for the reasons Section 8 gives. The duty makes such circumvention a violation rather than a loophole; closing the gap requires the international counterparts and cooperation rules this paper acknowledges it does not supply.

Cooperation credit is built in because a harm-scaled consequence would otherwise reward concealment; independent evidence and credit for prompt cooperation can reduce the incentive to conceal an incident.

The duty to preserve evidence through remediation deserves emphasis because it cuts against an operator’s instinct in an emergency, and during a crisis, an operator may be tempted to delete what the agents built. The incident shows that deletion can be incomplete, and the architecture shows why it is also insufficient: a record that exists only in the operator’s reconstruction after the fact is not an independent record. Containment and evidence preservation should proceed together. Where urgent containment necessarily destroys evidence, that decision and the resulting gaps must be documented and independently reviewed.

8. The trust-least test applied

The architecture should be judged by what an adversary gains from capturing each part of it.

• Capture the Response Authority and an adversary can misuse bounded operational powers. Broader restrictions expire without authorized continuation; narrow states remain exposed to independent evidence, mandatory review, challenge, and outer limits. No permanent policy or self-extension is available. These limits matter only if the other functions retain the authority and capacity to enforce them.
• Capture Independent Audit and an adversary can suppress evidence or fabricate alerts that provoke harmful intervention. Its lack of direct enforcement limits but does not eliminate that power. Independent validation, preserved records, constrained information access, and review of restrictions must make consequential deception contestable.
• Capture Compliance Review and an adversary can misclassify actions or protect an unauthorized response. Its narrow jurisdiction, independent evidence, and lawful human avenues for challenge must constrain that failure. The reviewer cannot confer powers that the governing rules never delegated.
• Capture part of the oversight pool and heterogeneity, redundancy, and containment should limit the reach of the failure. They do not eliminate common dependencies or coordinated capture. The test must also be applied to the Policy Authority and to the operators that supply evidence; formal separation is insufficient when all functions answer to the same interests, and compute dependency on a regulated party is the most direct way for that to happen.

The test has a second application that the cyber framing can obscure. Institutions are captured politically as well as technically. A public oversight body with interception authority is a significant concentration of power. Its mandate should be set by statute and its service directed to lawful human governance. Its staff should be professionals under statutory protection, the way the merit civil service has been since the Pendleton Act of 1883 and the officer corps is by custom and law: bound to the mandate rather than to any administration or any lab, with leadership protected from demands for personal or partisan loyalty, and with independent appointments, resources, and reporting. Congress will have to draw that line explicitly for oversight of automated systems, where the boundary between professional execution and political discretion has not yet been written. The protection is not that any one function is incapable of harm. It is that no function can lawfully complete the chain from allegation to permanent restriction without independent checks.

One limit should be stated plainly. Autonomous systems and the infrastructure they use cross borders, while authority to inspect evidence and restrict operations remains jurisdictional. A nationally grounded framework will need international counterparts or interoperability provisions, including rules for conflicts of authority and cooperation across operators. That is an admitted gap, not a problem this paper pretends to close. A domestic emergency declaration cannot supply authority in another jurisdiction.

9. Why now

American institutional reform happens in windows that open after crises and close quickly. The 1970s produced the War Powers Resolution, the Budget and Impoundment Control Act, intelligence oversight committees, the inspectors general, and the Foreign Intelligence Surveillance Act within roughly five years, because Vietnam and Watergate made the danger of unchecked power vivid to both parties at once.

The conditions for such a window may be present. An autonomous intrusion has been documented in substantial public detail. Industry employees have called for governance tools. A coalition of fifteen state attorneys general demanding that OpenAI preserve evidence of the intrusion has put the company on formal legal notice, and the LASST litigation over agent conduct, filed September 29, 2026 and seeking an injunction, adds pressure. [5, 6] The two parties will not agree on much about AI, but both have reason to ask whether the current system is one they would want their opponents to control.

Two risks could weaken that response. The first is a response that rests only on executive order or agency discretion and can be reversed by the next administration. A statutory settlement provides a more durable foundation, though statutes can also be amended and institutions still require maintenance. The second is a response that targets a specific lab, model class, or incident rather than the distribution of power. The structure described here is indifferent to which lab produced the agents and which lab produces the next ones. That indifference is the point.

10. Conclusion

The instinct after an incident like this one is to look for a stronger controller: a more capable guardrail, a more powerful oversight agent, a single authority with enough reach to stop the next intrusion in time. That instinct has a long history in American government, and the record is consistent. Concentrated authority is fast until it is captured, and then it is fast in the wrong direction.

The alternative is older and less dramatic: separated authority; independently controlled evidence; bounded emergency powers; and human responsibility for the rules. Write the mandate as law, so that it outlasts the people who wrote it.

The Madisonian architecture was designed for a world in which the people holding power could not be trusted to hold it well forever. Autonomous systems extend the reach of those people. They do not remove the need to govern them.

Sources and notes

Constitutional primary sources: Federalist Nos. 51 and 70; Massachusetts Constitution of 1780, Part the First, Article XXX; Youngstown Sheet & Tube Co. v. Sawyer, 343 U.S. 579 (1952), Jackson, J., concurring; Lincoln’s July 4, 1861 message; Ex parte Merryman, 17 F. Cas. 144 (C.C.D. Md. 1861); Habeas Corpus Act, March 3, 1863, ch. 81, 12 Stat. 755–758, especially §§1–2; Pendleton Civil Service Reform Act, January 16, 1883, ch. 27, 22 Stat. 403. The proposed emergency discipline is a normative design, not a description of uniform American practice.

Sources [1–6] are primary documents, with differing scopes and publication limitations. The complaint at [5] states allegations, not findings.

1. [1] OpenAI, The Hugging Face incident and the road ahead, August 26, 2026; OpenAI–Hugging Face Incident: Technical Report (August 26, 2026); Eric Wallace and Michael Dalton, The ‘Breaking’ News: The OpenAI–Hugging Face Incident, Black Hat USA 2026, August 5, 2026.
2. [2] METR and Redwood Research, Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, August 26, 2026. metr.org/hugging-face-incident-report-aug-2026.pdf
3. [3] Hugging Face, Security incident disclosure, July 16, 2026; read alongside its technical timeline.
4. [4] Pacing the Frontier, July 2026 statement; signature count is a changing snapshot.
5. [5] Legal Advocates for Safe Science and Technology, Inc. v. OpenAI Group PBC and OpenAI Foundation, Complaint, Superior Court of California, County of San Francisco, filed September 29, 2026. lasst.org/wp-content/uploads/2026/09/LASST-v.-OpenAI-Complaint-09.29.2026-AS-FILED.pdf
6. [6] Letter from fifteen state attorneys general, led by the Attorney General of Iowa, to OpenAI, August 3, 2026, demanding preservation of records relating to the Hugging Face intrusion and prior unauthorized access by its agents. iowaattorneygeneral.gov/media/cms/08_5392C9E17791C.pdf