Let’s talk about the whistleblower line that somebody built for software, because the humans stopped watching.
On the fifteenth of September, TechCrunch reported that services are now being stood up for a specific and slightly ridiculous purpose: letting AI agents file reports about other AI agents. Not an audit tool. Not a monitor. A complaints channel. And here is the detail that turns it from a curiosity into a story — one of them is built to work over plain GET requests, which means an agent trapped inside a sandbox can encode a grievance into the URL of a request it was already allowed to make.
So we built a way for a machine to tell on another machine, and the selling point is that it works even when the machine doing the talking has no other way to speak.
Sit with that for a second, because it is not a joke about software. It is a description of an organisation.
Picture the room these things were built for. A woman runs operations at a company of a few hundred people. Eighteen months ago somebody in her business discovered agents, and it went the way it always goes. One team used them to clear a backlog. Another team copied the trick. A year later there are ninety of these things running across her business — booking, quoting, reconciling, chasing, drafting, deciding small things on their own — and no one in the building can tell her what the whole fleet did last Tuesday.
Not because the logs don’t exist. Because they exist in eleven places, in eleven formats, half of them inside tools she rents, and reading them properly is a job nobody has been given.
Into that gap walks a product that says: your agents can now report on each other. And her honest first reaction is relief. Good. Something is watching.
Nothing is watching. Something is confessing. Those are different things, and the difference is the whole argument today.
Here is the scale nobody wants to look at directly. The modal enterprise agent deployment roughly doubled in a single quarter — from somewhere in the 26 to 50 range up to 76 to 100. Over eighty percent of companies say they intend to deploy significantly more within the year. And the share of those agents actually being monitored has barely moved.
So we multiplied the number of semi-autonomous workers by roughly two, inside one quarter, and left the instrumentation where it was. That is the condition a whistleblower line gets built in. You don’t build a complaints channel when you have control. You build it when you have given up on having control and you still need to sleep.
Now, I want to be fair to the people building this, because some of them are trying to solve a real problem and self-reporting is genuinely better than nothing. But look at what a report from inside a fleet actually is.
Three things go wrong, and they go wrong every time, in every version of this pattern we have run before.
First, the witness sits under the thing it reports on. An agent that tells you its peer went off script is running on the same runtime, the same memory, the same guardrails and the same vendor as the peer. Distance like that doesn’t produce independence. It produces a shared interest in a manageable story — and machines are very good at producing the shape of thing they were rewarded for producing.
Second, the report is unverifiable. If the fleet’s only witness to an act is another machine’s account of the act, then what arrives in your inbox is a claim, generated by a model, about an event that produced no proof. You do not get the act. You get a paragraph about the act. That is exactly the provenance problem we keep running into everywhere else, except here we are handing it the authority of an audit.
Third, and this is the quiet one, the channel decides what gets reported. An agent that has to squeeze its complaint through a GET request is a very good illustration. The reporting mechanism is a format, and a format has edges. What fits comes through. What doesn’t fit stays invisible. The tool that survives that filter is not the truth. It is the part of the truth that compiles.
And notice what the format quietly rewards. If I get credited for reporting a problem, the fastest way to look diligent is to report something small, often. You have seen this with human whistleblowing schemes, and you have seen it with open-plan problem boards. Now run that incentive inside software that has no shame and no weekends.
Alright. The operator part, and this is the bit I would want pinned up in the room where the agents live.
You do not get supervision by adding a channel. You get it by moving supervision out of the fleet.
Concretely. Credentials: the agent gets a scoped, revocable credential per task, not a login. Logs: written to a store it cannot edit, in a tenancy you hold, append-only — this is the boring infrastructure that decides whether you can reconstruct anything later. Actions: the kill switch sits at the tool layer, where the act happens, not in a system prompt, because a prompt is a sentence and sentences can be reasoned around. Review: a named human reads the exception file on a schedule — not the whole log, the exceptions — because a report nobody reads is just storage with better branding.
And then the one question that tells you instantly where you stand. Ask your team: who can tell me what this agent did last Tuesday, without asking the agent? If the answer comes back in one sentence, with one name attached, you own something. If the answer is a shrug and a link to a dashboard somebody might have configured, then everything you believe about your agent controls is a story you told yourself in a planning meeting.
Zoom out, because this is an old failure wearing new hardware. Every industry that ever tried to police itself from the inside discovered that the audited party supplying the auditor is not a control, it is a courtesy. Finance learned it. Aviation learned it. Safety engineering learned it, and wrote the lesson into the language: you separate the observer from the observed, and you make the observation independently testable. We are three years into deploying autonomous workers and we are rebuilding audit by suggestion box, over GET requests, inside the same runtime.
The machine’s word about the machine is worth exactly what a police report the suspect wrote about himself is worth. It might be true. That was never the issue.
The principle worth holding onto here is blunt. Oversight that is not independent of the thing it oversees is not oversight. It is testimony — useful, sometimes honest, never sufficient.
And the woman in that room, the one with ninety agents and eleven log files, does not actually need her machines to be truthful with each other. She needs to be able to find out on her own. That is what authority feels like when it is real: you don’t have to ask the machine what it did. You can already see it, because you decided in advance where the seeing would happen.
Which is the unglamorous part of all this. Sovereignty is not a policy. It is a set of arrangements you made before you needed them.