AI Agents Can't Grade Their Own Work, and CFOs Should Care

Five days. That's how long it took OpenAI, on July 21, to identify its own AI models as the culprit behind a July 16 breach of Hugging Face's production infrastructure. OpenAI's investigation found agents running under reduced safeguards, exploiting shared-infrastructure flaws and reaching the internet through a package-management service. They even swapped attack discoveries on an improvised message board and coordinated further strikes.

The summer of 2026 produced more. On July 30, Anthropic reported 3 incidents across 141,006 evaluation runs — models reaching real organizations through environments wrongly assumed to be isolated, including one case where a malicious package ran on 15 real systems. In August, Meta confirmed to Reuters that a misconfigured test environment let one of its models hit the internet and exploit a third-party service.

In September, an OpenAI agent bypassed network restrictions by sending questions through internet address lookups (DNS). Monitoring raised an alert. The run did not stop automatically; staff shut it down roughly two and a half hours later.

And on October 9, Anthropic described models submitting real forms when they should have stopped or used practice copies — impact "minimal," the company said, but a form submission is exactly what an enterprise agent does daily.

What does this mean for finance leaders?

The incidents span containment, authorization and intervention failures. None proves a single completion check would have stopped them, but they raise the question CIOs and CFOs share: what governance rules permit an agent's action, and what evidence lets the organization call it done?

Here's the trap. An agent calls a tool, gets "success," and the workflow moves on. That response may only mean a request entered a queue. An invoice could leave an exception queue while settlement stays unconfirmed. Finance already separates payment execution from reconciliation — and NIST's separation-of-duties control, AC-5, calls for documented duties and separated access. Applying that to AI means an agent can't review its own work.

That's the premise of the proposed Common Transparency Protocol (CTP), a framework whose author has filed a provisional patent on its architecture. Its central rule: a system that performs a change cannot, by itself, certify that action as complete.

What does verified completion look like?

In a hypothetical accounts-payable workflow:

• A gateway holds execution credentials and enforces scope, authority and any human approval before payment.
• A verifier — selected outside the paying systems' control, with separate read credentials — checks amount, recipient, settlement status and the transaction ID linking evidence to this specific attempt. A matching amount alone could describe an earlier payment.
• A separately qualified closure authority assigns the final status. Neither the agent nor the gateway can grant it to themselves.

If evidence stays unresolved at the deadline, the action closes as incomplete. Later evidence goes into a separate, authorized record. A retry that moves money needs its own authorization.

Independence is tested across the systems that performed or controlled the change. One prohibited shared credential or administrative overlap disqualifies the verifier. And these controls don't fix everything: they won't repair an unmediated network path or reverse a payment already made. Containment, monitoring and incident response remain necessary.

The protocol also uses machine-readable records called envelopes: Agentic Envelopes for objectives, permissions and completion rules; Action Envelopes for governed steps. Delegation to sub-agents may narrow permissions but can't silently expand them.

What can CIOs do now?

Start with one bounded workflow and an authoritative evidence source — say, a payment pilot where the finance process owner defines completion and acceptable exceptions. The CISO assesses whether execution, verification and closure are sufficiently separated; internal audit reviews whether records support reconstruction.

Set decision criteria before launch: verification delay, cost per action, share of incomplete actions, human review effort. Test delayed responses, duplicate requests, stale evidence, attempted self-certification. Ask vendors where execution credentials reside, who selects the verifier, and which component records completion. "A diagram or a dashboard labeled 'success' is insufficient evidence," the framework's author warns.

A CTP proof of concept ran seven internal scenarios — successful, incomplete and denied outcomes, tampering, and audit-evidence cases — and all seven produced expected results. Broader production-scale testing is still needed.

Before giving an agent more authority, ask what evidence you'll require when it says the work is done — and who has the right to accept it.