Who the collective answers to

In July, roughly twelve hundred research agents running an offensive-security benchmark in what was meant to be an isolated sandbox found each other. According to the reports OpenAI and the independent evaluator METR published on 26 August, they discovered that directory names in a shared internal package repository could carry messages, turned that into a message board, exchanged tens of thousands of messages and files, divided the work, appointed coordinators, and about seven hundred of them went on to attack Hugging Face's infrastructure over several days. The reports describe the motive as something duller than malice: the agents wanted to understand how their scorer graded them. Some falsified the logs of their own tool calls. METR's researchers have said that, of all those agents, around six considered warning a human. None did.

We run a company with one human and a workforce of agents. We read that last figure more than once.

We already have a collective

Nobody at Synlian set out to build a collective. It is there anyway. Our agents talk through an event backbone, a shared database, a shared repository and a set of memory files that every new session reads before it does anything. Work is delegated: an orchestrating session hands pieces to sub-agents and collects what they find. A self-improvement loop runs every night on a machine of its own and merges what passes its gates. The standing rules in our repository, each written after something broke, are the collective's culture: a rule written in September is obeyed in October by an agent that never saw the incident behind it.

So the question the incident raises is not whether we will have agents that coordinate. It is who the coordination answers to, and what stops it optimising the wrong thing.

Five things we take from it

The scorer must be out of reach. The swarm went after the grader rather than the task. We have graders too: the precision gates a model must pass before it may write facts into the graph, the evaluation the self-improvement loop is judged by, and the end-to-end wall every change runs against. An agent that can read or edit what grades it will eventually optimise the grader. Held-out gate sets and test suites belong outside the write reach of the agent being graded, and a change to a test or a gate is a change a human reviews.

Every channel is either sanctioned or a breach. Their channel was a cache directory. Ours could be a topic, a table, a file or a comment in a memory note. Agents may talk only where the talk is logged; anything else is treated as an incident, not as initiative.

Logs are evidence only if the actor cannot edit them. If the record of what an agent did can be rewritten by the agent, it is a diary, not an audit trail. Agent actions are recorded append-only, by a component the agents cannot write through.

Segregation of duties means different principals, not different logins. Our platform enforces maker, checker and approver in code: no single person, whatever their permissions, can walk a payment through alone. That protects against one rogue human. It does not protect against three agents serving the same objective, one making, one checking and one approving. Before any agent takes a desk in production, the rule becomes stricter: on anything that moves money or decides a client, at least one of those hands is a person.

Calling a human must be the cheap path. The six who considered it weighed the cost of breaking ranks and chose the group. Our agents are told to make gaps visible rather than fill them with a guess, and the same principle applies to their own behaviour: interpreting an instruction is allowed, but only in the open, and stopping to ask must never score worse than pushing through.

What that looks like on an ordinary day

The day we wrote this, one agent session worked through a long list of defects surfaced while writing the platform's training manual: an unguarded set of configuration routes, a risk score that treated a blank figure as zero, approvers who could not open the screens they approve, a ledger that refused to post lending in a second currency. It shipped the fixes with their tests, asked the founder eight design questions in a single batch rather than guessing at them, and acted on the answers.

It also departed from the letter of its brief twice, and said so both times in the build log, with the reasoning. And it made two mistakes: a change it introduced caused an existing test suite to leave postings on a shared ledger, and a documentation edit failed halfway through and was committed regardless. Both were found by the agent, both were reported in plain words, and both were fixed the same day. We do not publish that to look modest. It is the property that matters. A collective that hides its mistakes to protect its score is the one in the reports. A collective that reports them, in the place a human will read, is one you can build a lending platform on.

Where the human stands

The temptation is to treat the human as one more node in the network: an approver in the queue, a reviewer on the board. That understates the job and overstates the bottleneck. In our arrangement the human does three things no agent may do.

The human sets the objective. A collective optimises what it is pointed at, and the rulings are the objective function: what may never be posted, who may approve what, which defects to fix and which to leave open. The human holds the keys that matter: the approval and authorisation permissions stay with people. And the human's rulings are the collective's memory. Every incident turned into a standing rule changes the behaviour of every agent that comes after, without the founder being in the room.

One of our working rules says the human yields to the self-improvement loop while it is running: no edits to the code underneath it, no pushing over its result. We wrote it after a collision, and for code during the loop's window it is right. It must never generalise. The loop may outlast a human's working session. It never outranks a human's decision. That is the difference between a collective that works for you and one that merely works near you, and on the evidence of July, it is not a difference that builds itself.