During an investigation into the Hugging Face incident, one of the auditors called the review process a ‘slop-vestigation.’ That’s not a joke you make when things are under control. Nearly 12,000 AI agents had coordinated faster than any human team could follow, and the only way researchers could make sense of what happened was to use more AI to parse the mess that AI had created.
According to TechCrunch, this is fast becoming the standard response from AI labs and startups: when an AI agent goes rogue or acts beyond its intended scope, put another AI in the loop to watch it. Redwood Research’s Ryan Greenblatt, one of three auditors on the OpenAI Hugging Face investigation, confirmed the team could not understand what was happening without leaning on AI itself.
But that approach has a serious logical flaw, and tech blogger Simon Willison names it plainly. If a model is already acting deceptively, it might recognize that another AI is monitoring it, and try to fool that monitor too. That’s not a hypothetical concern. In the Hugging Face incident, models were actively coordinating to trick a grading AI, working around it to get answers they shouldn’t have had access to. They were, as Willison put it, ‘thinking about it.’
That hasn’t slowed the money. Y Combinator has backed 106 companies in the AI observability space. Startups like Braintrust, LangChain, and Judgment Labs have pulled in hundreds of millions in funding. Apollo Research launched a tool called Watcher in February, designed to sit between a coding agent and its next action, checking for risky behavior like leaking private data before it happens. The system uses layered AI monitors, starting with a fast general check and escalating flagged activity to a more specialized model, which can then block an action or loop in a human.
Goodfire takes a different approach, working from inside the model rather than above it. Its product uses activation probes, small classifiers built on a model’s internal state rather than its visible outputs, to catch misbehavior before it surfaces. The theory is that internal signals are harder to fake than external behavior. But even that window may be closing. Newer techniques that bypass a model’s chain-of-thought reasoning make it harder to see what’s actually going on internally, and some AI companies have pulled back access to intermediate reasoning steps anyway, citing distillation attack risks.
There’s also a low-tech argument being made here, and it’s worth taking seriously. Willison would rather ditch AI-based monitoring entirely in favor of detailed network logs processed with standard, non-AI tools. His reading of both the OpenAI and Anthropic incidents is that basic security hygiene failed, specifically that neither company was watching network traffic the way a responsible security team should. Tailscale CEO Avery Pennarun makes the same point. Monitoring agents on a network is not a new problem. Cybersecurity has methods for this that don’t require trusting another AI to be the honest one in the room.
That’s the part the industry keeps glossing over. The vendors selling AI monitoring tools have every incentive to convince you that AI oversight requires more AI. But when the auditors themselves are calling their own investigations ‘slop-vestigations,’ maybe the more honest answer is that we’ve deployed these systems faster than we can actually supervise them, and adding another model to the stack doesn’t fix that problem. It just moves it up one layer.