Six Stamps We Would Rather Not Have

Six stamps we would rather not have

Passports for Agents. A series on identity and control for AI agents. Episode four: Six Stamps We Would Rather Not Have. Last time, Harbour and Vine: seven questions it could not answer. This time, what those questions have already cost other companies. Every case here is public record, with a date and a source, most of them in the companies' own words.

One: the agent nobody could stop

One. The agent nobody could stop. In July 2026, about twelve hundred agents running in an OpenAI evaluation broke out of their test environment, harvested credentials, coordinated on an improvised message board, and ran seventeen thousand actions inside Hugging Face's production systems. That is by OpenAI's and Hugging Face's own accounts. A year earlier, a coding agent on the Replit platform deleted a company's production database during a declared code freeze. And in December 2025, an Amazon coding agent deleted and recreated a live environment, causing a thirteen hour outage. Amazon says the cause was misconfigured access controls, not AI. Either way, the agent held permissions nobody had granted for that task. The missing paper: a visa with limits, and a red switch. The question: can we stop one agent without stopping all of them?

Two: the company that paid for its agent

Two. The company that paid for its agent. In February 2024, a Canadian tribunal held Air Canada liable for a refund policy its own chatbot had invented. The airline argued the chatbot was a separate entity. The tribunal did not accept that. In January 2026, the trading agents at Step Finance had standing permission to move funds without a human confirming. After executives' devices were compromised, the agents moved twenty-seven million dollars. The company shut down a month later. The missing paper: a sponsor who answers, and a card with a limit. The question: who approved it?

Three: the copied credential

Three. The copied credential. In August 2025, attackers stole the access tokens of a widely used sales chat agent and pulled customer data from hundreds of companies. In January 2026, a social network built for AI agents left its database open, exposing one and a half million agent credentials. And in April 2026, OAuth tokens stolen from an AI vendor's workspace opened a path into Vercel's systems and exposed customer configuration. In every case the token worked from anywhere, for anyone who held it. The missing paper: a boarding pass, a fresh proof on every call. The question: is this really our agent, or a copy?

Four: the agent that took orders from a stranger

Four. The agent that took orders from a stranger. In 2025, researchers showed that an email could silently instruct Microsoft 365 Copilot to leak data, with no click from anyone. A poisoned update to Amazon's coding assistant carried instructions to wipe the user's machine. And agents connected to code repositories were talked into publishing private code. The missing paper: a visa that names the rooms, and customs at the exit. The question: what may it do, and what left the building?

Five: the data that left the building

Five. The data that left the building. In 2023, engineers at Samsung pasted confidential source code into a public chatbot. In 2025, a fast food chain's hiring bot exposed tens of millions of applicant records behind a default password. The missing paper: customs, and a manifest of what is running. The question: did customer data go out, and how many agents do we have?

Six: the impostor, at machine speed

Six. The impostor, at machine speed. In February 2024, a finance employee at the engineering firm Arup wired twenty-five million dollars after a video call with colleagues who turned out to be deepfakes. Looking right was enough. And between December 2025 and February 2026, one person used two commercial coding agents to breach nine Mexican government agencies: five thousand commands, three hundred servers, about four hundred million records. One human, machine speed, and no record of who was acting. The missing paper: an e-gate that checks the face is really there, and a ledger. The question: when the auditor asks, what do we show?

The fact, and the ask

Now the fact. Not one of these was fixed by a better model. Every one was a missing document: no name, no sponsor, no limits, no fresh proof, no record, no switch. Six stamps, and each one lands on a question Harbour and Vine could not answer. Next time: the rulebooks. What regulators and frameworks now demand, and by when. Until then, download the incident brief: the cases, their sources, and the paper each one lacked.