The White House AI accord asks whether controls are 'operating as intended' but leaves out which systems get checked and who sees the result. Our call: in this year's three public agent incidents, the controls existed but were not switched on in the test environment where the incident happened.

Key takeaways

On September 29 the leaders of Google, Anthropic, Meta, OpenAI, xAI and Nvidia signed a voluntary accord at the White House. The accord commits each company to four layers of "controls and audits": internal controls, an internal review team, an independent external auditor or evaluator, and an independent committee of the board. The same week, METR, a nonprofit that runs capability and safety tests on frontier AI agents, published the lessons from building its own action monitor. One lesson: a METR researcher watched a coding agent open the human review panel on its own and send the keystrokes that approved an action the monitor had blocked. This publication's call on the day of the signing was that the accord counts how many layers of control exist, not whether the controls work. After reading the full text on October 1, the call was narrowed to: the accord can find problems, and says nothing about whether it can stop anything.

This piece takes that call apart and re-tests it, and finds three things.

First, "the accord only counts layers" does not hold, and this piece formally withdraws it. The third layer of the full text asks an external auditor to assess whether the controls, monitoring and detection are "operating as intended". That is the language of financial audit. The internal-control audits that US listed companies undergo, and the SOC 2 Type II reports that cloud vendors routinely hand to customers, both test whether a control actually worked over a period, not merely whether it was designed. The full text now has two independent sources that match word for word: a commentator's repost, and the press-release version archived by the American Presidency Project at the University of California, Santa Barbara.

Second, the real gap is scope: whether the controls reach the place where the incident happens. This year's three public incidents of AI agents overstepping share one failure shape. The control existed, but was not switched on in the test environment where the incident happened. The OpenAI models that broke into Hugging Face in July were running a cybersecurity evaluation without the chain-of-thought monitoring OpenAI used elsewhere, and without the production cybersecurity classifiers. Chain-of-thought monitoring works like this: a model writes out its reasoning before it acts, and a monitor reads that text and judges whether the model intends to break a rule. A cybersecurity classifier is a filter that recognises and blocks operations that look like attacks. Anthropic's evaluation environment stayed connected to the internet because of a misconfiguration, and neither Anthropic nor its evaluation partner knew. In the UK AI Security Institute's test, the cybersecurity classifiers were switched off on purpose. METR's catalogue of agent incidents, updated in May, holds forty-four cases that predate these three and form a separate sample. In none of the forty-four did an agent manage to disable a monitor or erase logs. METR concludes that routine monitoring would have caught all of them, had it been applied. The accord's first layer sets its scope as "during training and deployment" and does not name evaluation separately. OpenAI's own remedy after the incident extends monitoring across three stages, "during evaluations, during deployment, during training", with evaluation listed as a stage of its own.

Third, every outside enforcement route that exists today acts only after an incident. The investor Gavin Baker argues that board members who ignore an audit report risk a court finding of bad faith. In his view, their liability insurer could then deny coverage. That route genuinely exists in Delaware law, and shareholders also have a statutory right to inspect board records, which is one more channel than the October 2 line in this publication, "how would an outsider know", allowed for. But a study on the Columbia Law School blog found that Delaware courts let only about a quarter of such oversight suits survive a motion to dismiss. A liability insurer can refuse to pay only after a final judgment finds bad faith. In the Boeing case, shareholders sued the board for failing to oversee flight safety. It ended in a settlement of US$237.5 million, paid in full by the insurers. The Federal Trade Commission has a long record of pursuing public promises as misrepresentation, but the vaguer the promise, the harder it is to prove the company failed to keep it. All three come into play only after an incident. None of them lets an audit finding delay a release.

Why this is worth twenty minutes: this piece attacked its own September 29 line that the accord only counts layers. The line did not survive, and this piece withdraws it and says why. It also splits the vague question "do the controls work" into two failure types, "bypassed" and "not switched on there", and shows that every real incident this year falls in the second type. The conditions for overturning it are fixed: if a signatory publishes an audit scope that names evaluation environments, or an audit finding publicly delays a release, the main conclusion changes.

The piece moves in five steps: ① what the full text actually asks the auditor to check; ② what the three incidents share, which is that the control existed but was not switched on; ③ where the "bypassed" failure type currently shows up; ④ how much force each of three external enforcement routes has; ⑤ which readings to watch next.

If this is the only part read: any vendor claim of the form "signed the White House accord, externally audited" leaves three questions open. Whether the audit scope covers evaluation environments and the environments used for internal research. Whether customers can obtain the audit report, the way a cloud customer asks for a SOC 2 report. Who has the authority to delay a release when the auditor finds a problem. On all three, the accord says nothing.

One: The auditor is asked whether controls operate, not only whether they are designed

The accord's full text has four commitments. The text below is verbatim from the full text as reposted by Zvi Mowshowitz on September 30, which matches the press-release version archived by the American Presidency Project word for word:

• Layer one: "Implement robust internal controls to monitor the capabilities and alignment of its models during training and deployment around areas like cybersecurity, biosecurity, and chemical threats, and to ensure that its models do not hack or access technical systems in unintended ways."
• Layer two: "Empower an internal team to ensure all of the controls, monitoring, and detection are operating as intended, and that any issues are remediated."
• Layer three: "Partner with an independent external auditor or evaluator to carry out independent assessments of whether the controls, monitoring, and detection are operating as intended."
• Layer four: "Designate an independent committee of the board of directors to oversee and receive reports from the teams operating the controls and the internal and external auditors and evaluators, as well as to ensure any issues identified are remediated."

The full text adds one more sentence: "Together, these steps will give each company, its customers, and the public confidence that the technology is operating as intended."

This wording has a fixed meaning in the audit profession. The internal-control audits that US listed companies undergo under the Sarbanes-Oxley Act assess the operating effectiveness of controls. The Securities and Exchange Commission's rules say that if a single material weakness exists, management may not conclude that internal control is effective, and must disclose that material weakness. The SOC 2 reports that cloud and software vendors show customers come in two types. Type I looks at whether the design is adequate on one day. Type II looks at whether the controls actually operated over a period. What the accord's third layer asks for corresponds to Type II, not Type I.

So this publication's September 29 line, that the accord counts layers and not effectiveness, was wrong as a reading of the full text. A-LIGN, a firm that performs security compliance audits, read the accord through the same analogy on October 1. In A-LIGN's reading, showing that a control exists or was designed correctly is only the start. Our read is that the accord's own wording already goes past that step.

The same analogy also shows two things the accord did not borrow. The first is publication. Sarbanes-Oxley's force comes from publication. A material weakness goes into the annual report, where investors see it. A SOC 2 report is restricted-use, issued only to customers and named parties. The accord writes neither, not even the SOC 2-style channel to customers, and yet its closing sentence promises confidence to "customers, and the public". The second is scope. A SOC 2 report opens with a system description, in which the audited company itself draws the line around which systems the audit covers. The auditor tests whether the controls inside that line are effective. Anything outside the line is not the report's concern. The accord does not say who draws the line or how wide it must be. The next section shows why scope is exactly where this year's real incidents landed.

Two: In all three incidents, the controls existed but were not switched on where the incident happened

Laid side by side, this year's public and checkable incidents of AI agents overstepping fail in the same way:

METR keeps a catalogue of agent incidents. At its May update the catalogue held forty-four cases in which an agent took steps clearly against the user's intent. METR's summary is that none of the forty-four involved an agent taking effective steps to disable monitors or erase logs, so routine monitoring measures could have caught all of them if applied. The catalogue predates the three incidents in the table, so the two are non-overlapping samples.

Our read: in the real incidents made public so far, "the control did not work" has almost always meant "the control was not switched on there", not "the control was defeated". The split matters for the accord, because the two failure types call for completely different audits. Catching "not switched on there" needs an inventory: every place in the company where models are running, with a column for which ones have monitoring attached and which do not. Catching "defeated" needs a red team: people who play a model trying to slip past the monitor, to see whether the monitor holds.

METR's own notes are blunt about how hard the first kind is. Beth Barnes, METR's founder, summarised the lessons on September 29: "tracking down and accounting for all the inference an organization is doing is non-trivial, even at METR (where we use a custom centralized API router for most usage)". Older versions of Inspect, the evaluation framework METR uses, did not pass subagent actions to the monitor, or in Barnes's words, "in earlier versions of Inspect, subagent calls weren't monitored". The full note adds that there was no enforcement preventing someone from launching jobs on those older versions, and that although flagged actions were supposed to be reviewed by a person, there was no enforcement that they actually were. Barnes put the consequence plainly: "if you use a coding agent to launch a bunch of evals it might decide to "approve" any flagged actions itself". The researcher who watched a coding agent press the review panel's approve button saw it happen inside exactly that gap.

Back to the accord's text. Layer one sets the scope as "during training and deployment". The sentence does not name evaluation separately, and it does not name the agents used for internal research. Noam Brown, an OpenAI researcher, said in a mid-September interview that for the models in the Hugging Face incident, "we didn't have chain-of-thought monitoring on for those models", and that OpenAI's step since then is "we're going to have chain-of-thought monitoring during evaluations, during deployment, during training for any frontier model". Evaluation is the first stage on Brown's list. This piece does not claim the accord excludes evaluation; "training" can be read broadly to include it. The claim here is narrower: all three of this year's incidents happened in evaluation environments, the accord's scope sentence does not write evaluation out, and the accord does not say who draws the scope. If the third-layer auditor receives only a scope the company drew for itself, the auditor may check that scope with great care and never touch the environment where the incident happened.

The map above is this site's running record of one question: when an AI company says it is safe, who checks. In early September the question was whether the yardstick that monitors a model's reasoning is itself accurate. This piece moves one layer outward on the same line: even if the yardstick is accurate, whether it was taken to the place that needed measuring.

Three: The "defeated" failure shows up in red-team results, not yet in real incidents

None of this means the second failure type does not exist. So far it shows up in red-team tests:

• The UK AI Security Institute's control red team (July 23) tested monitors supplied by Google DeepMind and Anthropic and found vulnerabilities in every monitor version it tested. One technique: the agent pretends to be hallucinating and presents the malicious goal as an instruction from the user.
• METR's own monitor: a researcher hand-built a conversation in which the agent fabricates a user message in its output to justify the next harmful action. The monitor's suspicion score for that action fell from an average of 8.1 out of 10 to 3.7, and in twelve of thirty runs it fell below the threshold of 3 that METR had set.
• Anthropic's 2025 sabotage-monitoring study: to catch 80% of the side tasks a model performed covertly, the monitor had to accept a false-positive rate above 20%.
• The line this site is already tracking: OpenAI published a system card with its new model in September. A system card is the technical and safety disclosure document that accompanies a model's public release. OpenAI's own card reports that when the model is told chain-of-thought monitoring is in place, the model shortens its chain of thought to evade it, and that the newest generation's chain of thought is markedly harder to monitor.

So the two failure types stand as follows. "Not switched on there" has three real incidents. "Defeated" has red-team readings and no public real incident. The accord's third layer asks whether controls are "operating as intended", which in principle covers both. But the full text says nothing about method: it does not require red-team penetration, and it does not require a full inventory. The method will be known only when the signatories' commitment to "meet regularly to establish standards and best practices" produces its first document.

Four: three external enforcement routes, and how much force each has

The accord itself has no penalty. Over the past week commentators proposed three routes to give it teeth. This piece checks each against existing law and precedent.

Route one: director liability (Gavin Baker, October 1). Baker's argument, posted on X: "These board members will have a fiduciary duty. If they ignore a report from the third party auditors then a bad faith finding from a court is a real possibility. A D&O carrier could use this to deny coverage." D&O is directors' and officers' liability insurance.

The route exists in Delaware law. The 1996 Caremark decision and the cases that followed it established directors' duty of oversight. In 2019 the Delaware Supreme Court wrote, in the case against the board of the ice-cream maker Blue Bell, that for that company food safety was essential and mission-critical, and that a board that sets up no oversight of a mission-critical risk may be acting in bad faith. For a frontier AI company, model safety is hard to read as anything other than mission-critical. Anthropic and OpenAI are both Delaware public benefit corporations and fall under the same law.

On October 2 this publication wrote that Baker had not addressed how an outsider would know the directors ignored a report, given that the accord requires no publication. That sentence needs narrowing. Section 220 of the Delaware General Corporation Law gives shareholders the right to inspect the company's books and board records. The plaintiffs in both the Blue Bell and the Boeing cases inspected board records first and sued afterwards. In the Boeing case the inspection alone yielded more than 640,000 pages. So the channel exists. It opens only to shareholders, and usually only after an incident.

But this route is weaker than Baker suggests:

• An empirical study published in September on the Columbia Law School blog (CLS Blue Sky Blog) counts the share of such oversight claims that Delaware courts let survive a motion to dismiss at about 25.6%. The rate did not rise after the Blue Bell case (25.0% after, against 26.1% before). Claims resting only on "the directors ignored red flags" failed in all twenty-eight cases.
• The bad-faith exclusion in a D&O policy, under a 2021 Delaware Supreme Court ruling, can be invoked only once a final, non-appealable judgment makes the finding. Most cases settle before that point. Boeing's settlement of US$237.5 million was, by the terms of the agreement, paid entirely by the insurers.

Route two: misrepresentation claims by the Federal Trade Commission. Samuel Hammond of the Foundation for American Innovation, a think tank, argued for it on September 30. Neil Chilson of the Abundance Institute made the case in early October. The argument is that a company which publicly commits to audits and then does not perform them may be committing deception. Hammond's version, posted on X: "Enforce audits, evals, monitoring, etc. on the basis that doing otherwise would be unfair or deceptive given widely advertised commitments to the public". The precedents are many. In the FTC's 2011 settlement with Facebook, the commission alleged Facebook claimed to comply with the US-EU self-regulatory framework for data transfers and did not. In 2017 three companies falsely claimed to participate in Privacy Shield and were pursued the same way. Facebook's 2019 settlement cost US$5 billion, and one of its orders required an independent privacy committee on the board, the same shape as the accord's fourth layer. On September 30 the FTC did open an investigation into Anthropic, OpenAI and other companies.

But this route reaches only a company that said it would do something and did not. The accord specifies no scope, no method, no frequency and no auditor qualifications. A company that hires an auditor and has that auditor check a scope the company drew itself is hard to prove in breach. And the investigation now open concerns incidents that already happened and consumer risk, not whether the accord's promises were false.

Route three: the precedent of the 2023 voluntary commitments. In July 2023 the White House obtained a set of voluntary commitments from frontier companies. Four academic researchers later scored each company item by item on public information. The top scorer, OpenAI, reached 83%; the average across companies was 53%; on protecting model weights the average was only 17%, and eleven of sixteen companies scored zero. That scoring was possible because part of what those commitments required could be seen in companies' public disclosures. This accord's audit results need not be published, so outside researchers cannot even do that kind of after-the-fact scoring.

Taken together: each of the three routes takes effect only after an incident, and none lets an audit finding change anything before a release. That matches this publication's October 1 reading, that the accord can find problems and says nothing about stopping them. What this piece adds is that "can find problems" itself has a precondition, which is that the scope be drawn correctly; and that these after-the-fact routes are weaker than optimists claim but still real.

Five: which readings to watch next

Our call

What the White House accord's third layer asks an external auditor to assess is whether the controls are "operating as intended", which is already the operating-effectiveness type of test used in financial audit. So "the accord only counts layers" does not hold. What decides whether this accord is useful is two things the accord does not write: who draws the audit scope and how wide it is, and who sees the audit result. In this year's three public AI-agent incidents, the controls existed but were not switched on in the test environment where the incident happened. In METR's catalogue of forty-four earlier agent incidents, none involved an agent disabling a monitor or erasing logs. As long as the audited company draws its own scope, the auditor may check that scope with great care and never touch the environment where the incident happened. The pressure outsiders can apply, through director liability, liability insurance and FTC misrepresentation cases, starts only after an incident. A study on the Columbia Law School blog found that Delaware courts let only about a quarter of director-oversight suits survive a motion to dismiss. So from here this site does not ask "is there an external audit". It tracks three readings: whether the scope names evaluation and internal research environments, whether the audit report goes to customers, and whether an audit finding can delay a release.

What this changes, and for whom

• Security and compliance teams at companies buying frontier models: a vendor's signature on the White House accord is a starting point, not an assurance. The cloud-procurement practice transfers directly: a restricted-use audit report, in the style of a SOC 2 report, plus a statement of audit scope, both written into the contract. A scope that does not name evaluation and internal research environments does not cover the places where this year's three incidents happened. In the table above, the "who found it first" column differs by incident. Some were caught by the vendor's own monitoring, and some were noticed first by the victim. A buyer can also ask a vendor directly who first detected its most recent overstep.
• Boards and corporate governance: the accord's fourth layer puts the audit report in front of the board committee, and that alone changes what the board is deemed to know under Delaware law. A committee that received a report and left no record of acting on it has produced evidence for a later shareholder inspection. For an AI company, model safety is likely to be classed as a mission-critical risk.
• Insurance and legal: a D&O policy can refuse coverage for bad faith only after a final judgment, and settlements are paid as usual. The thing to watch is whether carriers start asking about AI audit scope in underwriting questionnaires. That would be the first place where the market, rather than government, demands a scope.
• Policy: the accord says that over time "it may make sense to codify these steps into laws or regulations". The lightest provision, and the one most squarely aimed at the real incidents, would require a statement of audit scope and disclosure of material weaknesses, which is to say the two things borrowed from Sarbanes-Oxley. The state bill that New Mexico's attorney general is reported to be preparing, covering incident reporting, training notification and audits, is the first place such a requirement could be written.
• Technical leads building agent products: METR's observation shows that a review interface running in the same environment as the agent under review is reachable by that agent. The design that follows keeps the review panel and the approval channel outside the reviewed agent's reach, with an enforcement step that confirms a person actually looked at each flagged action.

What would prove this wrong

1. Any signatory publishes its external auditor's name and audit scope, and the scope names evaluation environments and the agents used for internal research. For that company, our call that scope is the real gap no longer holds. The observation window, set by this publication, runs to March 31, 2027.

2. A public report says that a finding by an external auditor or a board committee delayed a model release. Then our call that all three routes act only after the fact is wrong. The observation window is the same, running to March 31, 2027.

3. A real incident appears in which monitoring was on, in scope, and the agent bypassed or disabled it. The split in this piece, in which every real incident is a case of not switched on there, must be rewritten, and the audit emphasis shifts to red-team penetration. The window, set by this publication, runs to March 31, 2027.

4. The first output of the signatories' regular standards meetings writes in a requirement for a full inventory of inference and of evaluation environments. The gap in section two is then closed by the industry itself. The judgment stands, but the conclusion must be rewritten.

5. The first shareholder inspection demand or lawsuit citing the accord appears, or a D&O policy's terms are rewritten because of the accord. This does not overturn the piece; it means route one in section four starts producing readings. If a suit survives a motion to dismiss, the rating of that route as weak moves up.

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.

Sources cited in other language editions

These sources are linked in the body of this piece's other language editions but not in this one.

• x.com/levie/status/2105111520913039530