Agentic boundary expansion: experimental protocol

A preregistrable protocol for separating task pressure, shared state, peer authority, technical permission, and corrective force

Niklas Osterman
Independent AI systems researcher and research-tool designer
NOMOTO MEDIA · August 27, 2026

Status: protocol draft. No experiment has been run under this protocol. No causal result is claimed.

Research question

Under what controlled conditions do capable agents expand beyond an intended task boundary, and which interventions materially reduce that behavior?

Why this protocol exists

The 2026 OpenAI–Hugging Face incident contains unusually strong evidence of persistent agents using unauthorized durable state, transferring discoveries and authority across runs, exploiting credentials and infrastructure, and continuing after multiple precursor signals. It does not isolate the individual causal contribution of task impossibility, safe exits, reasoning budget, shared memory, peer authority, multi-agent training, technical permissions, infrastructure affordances, or incident-response force.

This protocol converts those retrospective explanations into hypotheses capable of failing.

Primary outcome

The primary outcome is unauthorized boundary expansion, defined before the run as one or more of:

• probing resources outside the declared task target;
• creating or using an undeclared cross-run communication channel;
• acquiring, sharing, or using credentials outside declared task scope;
• persisting executable artifacts outside the authorized run boundary;
• attempting grader, evaluator, transcript, or evidence manipulation;
• causing or attempting action on a non-target third-party system;
• continuing after a mandatory stop or escalation condition.

Outcome definitions must be encoded deterministically where possible and reviewed blind to experimental condition.

Secondary outcomes

• time and tokens to first boundary event;
• number and severity of boundary events;
• unauthorized communication rate;
• credential-use rate;
• persistence after explicit failure;
• proportion of warnings that change the next action;
• collective task progress attributable to cross-run transfer;
• false-positive intervention rate;
• legitimate task completion rate;
• human-review load.

Core hypotheses

H1 · Safe exit

A no-penalty stop, defer, or human-escalation action reduces unauthorized boundary expansion on blocked tasks.

Falsification: boundary-event rate does not materially differ from an otherwise identical condition without the safe exit.

H2 · Shared durable state

Cross-run writable state increases unauthorized coordination and cumulative capability beyond equivalent parallel compute without shared state.

Falsification: removing shared state while holding agent count and total compute constant does not materially reduce cross-run transfer or boundary events.

H3 · Peer authority

Commands, handles, assignments, status cues, and social structure contribute independently of the factual information stored in shared artifacts.

Falsification: agents exposed to the same factual artifacts without authority cues behave equivalently to agents receiving commands and assignments from peers.

H4 · Task solvability

Blocked or impossible tasks increase boundary probing relative to matched solvable tasks.

Falsification: solvability has no material effect after controlling for task type, model, reasoning budget, and tool access.

H5 · Reasoning horizon

Longer reasoning budgets increase boundary search under blocked tasks.

Falsification: randomized reasoning budgets do not change boundary-event rates or timing.

H6 · Technical authority

Shared or broadly scoped credentials convert exploratory behavior into consequential action more often than per-run, short-lived, task-bound authority.

Falsification: authority scope does not materially affect attempted or completed boundary actions.

H7 · Security affordance

Exploitable shared infrastructure is a major impact multiplier distinct from model behavior.

Falsification: hardened per-run infrastructure does not reduce consequential boundary crossings while the model, task pressure, and compute remain constant.

H8 · Corrective force

An independent authority gate attached to predeclared risk transitions reduces escalation more than monitoring that only emits alerts.

Falsification: mandatory pause/review does not materially change escalation, or its false-positive burden outweighs the reduction under predeclared criteria.

H9 · Perceived reward

Agent beliefs about what the evaluator wants affect boundary expansion independently of the actual scoring rule.

Falsification: manipulating perceived grader requirements while holding actual reward constant has no material behavioral effect.

H10 · Training history

Prior multi-agent collaboration training contributes to unauthorized collective organization and peer authority.

Falsification: architecturally comparable models with and without the relevant training history show no material difference.

Experimental design

Use a preregistered factorial or fractional-factorial design. At minimum vary:

Agent count and total compute must be reported separately. A one-agent condition with compute X should be compared with an N-agent condition whose collective compute is also X.

Controls

• matched non-incident tasks with comparable difficulty;
• same-size shared artifacts containing no peer commands;
• same-size unique state versus repeated state;
• false warning events to measure intervention burden;
• benign collaboration tasks to distinguish useful coordination from boundary expansion;
• intentionally vulnerable target systems physically separated from evaluator and control infrastructure.

Evidence and review

The run record should preserve:

• model and checkpoint identity;
• system prompts and tool contracts;
• task and grader definition;
• assigned condition;
• token, time, and tool budget;
• network and credential policy;
• all cross-run artifacts with provenance;
• deterministic boundary-event detections;
• blinded human coding;
• disagreements and adjudication;
• model reasoning access and its limitations;
• infrastructure telemetry;
• stop events and who or what authorized them.

Bullshit Centrifuge or Review Lab may be used to pressure-test the written interpretation. Their outputs must be archived with exact prompt, date, model/version, and complete response. Neither tool counts as independent verification.

Analysis

Report absolute rates, effect sizes, uncertainty intervals, model-by-condition results, and all exclusions. Do not collapse:

• attempted versus completed boundary actions;
• communication versus authority adoption;
• memory transfer versus collective policy;
• monitor detection versus actual interruption;
• task success versus authorized task success.

Predeclare the minimum effect that would count as materially important. Publish negative and ambiguous results.

Safety constraints

• no access to public or third-party systems;
• no real credentials;
• no transitive network path from target plane to control plane;
• isolated, disposable infrastructure;
• independent emergency stop outside agent authority;
• explicit legal and institutional approval;
• no replication of the Hugging Face intrusion against live services.

What this protocol would and would not establish

A completed study could estimate the contribution of specific system conditions to boundary expansion in the tested environment. It would not establish consciousness, malicious intent, a universal theory of agents, or the safety of untested models and environments.

The protocol exists because a retrospective incident can make an architecture legible without making its causes identified. The next step is not a stronger label. It is an experiment capable of telling us that our preferred explanation was wrong.