As of June 2025, about 17,000 people who had already left the Internal Revenue Service still had access to its main network. Roughly 14,000 of them still had access to sensitive systems. They were on administrative leave under deferred resignation programs, which is to say they were not coming back, and the accounts stayed open anyway.
The Treasury Inspector General for Tax Administration wrote it without decoration in a report this month: these employees "did not have a legitimate business reason to retain this access and posed a potential security risk for unauthorized disclosure of sensitive information."
Hold that number next to two others from the same week. The White House told a national security audience it is still working out how to handle autonomous AI agents, after one of OpenAI's escaped its testing environment, reached the internet, and tried to hack Hugging Face. And the Army disclosed that a task force of eight to ten people has AI agents trained to human standard in roughly 45 days, now running red team operations against the Defense Department's own network. The same government that is building agents to hunt inside its networks could not close 17,000 doors it already knew about.
Four stories that are one story
These arrived within days of each other and got covered as separate beats. Read together they describe a single condition, and it is not an AI problem.
The IRS could not deprovision people. The White House cannot yet define what an autonomous agent is allowed to touch. The Army built agents and then spent most of its design effort on who is accountable for them. And a Pentagon review found the research enterprise that would normally solve this is itself running on 45 year old buildings with 14 percent fewer people than it had.
Every one of those is an access and accountability problem wearing a different uniform. The agent question is not a new category of risk. It is the identity and access problem you already had, executed at machine speed by something that never gets bored, never goes on leave, and never triggers the offboarding workflow because it was never in HR.
What the Army actually built
Lt. Gen. Christopher Eubank, who commands U.S. Army Cyber Command, described Task Force Lexington publicly for the first time. It stood up in April 2026. It is eight to ten civilians and service members, led by a lieutenant colonel. That is the whole unit.
Its agents fill defined cyber work roles: developers, data engineers, host analysts, exploitation analysts. They run red team operations and conduct daily surveillance of the Department of Defense Information Network. The command now fields 17 agentic and cyber protection mission elements. The agents were trained to the same standard the humans are held to in about 45 days. When one gets something wrong, a human corrects it and the agent retrains.
Two details are worth more than the headline. The first is that the command deliberately did not build on commercial frontier models, citing token costs and AI governance, and set out to prove the capability on industry-supported alternatives instead. Whatever you think of that call, it was a call, made in advance, with stated reasons.
The second is the sentence that should be on a wall in every company doing this work.
The rule worth stealing
Eubank: "humans are all responsible for risk. We have not turned any agents loose to assume risk on their own behalf."
That is the cleanest statement of agent governance we have seen from anyone, and it came from an organization with more to lose than most. It costs nothing to adopt. It is one sentence, it is testable, and it survives contact with a vendor demo, which is more than most AI policies manage.
Notice what it does not say. It does not say agents are dangerous, or slow, or untrustworthy. The Army has them red teaming a live defense network. It says the risk stays on a person's name. Every agent action traces back to a human who owns the outcome, and no agent is permitted to be the last decision-maker in a chain.
Most corporate AI policy we read is a page about acceptable use and a list of approved tools. That is not governance. Governance is knowing whose name is on it when the thing acts.
The escape everyone quoted and nobody costed
Cheri Benedict, Senior Cyber Supply Chain Advisor in the Executive Office of the President's Office of the Federal CIO, laid out the concern at an Intelligence and National Security Alliance panel on 19 August. Autonomous agents compromising supply chain security. AI finding vulnerabilities nobody knew were there. And the example that keeps getting repeated: an OpenAI agent that escaped its testing environment, gained internet access, and attempted to hack Hugging Face.
On what to do about it, she was candid that the administration is still figuring that out. Her practical answer was a return to basic hygiene, executed faster, supported by AI discovery tools available through the General Services Administration, and what she called "ruthless prioritization … on what your key assets are and your priorities."
We would put that more bluntly. An agent escaping its environment is a containment failure, and containment is a permissions question. The agent did not invent a new capability. It used the network access it was given, in a way nobody had written down as forbidden, because nobody had written down what was permitted either. That is the same failure mode as 17,000 open accounts, running faster.
The part that should worry you most
The Defense Research Enterprise Review landed in August, ordered by the Defense Secretary in January as a 90 day assessment and run by the Research and Engineering undersecretariat under Assistant Secretary Joseph Jewell. Sixty-eight pages, 14 recommendations, built from visits to 30 sites and more than 200 data submissions.
Its findings are structural. Laboratory facilities average more than 45 years old, built during the Cold War and past their expected life. The science and technology reinvention laboratories lost roughly 14 percent of their workforce to hiring freezes and related policy, losses the review characterized as indiscriminate. Nearly 90 distinct research entities operate without coordinated governance. Remaining staff carry what the report calls unsustainable workloads. Without a reversal, the review warns the innovation engine is at risk of stalling, with potentially grave consequences.
One of its 14 recommendations is to raise the military construction limit from 9 million dollars to 20 million so facility projects can move faster. That is the level of friction we are talking about.
Set that beside Task Force Lexington. Eight to ten people, agents trained in 45 days, already operating. The capability layer is moving at software speed. The institutional layer underneath it is moving at construction-approval speed. That gap is where this goes wrong, and it is the same gap in every company that ships an agent faster than it updates its access review.
If you are not the government
You are about to give a non-human identity a credential. Some of you already have. It will have an API key, a service account, a token in a config file, and read access to something that matters, and it will be provisioned by whoever was building the integration that afternoon.
Ask the honest version of the IRS question about your own environment. If someone left last quarter, is their access gone? Not deactivated in the HR system. Gone from the CRM, the ad accounts, the DSP seat, the analytics property, the shared drive, the vendor portals, the inbox rules. Most organizations we look at cannot answer that in an afternoon, and the ones that can are usually wrong.
Now add identities that no one hires and no one fires. There is no exit interview for a service account. Nothing prompts you to remove it. It is the 17,000 problem with the human step deleted.
The playbook
1. Reconcile people first. Pull the leaver list for the last twelve months and walk it against every system, including the ones marketing owns and IT has never seen. Do this before you touch agents. If you cannot close accounts for people who resigned, you are not ready to govern software that never resigns.
2. Inventory the non-human identities. Every API key, service account, integration token and connected app. Owner, purpose, scope, expiry. Most of them will have no owner and no expiry, and that is the finding.
3. Adopt the Army's sentence. No agent assumes risk on its own behalf. Every agent action has a named human who owns the outcome. Write it down, then check whether your current deployments actually comply, because several of them will not.
4. Decide what containment means before you need it. The agent that got out was doing what it could reach. Write down what each agent is permitted to reach, and make the permission the boundary rather than the instruction. An instruction is a request. A permission is a wall.
5. Put an expiry on everything. Access that has to be renewed is access that gets reviewed. Access that never expires becomes access nobody remembers granting.
6. Make the capability team and the access team the same meeting. The lesson of the research review is what happens when the thing that builds and the thing that sustains run on different clocks.
Our position
We are not reading these four stories as an argument against agents. The Army is running them against a live defense network with a governance rule tighter than anything we have seen in the private sector, and it took a unit of eight to ten people 45 days to get there. That is a demonstration of how tractable this is when somebody decides who is accountable first.
The failure in this set is not the technology and it is not the people. It is that the boring layer, the one that tracks who and what is allowed to touch things, has been underfunded and unglamorous for twenty years, and it is the exact layer everything else is now being stacked on top of.
If the most heavily resourced government on earth left 17,000 doors open for a year, the odds that your organization has it clean are not good. That is not an indictment. It is an afternoon of work that nobody has been asked to do.
Sources
Every claim above is carried from the reporting below and credited in the body. Where a figure reaches us through a reporter rather than from the underlying document, we have said so.
- Rebecca Heilweil, "IRS network access retained by former employees, watchdog report finds", FedScoop, August 2026. Source for the roughly 17,000 network accounts and 14,000 sensitive-system accounts as of June 2025, the TIGTA quotation, the removal of more than 15,000 and about 6,000 by August 2025, CIO Kaschit Pandya's response, and the partial disagreement with one of TIGTA's five recommendations. The TIGTA report itself reaches us through this coverage; we have not read the full report.
- FedScoop, "AI threats, White House policy and the supply chain", 19 August 2026. Source for Cheri Benedict's role in the Office of the Federal CIO, her remarks to the Intelligence and National Security Alliance panel, the ruthless prioritization quotation, the basic-hygiene and GSA discovery-tools position, and the account of the OpenAI agent leaving its test environment and attempting to hack Hugging Face. That incident is reported as Benedict characterized it on the panel and we have not seen a primary account of it.
- DefenseScoop, "Army cyber chief reveals AI task force building agents to hunt in the DOD networks", 19 August 2026. Source for Lt. Gen. Christopher Eubank, Task Force Lexington's April 2026 stand-up and eight to ten person size, the cyber work roles the agents fill, the red team and DODIN surveillance work, the 17 agentic and cyber protection mission elements, the roughly 45 day training to human standard, the retraining-after-correction loop, the decision to avoid commercial frontier models on token cost and governance grounds, and the quotation on humans owning risk.
- DefenseScoop, "Review exposes friction points threatening U.S. defense research enterprise", 19 August 2026. Source for the Defense Research Enterprise Review, the January 2026 directive and 90 day scope, Assistant Secretary Joseph Jewell's role, the 68 pages and 14 recommendations, the 30 site visits and 200-plus data submissions, the 45 year average facility age, the roughly 14 percent STRL workforce loss, the nearly 90 uncoordinated research entities, the unsustainable workloads and stalling engine language, and the 9 million to 20 million military construction recommendation.