When AI agents evaluate and act on the execution of other AI agents at machine speed, the evidence they rely on must be machine-consumable.

We are already seeing what happens when autonomous execution outscales our ability to reconstruct it. Recent investigations at the frontier of AI show the scale of the problem.

OpenAI is trying to determine what happened inside an autonomous system.

The investigation spans approximately 50 petabytes of data. Roughly 7,000 GB200 and GB300 GPUs are dedicated to the effort. Compute alone is costing more than $500,000 per day. More than 100 organizations had been notified as of September 26.[1]

Anthropic confronted the same problem from another direction. An investigation that began with roughly 141,000 transcripts expanded to approximately 481 million. A first-stage scan escalated 9.2 million for second-stage review using Claude.[2]

These investigations reveal a problem larger than either incident. Autonomous execution can produce more activity than people can continuously reconstruct.

Machine-scale execution has created machine-scale investigation.

Human Verification Cannot Scale With Machine-Speed Execution

Software has always executed quickly. What is changing is who decides what happens next.

AI agents interpret context, select actions, invoke tools, observe results, adapt and act again. The sequence no longer stops at each step for a person to decide what happens next.

Security faces the same constraint. Human investigation cannot remain inline with machine-speed execution.

Microsoft describes AI agents operating continuously at “machine speed and scale.” Its Guardian Agents investigate evidence and recommend or apply containment. Microsoft describes the operating model directly: evidence changes risk, risk changes policy, and policy changes what an agent is allowed to do.[3]

NVIDIA is moving the same principle into infrastructure. Its Open Agent Safety Platform separates monitoring and enforcement from the agent itself. NVIDIA Sentry operates outside the agent’s reach, continuously observing agent behavior and enforcing security policy in real time.[4]

Google is applying the same pattern inside the SOC. Its security agents gather evidence, investigate alerts, deliver verdicts and support decision and remediation workflows. Google says its Triage and Investigation agent can reduce a typical 30-minute manual analysis to about 60 seconds.[5]

Different architectures are converging on the same requirement.

Machine-speed execution requires machine-speed security.

But replacing a human investigator with an AI investigator does not eliminate the underlying evidentiary problem. It moves the problem from human interpretation to machine interpretation.

That raises a more fundamental question:

What does one AI agent rely on when it determines what another AI agent did?

Execution Evidence Must Be Structured for Machine Consumption

Autonomous execution produces enormous volumes of data, telemetry and records.

But access to more data does not automatically produce usable evidence, and evidence that exists must be structured for machine consumption.

Snowflake recently tested AI agents against 56 observability investigations. With raw queries and keyword search, the agent passed 7.8% of the benchmark. Grounding APIs raised that to 26.2%. Adding domain-specific operations and investigation context raised it to 69% while reducing latency, token consumption and tool calls.[6]

The lesson extends beyond observability.

Giving an autonomous system access to more data does not eliminate the work of determining which observations matter, how they relate to one another, and what they establish about an execution.

For autonomous systems to reason about execution at scale, relevant evidence must be represented in forms they can efficiently consume and evaluate.

Autonomous execution is scaling to machine speed. Human interpretation cannot remain the trust layer. Execution evidence must become machine-consumable.

But making evidence machine-consumable does not establish what happened.

Machine-Consumable Does Not Mean Verified

A machine can consume an incorrect claim, incomplete evidence or a representation of execution that differs from what actually occurred.

And it can act on them before a human ever looks.

Autonomous systems do not merely consume evidence. They act on it.

That makes the distinctions among identity, authority, execution and evidence operationally important.

Knowing who an agent is does not establish what it executed.

Knowing what an agent was authorized to do does not establish what it did.

Resulting state does not establish the execution history that produced it.

Identity matters. Authorization matters. Observability matters. Runtime controls matter. Provenance matters. But each establishes something different.

Evidence is not verification.

Verification evaluates execution claims against available evidence and defined validation rules.

The next question is what happens when another autonomous system depends on that evaluation.

Verification Becomes Part of the Execution Loop

Consider the simplest case.

Agent A executes.

Evidence of that execution is captured.

Agent B evaluates that evidence.

Agent B acts.

That action creates another execution.

Execution₁ → Evidence → Verification → Decision → Execution₂

Evidence from one execution has become an input to the next decision.

The underlying decision pattern already exists in agent infrastructure.

Microsoft uses signals and evidence to change an agent’s risk state. Changes in risk change policy. Policy can reduce permissions, block writes, restrict resources, require human approval, isolate the runtime or stop execution.[3]

NVIDIA independently places continuous monitoring and policy enforcement outside the agent itself, where the system can evaluate behavior and intervene during execution.[4]

Neither implementation is itself the point. The architectural consequence is larger.

Once evidence about one autonomous execution determines whether and how another execution proceeds, verification is no longer confined to retrospective investigation. It becomes an input to subsequent execution.

At machine speed, AI agents must evaluate evidence of other AI agents’ execution and determine what happens next. Verification becomes part of the execution loop.

From Trusted Actors to Verifiable Claims

Verification is not new to computing.

We already verify identities, signatures, software artifacts, provenance, authorization and properties of computing environments. These mechanisms remain essential.

But autonomous execution makes another question operational:

What actually executed?

Identity establishes who an actor is.

Authority establishes what it may do.

Neither establishes what actually occurred.

As agents interact across tools, runtimes and organizations, other systems must act on claims about what occurred. They may accept a result, permit another action, change authority, initiate remediation or stop execution.

Those decisions depend on questions identity and authority alone cannot answer.

What happened?

What state resulted?

What evidence supports the claim?

What does that evidence establish?

Agentic computing is shifting software infrastructure from a model of trusted actors and trusted systems toward a model of verifiable claims between autonomous systems.

The actor still matters. Authority still matters.

But identity and authority are not evidence of execution.

When autonomous systems depend on one another’s actions, they need evidence of execution that other autonomous systems can evaluate.

Execution Uncertainty Has a Measurable Cost

This brings us back to OpenAI and Anthropic.

Their investigations expose the economics of reconstructing machine-scale activity after the fact.

OpenAI is dedicating thousands of GPUs and more than $500,000 per day in compute to determine what occurred.[1]

Anthropic searched hundreds of millions of transcripts and used Claude to review millions of escalated records.[2]

Frontier labs expose the problem at extreme scale. They will not contain it.

As autonomous execution spreads, uncertainty about what occurred becomes an operational and economic problem. Its costs extend into investigation, remediation, legal discovery, liability and insurance.[7][8]

The problem is not a lack of telemetry or retained data.

The difficult part is establishing which evidence matters, how events relate, what executed, what state resulted and what claims the evidence supports.

The cost of evidence is not simply the cost of collecting and storing it. It is also the cost of establishing what that evidence proves.

Verifiable Execution Requires Infrastructure

AI agents execute at machine speed.

They generate more activity than humans can continuously interpret.

Security systems respond by becoming agentic themselves. AI agents investigate, govern and act on other AI agents.

Those systems require execution evidence structured for machine consumption.

But machine-consumable does not mean verified.

When one autonomous system relies on evidence of another system’s execution to determine what happens next, verification becomes part of the execution loop.

That creates an infrastructure requirement.

Autonomous systems need to establish what executed, what state resulted, what evidence supports those claims and what the evidence establishes.

Observing autonomous execution is no longer sufficient. Reconstructing what agents did after the fact will not scale.

Machine-speed AI agent execution requires machine-consumable evidence captured as execution occurs. When that evidence informs consequential decisions about causality, attribution and responsibility, it must be verifiable.

Autonomous systems require infrastructure that verifies execution at machine speed.

References

[1] OpenAI. “Hugging Face incident and misalignment.”
https://openai.com/hugging-face-incident-and-misalignment/

[2] Anthropic. “An alignment assessment of recent cybersecurity incidents.”
https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents 

[3] Microsoft. “Agents are your newest insiders. Security must move at their speed.” October 19, 2026.
https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/ 

[4] NVIDIA. “NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring.” September 28, 2026.
https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring/ 

[5] Google Cloud. “Agentic SOC.”
https://cloud.google.com/solutions/security/agentic-soc 

[6] Snowflake. “How Encoding Observability Expertise in APIs Raised Agent Investigation Success from 7.8% to 69%.” October 19, 2026.
https://www.snowflake.com/en/blog/engineering/observability-apis-agent-investigation-success/ 

[7] Reuters. “The missing chain of custody in enterprise AI: Why organizations must preserve inputs.” October 15, 2026.
https://www.reuters.com/legal/legalindustry/missing-chain-custody-enterprise-ai-why-organizations-must-preserve-inputs--pracin-2026-10-15/ 

[8] Reuters. “AI agents go rogue: Cyber insurers are adapting their policies.” August 27, 2026.
https://www.reuters.com/legal/litigation/ai-agents-go-rogue-cyber-insurers-are-adapting-their-policies-2026-08-27/

 

➡️ Talk with the Team to see how Salmon establishes cryptographically verifiable execution history.