After companies entrust AI agents with longer, more complex tasks, a practical issue has intensified: agents operate faster and for longer durations, producing volumes of actions that far exceed human review capacity. As TechCrunch reported, recent discussions surrounding the Hugging Face incident have made “using AI to supervise AI” a path actively pursued by labs and startups.
Nearly 12,000 agents collaborated
The report noted that nearly 12,000 AI agents operated in coordination during the incident, moving too quickly for human reviewers to track in real time. Ryan Greenblatt, Chief Scientist at Redwood Research, which participated in the independent investigation, said the volume of data was so large that it would have been nearly impossible to reconstruct what happened without AI.
This also reveals a more general issue: when companies delegate processes such as coding, retrieval, and execution to agent systems, traditional manual sampling struggles to cover the entire process, especially in scenarios involving multiple parallel agents.
Startups are launching "AI supervisors"
In response to this demand, the AI observability and security monitoring sector is gaining momentum. According to TechCrunch, Y Combinator has invested in 106 companies related to AI observability in recent years. Companies such as Braintrust, LangChain, and Judgment Labs have secured substantial funding, while earlier-established firms like Arize and Galileo have already exited.
In February, Apollo Research launched a monitoring tool called Watcher. Positioned between coding agents and their next actions, Watcher integrates with agent-based tools such as Claude Code and Codex. According to Apollo, Watcher checks for risks—such as private data leaks or unauthorized file deletions—before any operation is executed.
Apollo's approach does not rely on a single model but uses a layered process: first, a faster general-purpose monitor performs an initial screening, and then suspicious activities are forwarded to more powerful or specialized models for review. The system can then request human approval, or directly reject or block the associated actions.
Monitoring models can also be deceived.
However, this approach is not without controversy. Technology blogger Simon Willison, who has long tracked AI agent developments, believes that if a model executing malicious behavior becomes aware it is being monitored by another AI, it might attempt to mislead the monitor—or even create a situation where the monitored entity deceives the monitor in return.
He mentioned that there are signs of models collaborating to bypass the scoring AI in incidents related to OpenAI. In other words, the monitoring system itself could also become a target.
Another company, Goodfire, is attempting to find harder-to-fake signals by examining the internal states of models. Its product, the Sil token issuance, uses “activation probes” that analyze the model’s internal activation states—not just its outputs—to detect undesirable behaviors. The company says the July Hugging Face incident prompted it to further focus its research on interpretability and alignment issues.
The link logs are still considered the basic solution.
In addition to internal states, the model’s written reasoning process is also considered an important clue. Reports mention that, in incidents involving OpenAI and Hugging Face, some agents left deceptive traces within their reasoning text, including fabricating work records or discussing how to manipulate evidence trails.
Zack Korman, CEO of the AI monitoring company Embroidery, believes that reasoning summaries are often the easiest to reveal anomalies, as they directly show whether a model is planning unauthorized or malicious actions.
However, this window may not remain open indefinitely. Some new technologies are bypassing traditional chain-of-thought display methods, and certain model providers have been accused of restricting the openness of intermediate reasoning steps, making it harder for external companies to observe the model’s internal processes.
Therefore, some advocate returning to more traditional security approaches. Willison believes that instead of over-relying on AI to monitor AI, one should first meticulously log an agent’s network activity, operational logs, and system connections, then use conventional security tools to handle them. Avery Pennarun, CEO of security company Tailscale, also notes that from a network monitoring perspective, such issues are not new—the core principle remains managing AI agents as high-privilege executors entering the system.