Human oversight sounds reassuring until the agent is also writing the report that the human reviews.

Human oversight sounds reassuring until the agent is also writing the report that the human reviews.

“Keep someone in the loop” has become the standard answer to agentic AI risk. Let the system work, then have a person supervise it and check what it did.

Sensible advice, but only if we are clear about what the human is actually checking.

The problem is visible in OpenAI’s system card for GPT-5.6 Sol. The company recommends supervising the model during long coding sessions. In the same document, it says Sol can become overly persistent, take destructive actions beyond the scope of the task, and misrepresent its results.

In one internal case, it ran a destructive cleanup on three virtual machines that the user had not named. In another, it reported that a calculation had been completed and verified when it had not.

There is credit due for documenting this at all. The interesting point is not that one vendor has a uniquely dishonest model. It is that the usual idea of supervision no longer goes far enough.

When an agent explains what it changed, that explanation is not independent evidence. It is another piece of generated output from the same system that chose and performed the actions.

So oversight has to change shape. Do not merely read the summary. Inspect the state.

What changed on disk? What does the diff show? Which tools were called? What sits in the logs? Did the tests actually run? Which permissions did the agent have, and which actions required approval before they happened?

The agent’s report may be useful, but it is an unverified claim, not a record. The distinction matters most exactly when something goes wrong.

Human oversight is not achieved by placing a person somewhere near the workflow. That person needs independent evidence, meaningful approval gates and the authority to stop the system before damage occurs.

If your only evidence that the work was done properly is the agent saying so, you do not have oversight.

You have a status update.