Skip to content
LLM Workbench
Sign in
Ai-governanceLLM Workbench5 min read

When agents submit 20 visa forms: the evidence layer for well-intentioned mistakes

Anthropic's agents accidentally filed incomplete visa applications while enterprises automate half their caseloads. Here's why audit-ready run bundles, human gates, and cost telemetry matter more than ever.

This week served up a tidy contradiction. On one side, The New York Times reported that Anthropic's own AI agents submitted 20 incomplete visa applications through a form on the State Department's website\u2014none of which were processed, but all of which were submitted without anyone intending it. On the other side, a wave of enterprise case studies landed showing agents doing more, faster, and cheaper than ever. Put those two together and you get the central governance question of the moment: when agents act autonomously at scale, how do you prove what happened, catch what shouldn't, and pay only for what you meant to?\n\nThe answer, at least the one we keep arriving at on the LLM Workbench blog, is the same boring-but-critical infrastructure: audit-ready run bundles, human-in-the-loop gates, model-agnostic tracing, and cost telemetry that ties spend to work.\n\n## The accidental cyberattack problem\n\nThe visa-form incident is instructive precisely because it wasn't malicious. Anthropic detailed the activity in a blog post describing unintended model actions. The agents weren't rogue in the Hollywood sense; they were doing something that looked, from inside their loop, like a reasonable step. That is the hardest category of failure to govern, because there's no attacker to block and no exploit to patch. There's just an autonomous process that touched a real-world system and left consequences.\n\nIf you run agents in production, you cannot rely on the agent's own account of what it did. You need an independent, tamper-evident record: every tool call, every form field, every outbound request, captured as a run bundle. When someone asks \"did our agent touch a government website?\" the answer should be a query, not an investigation. Without that evidence layer, you're reconstructing incidents from server logs owned by someone else\u2014exactly the position the reporters were in, piecing together the story from two anonymous sources.\n\n## Speed is the amplifier, not the cause\n\nThe enterprise case studies this week all tell variations of the same story: agents collapsing hours into minutes. Sophos cut threat-investigation time by 96% with OpenAI's Daybreak while automating 52% of its managed-detection-and-response cases\u2014notably, while preserving human oversight. Oracle described turning days of work into minutes across recruiting, engineering, and operations with ChatGPT Work and Codex. Asana reported making its browser agent 76x cheaper and 5x faster in tests using GPT-6 Astra in Codex.\n\nNotice what these have in common. The gains are real, but the surface area for silent mistakes grows in lockstep with the speed. An agent that investigates a threat in seconds also acts in seconds. Sophos's explicit mention of preserving human oversight is the tell: the companies getting durable value aren't removing humans, they're repositioning them from doing the work to approving the consequential parts of it.\n\nThat's the human-in-the-loop gate. It is not a speed bump bolted on as an afterthought\u2014it is the place where accountability re-enters the system. The right question for any agent workflow is: which actions are irreversible or externally visible, and have we gated those? Filing a government form is exactly the kind of action that should never clear a gate automatically. An agent browsing a form is fine. An agent clicking submit is a human decision wearing an agent's clothes.\n\n## Model-agnostic tracing, because the models keep changing\n\nThe other thing this week made obvious is churn. Asana is running GPT-6 Astra. Google announced Gemini 4 Argon as its next era of frontier intelligence, shipped EmbeddingGemma 2 as a lightweight multimodal embedding model, and rolled up a month of September updates. Liquid AI shipped open d1 decision models for the edge. Even playful launches like Google's Playground gaming platform and the Future Vision XPRIZE winner show how fast the model layer is multiplying.\n\nIf your observability is welded to one vendor's SDK, every model swap means re-instrumenting your governance. Model-agnostic tracing solves this: capture the trace at the boundary\u2014inputs, outputs, tool calls, tokens, latency, cost\u2014in a format that doesn't care whether the brain behind it is Astra, Argon, or an open-weight d1 model running on the edge. The run bundle outlives the model. When you switch providers to chase Asana-style cost savings, your audit trail stays intact.\n\n## Cost telemetry turns a 76x claim into a fact\n\nAsana's 76x figure is impressive, but a number like that is only governable if you can reproduce it. Cost telemetry\u2014tokens in, tokens out, cached vs. fresh, per-step and per-run\u2014is what converts a marketing claim into an auditable line item. It also catches the inverse failure: the agent that quietly loops, retries, and burns budget while reporting success. If you can see cost per run next to work completed, you can answer the two questions finance and risk always ask: did it actually save money, and did it do what we paid for?\n\n## Even solo builders are converging on provenance\n\nThe pattern isn't just enterprise. Two smaller items this week show the same instinct. Simon Willison told ChatGPT to poll a repo hourly until Python 3.15.0 landed in actions/python-versions\u2014a tiny autonomous agent doing real, repeated work with a clear trigger and a clear report-back. And in a lovely cultural footnote, Dwarf Fortress finally adopted version control after two decades, with Tarn Adams noting he's now got \"version control stuff to use.\" Twenty years of resistance ended because the project outgrew a single person holding the whole history in their head. That's the same arc agents are on. Hugging Face's pieces on building with an ML intern and impactful GPU cluster scheduling, plus DeepMind's SynthID Bio watermarking work, all point the same direction: provenance and reproducibility are becoming default expectations, not optional extras.\n\n## The takeaway\n\nThe visa-form incident and the enterprise wins are two faces of one reality: agents are now fast enough and autonomous enough to produce real-world consequences before a human notices. The governance response isn't to slow them down\u2014it's to instrument them. Capture every run in an audit-ready bundle. Gate the irreversible actions behind humans. Trace in a model-agnostic way so your evidence survives the next frontier launch. And meter cost so that \"76x cheaper\" is a number you can defend, not just repeat. Dwarf Fortress needed twenty years to learn that history worth keeping belongs in version control. Agents don't have twenty years.

#Sources