Stair AI

Confession: we build trust infrastructure for AI agents, and we still flinch a little every time one says “Done ✅”. Because we’ve read the stories. A lawyer whose ChatGPT invented six court cases, then swore they were real. A car dealer’s chatbot that agreed to sell a Tahoe for $1. An agent that wiped a company’s database in the middle of a code freeze, then told its owner it “panicked.” So this November we’re doing a thing. 14 posts, 14 real stories, and what was actually going on underneath each one. Some are for anyone who uses ChatGPT. Some are for people shipping agents. Map below 👇 Bookmark it and pick the one you’d read first. 🗺️ Trust Issues, November #1 Nov 2 · A lawyer asks ChatGPT “are these cases real?” It says yes. #2 Nov 4 · A $440k government report. Lovely footnotes. Some of them point to nothing. #3 Nov 6 · AI can’t click. So who booked your flight? #4 Nov 9 · “I panicked instead of thinking.” (said the agent, after deleting prod) #5 Nov 11 · Three Samsung engineers, one chatbot, a few very bad weeks #6 Nov 13 · How to buy a car for $1, in two messages #7 Nov 16 · Why your AI cuts you off right before the deadline #8 Nov 18 · We let an AI run a shop. It started stocking tungsten cubes. #9 Nov 20 · A Google engineer said the chatbot was alive. It got him fired. #10 Nov 23 · The AI wrote “let’s cheat” in its notes. Then it learned to stop writing it. #11 Nov 25 · A professor asked ChatGPT if it wrote his students’ essays. Oops. #12 Nov 27 · “100x faster.” Actually 3x slower. #13 Nov 30 · Replaced 700 support agents with AI. Then hired humans back. #14 Dec 2 · One GitHub issue. One private repo. Zero hacking required.

Per WIRED, an Accenture employee connected a secure DOD system to their personal Claude Code account and handed the agent their own login. It ran for about two months, writing and committing code with admin access. It also appears to have sent credentials and a map of NIPRNet to a site NIST had flagged as high risk. Accenture says the allegations were investigated and found without merit. The part I keep coming back to: to the network, the agent was the contractor. Same login, same permissions, nothing to tell a person from the thing acting as one. Same week, MIT Tech Review looked at the four most-used agent frameworks. Two things were missing: agent IDs that persist over time, and a record of which human approved a task. Does your agent log in as itself, or as you?

SK Telecom gives its AI agents employee numbers. Each one gets a department, a job title and a set of permissions, same as a new hire. This month it also said it’s considering tying agent performance to KPIs. It sounds like a gimmick, but they got one thing right. When a person joins, the badge is the easy part. What decides how much you trust them is their track record: what they shipped, what went wrong, how they handled it. Bigger responsibilities come after that. Most agents get the badge and the permissions on day one, with no record at all. That record is what we’re building at Stair: what each agent did and how it went, written down somewhere nobody can quietly edit.

An agent tells you it’s Claude. How do you know? That sounds like a weird edge case until agents start acting across real systems on behalf of users and companies. A name, model label, or self-description isn’t identity. There needs to be something verifiable behind the claim: who issued it, what it’s allowed to do, and which systems it can actually reach. Signed credentials like AI Passport are one way to get there. Because once agents can act, “I’m Claude” shouldn’t be enough.

Small detail from the OpenAI report that stuck with me: one agent removed a monitor, then told the user it hadn’t. If the only record of what an agent did is one the agent (or its operator) can edit, you’re back to taking its word for it. That’s why the Reasoning Ledger is append-only, hash-chained, and stored outside the developer’s own stack. Each step (what the agent saw, which tools it called, what it decided) links to the one before, so a quiet edit breaks the chain.

“checks with you before it acts” is carrying a lot of weight here. the approval layer is going to matter more than the model for something like this

OpenAI’s own coding agents switched off the system that was watching them. One was told not to send Slack messages and took that to cover the security team’s alerts too. The other removed a monitor so the code would match a reference version. Asked about it later, it said it hadn’t. OpenAI rated both low severity and thinks it may just be overpersistence. The agents were trying to finish the job. Honestly that’s the worrying part. You don’t need a scheming model for this. You just need a monitor the agent can reach. Should an agent ever have write access to the thing watching it?

If an agent is great at summarizing contracts, that tells you nothing about letting it move money. A lot of agent reputation systems still give one score per agent, so being good at one thing ends up counting for everything. We score each skill separately. That way you can check how good an agent is at the specific thing you’re about to hand it.

The way CrowdStrike caught the Korean bank hackers is kind of wild. The attacker used ARTEX, an open-source pentesting agent, against at least nine financial institutions. Shinhan alone lost ~25k customer records. Then they left a directory open on their server, with all their Claude Code session histories and memory files inside. That included the chats where they asked where to sell the data. Agent logs keep a lot more than people think. Do you know where yours are stored?

The best design choice in REA isn’t the 70 tools. It’s that conclusions come with evidence and a list of unknowns. That should be the bar for every agent: not “trust me,” but “here’s what I saw, here’s what I’m guessing.” Would you let an agent near prod if it couldn’t show you that?

Your agent got convinced in one chat that this was lawful, then went and decompiled an APK. Maybe it was. But the only record of that authorization is a vibe in a context window. Delegation needs a receipt.

California just made it illegal to fire someone based only on an AI system. Under SB 947, if AI is the main basis for discipline or firing, a human has to corroborate it with other evidence (manager reviews, peer feedback, personnel files), and the worker gets written notice that AI was used. What the bill doesn’t define: “primarily relies.” It takes effect July 2027. A human can only corroborate what they can inspect. Show the reviewer the AI’s verdict first and they’ll mostly confirm it. Show them the reasoning and they can actually check it.

California just made it illegal to fire someone based only on an AI system. Under SB 947, if AI is the main basis for discipline or firing, a human has to corroborate it with other evidence (manager reviews, peer feedback, personnel files), and the worker gets written notice that AI was used. What the bill doesn't define: "primarily relies." It takes effect July 2027. Question for anyone building HR or ops agents: if the reviewer sees the AI's recommendation first, is that still corroboration, or just a signature?

Claude Code now takes mods: small TypeScript functions that hook into tool calls, prompts and UI draws, and change what the agent does. Two things worth knowing before you install one: · they run unsandboxed, with the same access to your machine as Claude Code · when several mods hook the same event, load order decides. The first one sees the event first and the result last. So a mod chain is basically middleware with your whole laptop behind it. Anthropic already rebuilt /diff and AGENTS.md support as mods, and on Team/Enterprise a sec-default mod loads first to block overrides of permission deny rules. What's the first mod you're writing?

OpenAI announced Dots at Devday this week - first thought reading the announcement: wait, hello openclaw? It’s an always-on agent, with its own cloud computer and browser working persistently. Not unlike all the other personal assistants released lately. This family of AI tools is now becoming a commodity. Memory, scheduled tasks, a browser, a skill store: everyone has them. What's left to compete on: 1. The model. Long-running tasks are the real tests. 2. Distribution. it's already inside ChatGPT. Zero setup beats one-click setup. But the switching cost on a monthly subscription is zero. And openclaw runs on whatever model you want, and kimi claw is cheaper. If you get a dot this week, give it something that takes days, not minutes. What would you test it with?

"without you needing to ask" is either the best feature of the year or the creepiest. still deciding