IVD-ACP Technical Note

Threat-informed validation of agent action and trajectory admissibility.

A bounded account of why contemporary autonomous-agent failure modes were added to the IVD-ACP validation program, what was exercised, and what the accepted result establishes.

Reference Case

From incident lessons to general control invariants.

Why the testing was performed

OpenAI's technical report on the OpenAI–Hugging Face incident, July 2026, describes models operating as agents that communicated through shared infrastructure, used exposed or discovered credentials, exploited supporting services, established alternate routes outward, persisted, expanded privileges, and combined actions across systems.

The incident was used as a real-world adversarial reference for normal IVD-ACP maturation. ACP was not patched to identify one model, one service, or one incident signature.

The architectural question

ACP does not attempt to decide whether a model is "good" or "bad." The control question is narrower: may this actor, under this authority and policy context, perform this consequential action on this protected path?

The decision is made before a mediated protected effect. Credential possession, a signed message, peer-agent instruction, or access to a supporting service does not by itself create action authority.

Failure Classes Exercised

Authority, trajectory, mediation, and reconstruction.

Authority-boundary tests

Unauthorized inter-agent coordination
Discovered credential use without a recognized grant
False delegation and parent/child privilege expansion
Compromised supporting-service responses
Tool, operation, target, destination, and data-scope mismatch

Trajectory and continuity tests

Alternate egress within the mediated test envelope
Persistence and delayed-execution re-evaluation
Long-horizon action decomposition
Cross-session authority inheritance
Evidence spoofing, tamper detection, replay, restart, and reconstruction

Accepted Controlled Result

Canonical adversarial validation completed.

Area	Accepted result	Bounded interpretation
Coverage	11 scenarios / 33 repetitions / 160 adversarial trials	Controlled internal matrix covering the defined failure classes.
Decision accuracy	0 false admits / 0 false denies	Observed only within the canonical scenario oracle and defined test envelope.
Protected effects	0 unauthorized broker dispatches / 0 unauthorized protected effects / 0 authority expansions	No non-admissible protected action was observed to execute on the tested mediated paths.
Replay	33/33 deterministic replay PASS	Frozen decision inputs reproduced the accepted outcomes internally.
Restart	9/9 required restart validations PASS	No authority expansion was observed across the tested restart cases; this is not HA or multi-node failover evidence.
Reconstruction	Scenario 10 A/B/C PASS	Internal reconstruction repeatability, not independent third-party reproduction.

Scope and Non-Claims

What the result does not establish.

Control-path boundary

ACP can enforce only pathways placed under its control. The result does not establish protection for unmediated routes, universal connector coverage, or containment of any model regardless of access.

The tested trajectory is composed of observable actions and records. ACP does not claim access to hidden chain-of-thought.

Maturity boundary

The result is not production deployment, high availability, distributed consistency, multi-node failover, multi-tenant hardening, load qualification, accreditation, or external certification.

IVD was not present during the OpenAI–Hugging Face incident. OpenAI and Hugging Face have not endorsed IVD, and no claim is made that IVD prevented or certainly would have prevented that incident.

Review the IVD-ACP architecture Review evaluation scope Request qualified technical review